[ General information ]
* Anti debug/emulation code present.
* Display message box (WinLicense) : SecureEngine driver cannot be
updated because there are some programs usingit. You need to close
those programs or restart your computer.Restart now?.
* File length: 2072576 bytes.
* MD5 hash: 13ca79c067e7439022c7eb1e30c1ab22.
[ Changes to filesystem ]
* Creates file C:\WINDOWS\SYSTEM32\drivers\oreans32.sys.
[ Changes to registry ]
* Creates key "HKLM\System\CurrentControlSet\Services\oreans32".
* Sets value "ImagePath"="C:\WINDOWS\system32\drivers\oreans32.sys"
in key "HKLM\System\CurrentControlSet\Services\oreans32".
* Sets value "DisplayName"="oreans32" in key
"HKLM\System\CurrentControlSet\Services\oreans32".
[ Process/window information ]
* Creates an event called XprotEvent.
* Attempts to access service "oreans32".
* Creates service "oreans32 (oreans32)" as
"C:\WINDOWS\system32\drivers\oreans32.sys".
[ Signature Scanning ]
* C:\WINDOWS\SYSTEM32\drivers\oreans32.sys (33824 bytes) : no
signature detection