CmdID

CmdID / Files

SearchIndexer.exe

Microsoft Windows Search Indexer file version info

Program on Windows 20 known copies with hashes 4 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real SearchIndexer.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductWindows Search, Microsoft Corporation
DescriptionMicrosoft Windows Search Indexer

20 known copies

7.0.22000.282 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\SearchIndexer.exe · signed by Microsoft Windows

cb1b0b0d8a4c093cff7cbb711cbeccce38ef409c0d15e9030be093dde71357bb

7.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\SearchIndexer.exe · signed by Microsoft Windows

3548a0c05a9ace8823296737b2c8131a7a3b0b5a3c53eb55f60816dc73dcd10a

7.0.19041.610 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SearchIndexer.exe · signed by Microsoft Windows

35da9f518b4f90af76b014c1d8b0232e1f58adfaba900df0e49da8511eceb932

7.0.19041.488 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SearchIndexer.exe · signed by Microsoft Windows

710af458414e90bc0b312d63b0a2cd7552227b269d0d617fcf93f02775948dd4

7.0.19041.329 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SearchIndexer.exe · signed by Microsoft Windows

73aac2d2c4cc1163a67aaf96247fff2d98269d1eddebee3c8fe1f01ee7391b70

7.0.19041.1151 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SearchIndexer.exe · signed by Microsoft Windows

b2f7e272a5e959b6feba8720cd63db34ee638d5d3419a00cdcd3a3753e725c30

7.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\SearchIndexer.exe · signed by Microsoft Windows

127dafa6f4b9f39191e8532be9772b29a269f4c9df5e78dcbf759c6f3d98b99f

7.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\SearchIndexer.exe · signed by Microsoft Windows

6177cdd79d82143de463486d22de69416db3da99a91c0b65e8708a295baef2ea

7.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\SearchIndexer.exe · signed by Microsoft Windows

63b92d3657ec7e81ad3a8ad8eca83c456752eb654715518732da1adc9c4241ad

7.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\SearchIndexer.exe · signed by Microsoft Windows

efa17d9342fc498ff6ebaef54fa2b5777ffd43e8786370d18b5f4364582d3d62

7.0.18362.719 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\SearchIndexer.exe · signed by Microsoft Windows

a1b94298c0bac96946de1850ab76781a9e4d6a2efa8f631ab78d55da7e88d62d

7.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\SearchIndexer.exe · signed by Microsoft Windows

8adf07e9a1511872e185fbe22914c2130c77ae7b2def2fe33da5de319470df0e

7.0.17763.1490 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SearchIndexer.exe · signed by Microsoft Windows

8fac5e5ee7e0cfad8684ea66605282d0b006fa151a484904860a961eeef09750

7.0.17763.1369 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SearchIndexer.exe · signed by Microsoft Windows

745fe249f9f28fdf2972148187479231a01d18c29e5a75a2b7e93458effd66ed

7.0.17763.1098 (WinBuild.160101.0800) · C:\windows\SysWOW64\SearchIndexer.exe · signed by Microsoft Windows

ec58d7f640cfcb9c6971803c5ba3a51fbdea36d2c4de4183feca955a1080e00f

7.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\SearchIndexer.exe · signed by Microsoft Windows

1b31e6cb35f3aac01e663d3bd98fa90129b5f1744ae70bf1dc3af464f284a573

7.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\SearchIndexer.exe · signed by Microsoft Windows

55b4b3510bcfaf831389b14a27f67417e1c4ab8d4c33c7c62bc7c4927a2c02bb

7.0.17763.1 (WinBuild.160101.0800) · C:\windows\system32\SearchIndexer.exe · signed by Microsoft Windows

e30696aad9ed79a56608b561fb521908b764b2fa169d93e671b3b30e5b08ae40

7.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\SearchIndexer.exe · signed by Microsoft Windows

02aa6d3040ffe4ef897cebc89f9d641f13dc27969b88eafba6a1eee6ba9d019e

7.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\SearchIndexer.exe · signed by Microsoft Windows

e5daafede3a97adb0f532c988427ca51e73640b74d0dbc68a7a57d77a9d9a424

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name SearchIndexer.exe
highAbused Debug Privilege by Arbitrary Parent ProcessesSemanur Guneysu @semanurtg, oscd.community
mediumUnusual Parent Process For Cmd.EXETim Rauch, Elastic (idea)

Sigma names SearchIndexer.exe in 4 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.