CmdID

CmdID / Files

AVCore.exe

AnyViewer is a remote monitoring and management (RMM) tool. LOLRMM

Program on Windows LOLRMM AnyViewer 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

A file of AnyViewer

a remote management tool, from LOLRMM

LOLRMM lists a file named AVCore.exe as AnyViewer’s.

From LOLRMM (Apache 2.0), which lists the remote management tools intruders are known to use as well as administrators. It goes by the file’s name.

What detects it

Sigma process creation rules that name AVCore.exe