西游Q记

allinwonderi

[ General information ]
    * File length:       122380 bytes.
    * MD5 hash: 539cba6a706acc74a1f261a260453b0c.

[ Changes to filesystem ]
    * Creates directory C:.
    * Creates directory C:\PROGRA~1.
    * Creates directory C:\PROGRA~1\\xed@_V.
    * Creates file C:\PROGRA~1\\xed@_V\__tmp_rar_sfx_access_check_55378093.
    * Deletes file __tmp_rar_sfx_access_check_55378093.
    * Creates file C:\PROGRA~1\\xed@_V\gongju.exe.

[ Changes to registry ]
    * Accesses Registry key "HKLM\Software\Microsoft\Windows\CurrentVersion".
    * Accesses Registry key "HKCU\Software\WinRAR SFX".
    * Creates key "HKCU\Software\WinRAR SFX".
    * Sets value "C%%PROGRA~1%\xed@_V"="C:\PROGRA~1\\xed@_V" in key "HKCU\Software\WinRAR SFX".

[ Process/window information ]
    * Creates a dialogbox with caption "WinRAR \xea\xe3\x8b\x87\xf6".
    * Buttons found in dialogbox: id102[278,173]"O\xc8(&W)..." id1[211,223]"\x89\xc5" id2[278,223]"\xd6\x88" .
    * Creates a window with name "".
    * Pressing button with id 1 "".
    * Attemps to NULL C:\PROGRA~1\\xed@_V\gongju.exe NULL.
    * Creates process "gongju.exe".

[ Signature Scanning ]
    * C:\PROGRA~1\\xed@_V\gongju.exe (26450 bytes) : no signature detection.