Reply to thread

Message

<blockquote data-quote="simmerskool" data-source="post: 1065618" data-attributes="member: 61091">[USER=62850]@danb[/USER] I think it was standard... <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite132" alt=":unsure:" title="Unsure&nbsp; &nbsp; :unsure:" loading="lazy" data-shortname=":unsure:" /> I found it yesterday &amp; today in settings | user log | (copy / paste follows)2023-11-16 15:36&nbsp; &nbsp; Auto Blocked&nbsp; &nbsp; mpcmdrun.exe&nbsp; &nbsp; c:\programdata\microsoft\windows defender\platform\4.18.2303.8-0\mpcmdrun.exe&nbsp; &nbsp; 226FACBDC52C7A6F7E4E140CBA0E2EF4AC5E60DC&nbsp; &nbsp; d710e889bee3b1ddae3c7cb15effa2964a5821c19a437e99553749d3740840eb&nbsp; &nbsp; &quot;c:\programdata\microsoft\windows defender\platform\4.18.2303.8-0\mpcmdrun.exe&quot; -wdenable&nbsp; &nbsp; 1645864&nbsp; &nbsp; svchost.exe&nbsp; &nbsp; &nbsp; &nbsp; (user name changed *** to protect the innocent)perhaps MORE interesting under Whitelist, mpcmdrun.exe is auto allowed and is listed 3 times: 2 have same hash, 1 has different hash, and none of those 3 match the blocked hash above, although VT says the above blocked hash is safe MS file,Original Name&nbsp; &nbsp; MpCmdRun.exeFile Version&nbsp; &nbsp; 4.18.2303.8 (WinBuild.160101.0800)perhaps different sha256 is windows update to this exe (I assume) <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite132" alt=":unsure:" title="Unsure&nbsp; &nbsp; :unsure:" loading="lazy" data-shortname=":unsure:" />This CL auto block was caused by &quot;the chain&quot;...<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite132" alt=":unsure:" title="Unsure&nbsp; &nbsp; :unsure:" loading="lazy" data-shortname=":unsure:" />EDIT by the chain, I mean mpcmdrun.exe was triggered not in the usual manner? <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite132" alt=":unsure:" title="Unsure&nbsp; &nbsp; :unsure:" loading="lazy" data-shortname=":unsure:" /><img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite132" alt=":unsure:" title="Unsure&nbsp; &nbsp; :unsure:" loading="lazy" data-shortname=":unsure:" />On this VM, CL 7.60 was installed over 7.44 (now 7.61 over 7.60)</blockquote>

[QUOTE="simmerskool, post: 1065618, member: 61091"] [USER=62850]@danb[/USER] I think it was standard... :unsure: I found it yesterday & today in settings | user log | (copy / paste follows) 2023-11-16 15:36 Auto Blocked mpcmdrun.exe c:\programdata\microsoft\windows defender\platform\4.18.2303.8-0\mpcmdrun.exe 226FACBDC52C7A6F7E4E140CBA0E2EF4AC5E60DC d710e889bee3b1ddae3c7cb15effa2964a5821c19a437e99553749d3740840eb "c:\programdata\microsoft\windows defender\platform\4.18.2303.8-0\mpcmdrun.exe" -wdenable 1645864 svchost.exe (user name changed *** to protect the innocent) perhaps MORE interesting under Whitelist, mpcmdrun.exe is auto allowed and is listed 3 times: 2 have same hash, 1 has different hash, and none of those 3 match the blocked hash above, although VT says the above blocked hash is safe MS file, Original Name MpCmdRun.exe File Version 4.18.2303.8 (WinBuild.160101.0800) perhaps different sha256 is windows update to this exe (I assume) :unsure: This CL auto block was caused by "the chain"...:unsure: EDIT by the chain, I mean mpcmdrun.exe was triggered not in the usual manner? :unsure::unsure: On this VM, CL 7.60 was installed over 7.44 (now 7.61 over 7.60) [/QUOTE]

Verification