CmdID

CmdID / Files

SndVol.exe

Volume Mixer file version info

Program on Windows 14 known copies with hashes 3 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real SndVol.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionVolume Mixer

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\SndVol.exe · signed by Microsoft Windows

9ed12dd2bf49002b916dfbe71a234f6d5a8f186113911dd70dc1bce0bcba12a3

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\SndVol.exe · signed by Microsoft Windows

e8dca95f237c2e8d3159b1dcf18d89c23285360b3c8525df4df88dc90b157d96

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\SndVol.exe · signed by Microsoft Windows

5be12686c75a1f034eac11031a7440ea40731298df5f7296b2c5462028793bf3

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\SndVol.exe · signed by Microsoft Windows

68b6ced01f5dfc2bc9556b005f4fff235a3d02449ad9f9e4de627c0e1424d605

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SndVol.exe · signed by Microsoft Windows

d68ddc4be84705357288ba972939aa9aa5f95537ebc059c3ff3ccaae11638fca

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SndVol.exe · signed by Microsoft Windows

f9555fd7f2a7ce9ee6b5ce664762d1292908ac4c04c0d28c8ecc25edc26435fa

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\SndVol.exe · signed by Microsoft Windows

1b436ab7d1c60434605ae3ab18f8f9c4d89496cfd07f3295fdfb93f8e1058929

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\SndVol.exe · signed by Microsoft Windows

3689a43858db4845b5da04ec5140e0616118d56a99f0c498ed5a90c4e9998cab

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SndVol.exe · signed by Microsoft Windows

439997e510099ccd0d086dc1a99df6651ced076b34df2029a6cbbdad6204b469

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\SndVol.exe · signed by Microsoft Windows

496feebc8bece33f0d6b5f11b7d03a6a7826ea3d72ac253fbc528c5c3aee72ff

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\SndVol.exe · signed by Microsoft Windows

1ff763f1bd807c33d52a9c28482f55916417a0cd221099ac4132714200bf6ec4

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\SndVol.exe · signed by Microsoft Windows

aeb8f9088436f40063d13c600cfdccff67d2682ba973cbbe83e8b2b76bfa6121

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\SndVol.exe · signed by Microsoft Windows

496fa6bf30f3205fb2232a1706d6de91b3a5e27cd2c2cccb70b7a3a0e29c091b

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\SndVol.exe · signed by Microsoft Windows

8b72fc4ca330772da1236d6a809452db4f6fb3ce62f80f2b5750e65a74d799d8

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name SndVol.exe
highPotential Pikabot Hollowing ActivityAndreas Braathen (mnemonic.io)
mediumUncommon Child Processes Of SndVol.exeX__Junior (Nextron Systems)

Sigma names SndVol.exe in 3 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.