Analysis
- max time kernel
60s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 09:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_fc1f818bc6d1d3139bb906c2bee206403313f297b35bcb9224c86a9b320e3a3f.exe
Resource
win10v2004-20260911-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_fc1f818bc6d1d3139bb906c2bee206403313f297b35bcb9224c86a9b320e3a3f.exe
Resource
win11ltsc2024-20260911-en
7 signatures
150 seconds
General
- Target jaffacakes118_fc1f818bc6d1d3139bb906c2bee206403313f297b35bcb9224c86a9b320e3a3f.exe
- Size 116KB
- Sample261002-lac7qaeg65
- SHA256 fc1f818bc6d1d3139bb906c2bee206403313f297b35bcb9224c86a9b320e3a3f
- MD5 dcff6340fa2850128c6c306481019709
- SHA1 0732618d684f3b2b8844dd77c13de97df541e12f
- SHA512 90b4e4e05dab71fe7b1b0cc850cca850967d3a33d8b6ccfd9f87494e5a57913824cccbd0a47ba2ba38596f38c5972758a98e5b451e9b60972876da4a323b47f4
- SSDEEP 3072:YRKc83vrUdVxAOxEiNMk0WRaJpLBTMb/p:yKP4dVxAOx3Ok0WVp
- TLSH T16AC37113FB15BC5DE09085761C328AEAA655BD3288117D13BB517FAB2E331877AF0A13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5616 snddrv.exe 4856 snddrv.exe 5272 snddrv.exe 3312 snddrv.exe 6124 snddrv.exe 3136 snddrv.exe 1676 snddrv.exe 4560 snddrv.exe 2724 snddrv.exe 2536 snddrv.exe 3532 snddrv.exe 3604 snddrv.exe 5100 snddrv.exe 5424 snddrv.exe 6100 snddrv.exe 5712 snddrv.exe 3444 snddrv.exe 1668 snddrv.exe 2188 snddrv.exe 4568 snddrv.exe 1276 snddrv.exe 4832 snddrv.exe 252 snddrv.exe 3804 snddrv.exe 4792 snddrv.exe 1900 snddrv.exe 2448 snddrv.exe 696 snddrv.exe 2284 snddrv.exe 5464 snddrv.exe 1684 snddrv.exe 1848 snddrv.exe 2456 snddrv.exe 4356 snddrv.exe 5944 snddrv.exe 3928 snddrv.exe 4872 snddrv.exe 4156 snddrv.exe 5532 snddrv.exe 2936 snddrv.exe 1208 snddrv.exe 6108 snddrv.exe 3448 snddrv.exe 1336 snddrv.exe 4116 snddrv.exe 4284 snddrv.exe 1120 snddrv.exe 1204 snddrv.exe 4868 snddrv.exe 1084 snddrv.exe 1932 snddrv.exe 3240 snddrv.exe 4924 snddrv.exe 5252 snddrv.exe 4300 snddrv.exe 796 snddrv.exe 2808 snddrv.exe 5912 snddrv.exe 1740 snddrv.exe 2984 snddrv.exe 3544 snddrv.exe 1656 snddrv.exe 5372 snddrv.exe 4424 snddrv.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Ac97Sound = "C:\\Windows\\system32\\snddrv.exe" jaffacakes118_fc1f818bc6d1d3139bb906c2bee206403313f297b35bcb9224c86a9b320e3a3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\microsystem = "C:\\Windows\\system32\\snddrv.exe" jaffacakes118_fc1f818bc6d1d3139bb906c2bee206403313f297b35bcb9224c86a9b320e3a3f.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\snddrv.exe jaffacakes118_fc1f818bc6d1d3139bb906c2bee206403313f297b35bcb9224c86a9b320e3a3f.exe File created C:\Windows\SysWOW64\snddrv.exe jaffacakes118_fc1f818bc6d1d3139bb906c2bee206403313f297b35bcb9224c86a9b320e3a3f.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_fc1f818bc6d1d3139bb906c2bee206403313f297b35bcb9224c86a9b320e3a3f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snddrv.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4228 jaffacakes118_fc1f818bc6d1d3139bb906c2bee206403313f297b35bcb9224c86a9b320e3a3f.exe 4228 jaffacakes118_fc1f818bc6d1d3139bb906c2bee206403313f297b35bcb9224c86a9b320e3a3f.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4228 jaffacakes118_fc1f818bc6d1d3139bb906c2bee206403313f297b35bcb9224c86a9b320e3a3f.exe 5616 snddrv.exe 4856 snddrv.exe 5272 snddrv.exe 3312 snddrv.exe 6124 snddrv.exe 3136 snddrv.exe 1676 snddrv.exe 4560 snddrv.exe 2724 snddrv.exe 2536 snddrv.exe 3532 snddrv.exe 3604 snddrv.exe 5100 snddrv.exe 5424 snddrv.exe 6100 snddrv.exe 5712 snddrv.exe 3444 snddrv.exe 1668 snddrv.exe 2188 snddrv.exe 4568 snddrv.exe 1276 snddrv.exe 4832 snddrv.exe 252 snddrv.exe 3804 snddrv.exe 4792 snddrv.exe 1900 snddrv.exe 2448 snddrv.exe 696 snddrv.exe 2284 snddrv.exe 5464 snddrv.exe 1684 snddrv.exe 1848 snddrv.exe 2456 snddrv.exe 4356 snddrv.exe 5944 snddrv.exe 3928 snddrv.exe 4872 snddrv.exe 4156 snddrv.exe 5532 snddrv.exe 2936 snddrv.exe 1208 snddrv.exe 6108 snddrv.exe 3448 snddrv.exe 1336 snddrv.exe 4116 snddrv.exe 4284 snddrv.exe 1120 snddrv.exe 1204 snddrv.exe 4868 snddrv.exe 1084 snddrv.exe 1932 snddrv.exe 3240 snddrv.exe 4924 snddrv.exe 5252 snddrv.exe 4300 snddrv.exe 796 snddrv.exe 2808 snddrv.exe 5912 snddrv.exe 1740 snddrv.exe 2984 snddrv.exe 3544 snddrv.exe 1656 snddrv.exe 5372 snddrv.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4228 wrote to memory of 5616 4228 jaffacakes118_fc1f818bc6d1d3139bb906c2bee206403313f297b35bcb9224c86a9b320e3a3f.exe 89 PID 5616 wrote to memory of 4856 5616 snddrv.exe 90 PID 4856 wrote to memory of 5272 4856 snddrv.exe 91 PID 5272 wrote to memory of 3312 5272 snddrv.exe 92 PID 3312 wrote to memory of 6124 3312 snddrv.exe 93 PID 6124 wrote to memory of 3136 6124 snddrv.exe 94 PID 3136 wrote to memory of 1676 3136 snddrv.exe 95 PID 1676 wrote to memory of 4560 1676 snddrv.exe 96 PID 4560 wrote to memory of 2724 4560 snddrv.exe 97 PID 2724 wrote to memory of 2536 2724 snddrv.exe 98 PID 2536 wrote to memory of 3532 2536 snddrv.exe 99 PID 3532 wrote to memory of 3604 3532 snddrv.exe 100 PID 3604 wrote