Untitled

<group desc="Access to the Windows Registry" id=1>
      <name>Registry</name>
      <info>The program accesses the Windows Registry</info>
</group>

<group desc="Access to the file system" id=2>
      <name>File system</name>
      <info>The program accesses files on a data medium</info>
</group>

<rule desc="is a run/runonce registry key opened?" id=1>
     <name>RegOpenKey</name>
     <argument>
        <index>2</Index>
        <action>EqualSubString</action>
        <data>Run</data>
     </argument>
</rule>

<rule desc="print 1st CreateFile argument" id=2>
     <name>"CreateFile"</name>
     <argument>
        <index>1</index>
        <action>PrintString</action>
     </argument>
</rule>


<ruleset desc="Registry run/runonce" id=1>
     <group>1</group>
     <op type="OR">
         <rule ref="1"</rule>
         <rule ref="n"</rule>
     </op>
     <info>Registry startup method (run/runonce)</info>
</ruleset>

<ruleset desc="CreateFile file access" id=2>
     <group>2</group>
     <rule>2</rule>
     <info>Accesses the following file:</info>
</ruleset>