RSASecured.exe

zst470396853

GD

左手

[mw_shl_code=css,true]2017-9-25 21:16:07    修改注册表值 风险提示:敏感    阻止
进程: c:\documents and settings\administrator\桌面\rsasecured.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [应用程序]?:\*\*\*\* -> [注册表组]阻止_优先黑名单

2017-9-25 21:16:07    修改注册表值 风险提示:敏感    阻止
进程: c:\documents and settings\administrator\桌面\rsasecured.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [应用程序]?:\*\*\*\* -> [注册表组]阻止_优先黑名单

2017-9-25 21:16:17    加载动态链接库 风险提示:中风险    允许
进程: c:\documents and settings\administrator\桌面\rsasecured.exe
目标: c:\windows\system32\dnsapi.dll
规则: [应用程序]* -> [动态链接库]c:\windows\system32\dnsapi.dll

2017-9-25 21:16:27    访问网络 风险提示:未知    允许
进程: c:\documents and settings\administrator\桌面\rsasecured.exe
目标: TCP [本机 : 2959] ->  [145.14.145.143 : 443 (https)]
规则: [应用程序]*.exe -> [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2017-9-25 21:16:44    创建新进程 风险提示:未知    允许
进程: c:\documents and settings\administrator\桌面\rsasecured.exe
目标: c:\program files\common files\microsoft shared\dw\dw20.exe
命令行: dw20.exe -x -s 1240
规则: [应用程序组]→a999_★《临时规则_安装模式》★ -> [子应用程序]c:\program files\common files\*.exe

2017-9-25 21:16:44    修改注册表值 风险提示:敏感    阻止
进程: c:\program files\common files\microsoft shared\dw\dw20.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [应用程序组]→a070_SystemRoot《系统程序》 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

2017-9-25 21:16:44    修改注册表值 风险提示:敏感    阻止
进程: c:\program files\common files\microsoft shared\dw\dw20.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Personal
值: C:\Documents and Settings\Administrator\My Documents
规则: [应用程序组]→a070_SystemRoot《系统程序》 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

2017-9-25 21:16:44    修改注册表值 风险提示:敏感    阻止
进程: c:\program files\common files\microsoft shared\dw\dw20.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [应用程序组]→a070_SystemRoot《系统程序》 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

2017-9-25 21:16:44    修改注册表值 风险提示:敏感    阻止
进程: c:\program files\common files\microsoft shared\dw\dw20.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [应用程序组]→a070_SystemRoot《系统程序》 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

2017-9-25 21:16:44    修改注册表值 风险提示:敏感    阻止
进程: c:\program files\common files\microsoft shared\dw\dw20.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [应用程序组]→a070_SystemRoot《系统程序》 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

2017-9-25 21:16:44    修改注册表值 风险提示:敏感    阻止
进程: c:\program files\common files\microsoft shared\dw\dw20.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common AppData
值: C:\Documents and Settings\All Users\Application Data
规则: [应用程序组]→a070_SystemRoot《系统程序》 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

2017-9-25 21:16:44    修改注册表值 风险提示:敏感    阻止
进程: c:\program files\common files\microsoft shared\dw\dw20.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [应用程序组]→a070_SystemRoot《系统程序》 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

2017-9-25 21:16:44    修改注册表值 风险提示:敏感    阻止
进程: c:\program files\common files\microsoft shared\dw\dw20.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
值: 0x00000000(0)
规则: [应用程序]?:\program files\*\*.exe -> [注册表组]阻止_优先黑名单

2017-9-25 21:16:44    修改注册表值 风险提示:敏感    阻止
进程: c:\program files\common files\microsoft shared\dw\dw20.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
值: 150.176.182.31;80:80
规则: [应用程序]?:\program files\*\*.exe -> [注册表组]阻止_优先黑名单

2017-9-25 21:16:44    修改注册表值 风险提示:敏感    阻止
进程: c:\program files\common files\microsoft shared\dw\dw20.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
值: *.local
规则: [应用程序]?:\program files\*\*.exe -> [注册表组]阻止_优先黑名单
[/mw_shl_code]

好想用EMSI

"Object","Threat","Action","Path",
"rsasecured.exe","Trojan.DownLoader21.33794","已隔离","C:\users\cosmos\appdata\local\temp\hz$d.679.4922\rsasecured.exe",
黑寡妇的

jm123ok

毒霸扫描miss