1 &OK 2 &Cancel 114 tries to a file 115 tries to files 116 tries to rename a file 117 creates files on different machines 118 deletes and recreates an existing file 119 creates and then executes a file 120 tries to copy itself 121 tries to write to the ini file 122 tries to write to the registry 123 tries to call in 124 tries to write to the address space of another running process 125 tries to create a thread in the address space of another running process 126 monitors key strokes 127 creates a COM object 128 tries to send a HTTP request 129 performs a HTTP download 130 creates network connections 131 listens for network connections 132 sends pings 133 downloads an email containing a suspicious link 134 named 135 in 136 that looks like an executable 137 containing executable code 138 with a suspicious double extension 139 within seconds 140 from 141 to 142 so it has a suspicious double extension 143 having 144 within seconds 145 to 146 to 147 to 148 with 149 with a URL longer than bytes 150 with a header longer than bytes 151 to 152 retrieving 153 retrieving a file of type 154 from the 155 on port 156 to the same domain or IP 157 kill the source process 158 inform the local user 159 write event to the system log 160 send an administarative alert 161 prevent the file access 162 prevent the file rename 163 prevent the copy 164 prevent the file write 165 prevent the registry write 166 prevent the memory write 167 prevent the thread creation 168 prevent the object creation 169 block the request 170 disable the link 171 prevent the connection 172 prevent the listen 173 no options available 174 Error 175 read 176 write 177 delete 178 create 179 execute 180 INI Files (*.ini) 181 DLL Files (*.dll) 182 All Files (*.*) 183 When 184 or 185 then 186 When any process 187 When any non-interactive process 188 When an email program or web browser 189 process list 190 Functions 191 You must click on the underlined items and configure them before continuing 192 and 193 the source process is in the system process list 194 the source process is in the trusted process list 195 the source process is 196 the target file is 197 the target file is in 198 the target files are 199 the target files are in 200 the target file is originally named 201 the target file is renamed to 202 the target ini file is 203 the target ini section is

204 the target value is 205 the target registry key is 206 the downloaded file is 207 the downloaded file type is 208 the port is 209 except when 210 delete the file 211 Registry Keys 212 Registry Values 213 Domains or IP Addresses 214 Ports 12323 &Back 12324 &Next 12325 &Finish