to memory of 5100 3604 snddrv.exe 101 PID 5100 wrote to memory of 5424 5100 snddrv.exe 102 PID 5424 wrote to memory of 6100 5424 snddrv.exe 103 PID 6100 wrote to memory of 5712 6100 snddrv.exe 104 PID 5712 wrote to memory of 3444 5712 snddrv.exe 105 PID 3444 wrote to memory of 1668 3444 snddrv.exe 106 PID 1668 wrote to memory of 2188 1668 snddrv.exe 107 PID 2188 wrote to memory of 4568 2188 snddrv.exe 108 PID 4568 wrote to memory of 1276 4568 snddrv.exe 109 PID 1276 wrote to memory of 4832 1276 snddrv.exe 110 PID 4832 wrote to memory of 252 4832 snddrv.exe 111 PID 252 wrote to memory of 3804 252 snddrv.exe 112 PID 3804 wrote to memory of 4792 3804 snddrv.exe 113 PID 4792 wrote to memory of 1900 4792 snddrv.exe 114 PID 1900 wrote to memory of 2448 1900 snddrv.exe 115 PID 2448 wrote to memory of 696 2448 snddrv.exe 116 PID 696 wrote to memory of 2284 696 snddrv.exe 117 PID 2284 wrote to memory of 5464 2284 snddrv.exe 118 PID 5464 wrote to memory of 1684 5464 snddrv.exe 119 PID 1684 wrote to memory of 1848 1684 snddrv.exe 120 PID 1848 wrote to memory of 2456 1848 snddrv.exe 121 PID 2456 wrote to memory of 4356 2456 snddrv.exe 122 PID 4356 wrote to memory of 5944 4356 snddrv.exe 123 PID 5944 wrote to memory of 3928 5944 snddrv.exe 124 PID 3928 wrote to memory of 4872 3928 snddrv.exe 125 PID 4872 wrote to memory of 4156 4872 snddrv.exe 126 PID 4156 wrote to memory of 5532 4156 snddrv.exe 127 PID 5532 wrote to memory of 2936 5532 snddrv.exe 128 PID 2936 wrote to memory of 1208 2936 snddrv.exe 129 PID 1208 wrote to memory of 6108 1208 snddrv.exe 130 PID 6108 wrote to memory of 3448 6108 snddrv.exe 131 PID 3448 wrote to memory of 1336 3448 snddrv.exe 132 PID 1336 wrote to memory of 4116 1336 snddrv.exe 133 PID 4116 wrote to memory of 4284 4116 snddrv.exe 134 PID 4284 wrote to memory of 1120 4284 snddrv.exe 135 PID 1120 wrote to memory of 1204 1120 snddrv.exe 136 PID 1204 wrote to memory of 4868 1204 snddrv.exe 137 PID 4868 wrote to memory of 1084 4868 snddrv.exe 138 PID 1084 wrote to memory of 1932 1084 snddrv.exe 139 PID 1932 wrote to memory of 3240 1932 snddrv.exe 140 PID 3240 wrote to memory of 4924 3240 snddrv.exe 141 PID 4924 wrote to memory of 5252 4924 snddrv.exe 142 PID 5252 wrote to memory of 4300 5252 snddrv.exe 143 PID 4300 wrote to memory of 796 4300 snddrv.exe 144 PID 796 wrote to memory of 2808 796 snddrv.exe 145 PID 2808 wrote to memory of 5912 2808 snddrv.exe 146 PID 5912 wrote to memory of 1740 5912 snddrv.exe 147 PID 1740 wrote to memory of 2984 1740 snddrv.exe 148 PID 2984 wrote to memory of 3544 2984 snddrv.exe 149 PID 3544 wrote to memory of 1656 3544 snddrv.exe 150 PID 1656 wrote to memory of 5372 1656 snddrv.exe 151 PID 5372 wrote to memory of 4424 5372 snddrv.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fc1f818bc6d1d3139bb906c2bee206403313f297b35bcb9224c86a9b320e3a3f.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fc1f818bc6d1d3139bb906c2bee206403313f297b35bcb9224c86a9b320e3a3f.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe13⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe14⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe15⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe17⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe18⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe20⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe21⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe22⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe23⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe24⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe25⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe26⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe27⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe28⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe29⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe30⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe31⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe32⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe33⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe34⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe35⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe36⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe38⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe39⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe40⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe41⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe43⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe44⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe45⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe46⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe47⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe48⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe49⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe50⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe51⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe52⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe53⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe54⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe55⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe56⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe57⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe58⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe59⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe60⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe61⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe62⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe63⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe64⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe65⤵
