Process Explorer

But SVC host is essentially a process that runs on every Windows system, and it's very prominent.

You'll have it running right now, but most average normal users won't be able to know that ISO environment broker is running in the background unless they use something like Process Explorer or from Sysinternals or something of the like to actually break down some of these processes that run on Windows.

However, this is kind of what they're doing, where they're putting it, and we're kind of just tracking down all these changes so we can strip them out, we can use tweaks and kind of fix the glitch that they're going to add.

They're also going to make a DLL in here from parameter.

The attackers scour the Internet for old, legitimate, legally signed drivers from real hardware companies.

For example, a graphics card diagnostic tool from 2015 or an old version of Process Explorer.

Drivers that have valid signatures but also contain known unpatched security flaws like buffer overflows.

Precisely.

Okay.

The text points to the Sysinternal suite, specifically the tools Process Explorer and Process Monitor.

Oh, I've heard of those.

Mark Russinovich's tools, right?

These are utilities that hook directly into the Windows kernel.

Whoa.

If you launch Process Explorer, you don't just see the building, you see every single hidden thread inside it.

So you see all the employees?

VM map, RAM map.

So it's indexed sysinternals, Windows memory diagnostic, resource monitor, core info, perfmon, task manager, process explorer.

Oh, I forgot about RAM map.

And if you click open, you can see a

okay i like that let me try that with start right uh document now is this ai is this a model is this a is this an official this

is actually really simple because what it's doing is when you launch it when you first download it and you launch it it looks through the windows settings it looks through what installed applications and inventories that list that you saw earlier and for each one of those that it finds it goes through enrichment and enrichment includes collecting trying to get as much information about this thing as it can besides just the file name so you talked about getting the description out of the file this gets the description out of the file but it goes a step further when it comes to an image it'll go in it'll go in and look at the resources.

Because one of the things that I found as I was playing with this is that I would say view memory usage in Process Explorer wouldn't come up.

And it turns out that there's no information really anywhere that Process Explorer actually shows you memory.

The Stephen Whiting, maybe.

What's the difference between this and Sysinternals Process Explorer?

I don't know.

You know what? It's funny.

Now, I have seen process.

Is it ProcMon or ProcExplorer?

Oh, he's asking about Process Explorer.

Okay.