Reply to thread

Message

<blockquote data-quote="128BPM" data-source="post: 725926" data-attributes="member: 70265">@[USER=68429]NoVirusThanks[/USER]Previous FPs are fixed, now:Date/Time: 10/04/2018 07:50:36 p.m.Process: [3376]C:\Windows\System32\rundll32.exeProcess MD5 Hash: C36BB659F08F046B139C8D1B980BF1ACParent: [2568]C:\Windows\System32\control.exeRule: PreventRundll32Control_RunDLLRule Name: Prevent rundll32.exe from using Control_RunDLL (shell32.dll)Command Line: &quot;C:\Windows\system32\rundll32.exe&quot; Shell32.dll,Control_RunDLL &quot;C:\Windows\system32\timedate.cpl&quot;,Signer:Parent Signer:User/Domain: PC/PCIntegrity Level: MediumParent Integrity Level: MediumDate/Time: 10/04/2018 08:07:11 p.m.Process: [5100]C:\Windows\System32\mmc.exeProcess MD5 Hash: 007665F8DE4B18F82CEC63313F8ADCD2Parent: [1548]C:\Windows\explorer.exeRule: BlockMSCScriptsRule Name: Block execution of .msc scriptsCommand Line: &quot;C:\Windows\system32\mmc.exe&quot; C:\Windows\system32\devmgmt.mscSigner:Parent Signer:User/Domain: PC/PCIntegrity Level: HighParent Integrity Level: MediumDate/Time: 10/04/2018 08:08:18 p.m.Process: [4620]C:\Windows\System32\DeviceDisplayObjectProvider.exeProcess MD5 Hash: 7E2EB3A4AE11190EF4C8A9B9A9123234Parent: [764]C:\Windows\System32\svchost.exeRule: BlockSuspiciousSvchostBehaviorsRule Name: Block suspicious Svchost.exe process behaviorsCommand Line: C:\Windows\system32\DeviceDisplayObjectProvider.exe -EmbeddingSigner:Parent Signer:User/Domain: PC/PCIntegrity Level: MediumParent Integrity Level: SystemNote: Could you add an option to reset the log? Thanks.</blockquote>

[QUOTE="128BPM, post: 725926, member: 70265"] @[B][USER=68429]NoVirusThanks[/USER][/B] [B]Previous FPs are fixed, now:[/B] Date/Time: 10/04/2018 07:50:36 p.m. Process: [3376]C:\Windows\System32\rundll32.exe Process MD5 Hash: C36BB659F08F046B139C8D1B980BF1AC Parent: [2568]C:\Windows\System32\control.exe Rule: PreventRundll32Control_RunDLL Rule Name: Prevent rundll32.exe from using Control_RunDLL (shell32.dll) Command Line: "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\system32\timedate.cpl", Signer: Parent Signer: User/Domain: PC/PC Integrity Level: Medium Parent Integrity Level: Medium Date/Time: 10/04/2018 08:07:11 p.m. Process: [5100]C:\Windows\System32\mmc.exe Process MD5 Hash: 007665F8DE4B18F82CEC63313F8ADCD2 Parent: [1548]C:\Windows\explorer.exe Rule: BlockMSCScripts Rule Name: Block execution of .msc scripts Command Line: "C:\Windows\system32\mmc.exe" C:\Windows\system32\devmgmt.msc Signer: Parent Signer: User/Domain: PC/PC Integrity Level: High Parent Integrity Level: Medium Date/Time: 10/04/2018 08:08:18 p.m. Process: [4620]C:\Windows\System32\DeviceDisplayObjectProvider.exe Process MD5 Hash: 7E2EB3A4AE11190EF4C8A9B9A9123234 Parent: [764]C:\Windows\System32\svchost.exe Rule: BlockSuspiciousSvchostBehaviors Rule Name: Block suspicious Svchost.exe process behaviors Command Line: C:\Windows\system32\DeviceDisplayObjectProvider.exe -Embedding Signer: Parent Signer: User/Domain: PC/PC Integrity Level: Medium Parent Integrity Level: System Note: Could you add an option to reset the log? Thanks. [/QUOTE]

Verification