- Executes dropped EXE
PID:4424 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe66⤵PID:5984
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe67⤵
- System Location Discovery: System Language Discovery
PID:1484 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe68⤵PID:4656
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe69⤵PID:2360
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe70⤵PID:5604
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe71⤵PID:5592
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe72⤵PID:5884
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe73⤵
- System Location Discovery: System Language Discovery
PID:5088 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe74⤵PID:2108
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe75⤵PID:3384
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe76⤵PID:5576
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe77⤵PID:6084
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe78⤵PID:6052
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe79⤵
- System Location Discovery: System Language Discovery
PID:4308 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe80⤵PID:1508
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe81⤵PID:4772
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe82⤵PID:1592
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe83⤵PID:2304
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe84⤵PID:5052
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe85⤵PID:1452
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe86⤵PID:2380
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe87⤵PID:3612
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe88⤵PID:3648
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe89⤵PID:6092
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe90⤵
- System Location Discovery: System Language Discovery
PID:5992 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe91⤵PID:1992
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe92⤵
- System Location Discovery: System Language Discovery
PID:4796 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe93⤵PID:4608
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe94⤵
- System Location Discovery: System Language Discovery
PID:5308 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe95⤵PID:748
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe96⤵PID:2452
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe97⤵PID:1112
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe98⤵PID:4800
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe99⤵PID:5828
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe100⤵PID:4040
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe101⤵PID:4460
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe102⤵PID:2840
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe103⤵PID:2792
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe104⤵PID:3512
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe105⤵PID:4892
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe106⤵PID:4048
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe107⤵PID:4776
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe108⤵PID:1464
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe109⤵PID:5900
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe110⤵PID:5352
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe111⤵PID:2276
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe112⤵PID:5784
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe113⤵PID:2112
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe114⤵PID:3500
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe115⤵PID:3116
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe116⤵PID:5716
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe117⤵PID:5240
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe118⤵
- System Location Discovery: System Language Discovery
PID:2940 -
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe119⤵PID:4884
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe120⤵PID:248
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe121⤵PID:3944
-
C:\Windows\SysWOW64\snddrv.exeC:\Windows\system32\snddrv.exe122⤵PID:1564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-