6ba4afd26b41d287eb3ad5d3be32192b140f8d980caa0841b21ac5e2112925bc

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 01:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OpticFilm 8200i_12L_V6.1.0.3.exe
Size 32.2MB
Sample260810-bnyepsydkd
SHA256 6ba4afd26b41d287eb3ad5d3be32192b140f8d980caa0841b21ac5e2112925bc
MD5 08f832b0fcdb1c2cbb01a003d944c8f1
SHA1 c1b51fca28086f6d45a90e739629c81e5d45e7a8
SHA512 99ff77772f447db336e5a89bef971b6dae49054613428836d9b72dac2f128010561c893d0c89852223004980ef9d00e0d04f351b8dc0fa30b0d90f69039d69fa
SSDEEP 786432:ATRffPznt4kKRARK+tKSdt1f2Fo9c1M7WrJU/WKyXARMHtRMrn:Alzt4hydtKIYucApnyQcErn
TLSH
T1EB77337311EA5CFFE14B2EB9461F9901782A79024224B8FFDB69DEB1B5363D014207A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery ransomware

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Drivers\USBSb992.rra	Setup.exe
File opened for modification	C:\Windows\SysWOW64\Drivers\USBSb992.rra	Setup.exe
File opened for modification	C:\Windows\SysWOW64\Drivers\USBSCAN.SYS	Setup.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File created	C:\Windows\system32\PkWiaDrv20_A2F_x64.dll	Install64.exe
File opened for modification	C:\Windows\system32\PkWiaDrv20_A2F_x64.dll	Install64.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{16b9555c-58c8-d840-9fd5-aa01c2a24ccc}\SETD279.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{16b9555c-58c8-d840-9fd5-aa01c2a24ccc}\A1C_A2FU_x64.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\a1c_a2fu_x64.inf_amd64_8a9066a454e6f0a0.ini	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\a1c_a2fu_x64.inf_amd64_8a9066a454e6f0a0\A1C_A2FU_x64.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\system32\PkImgFilter_x64.dll	Install64.exe
File created	C:\Windows\system32\PkWiaError_x64.dll	Install64.exe
File created	C:\Windows\System32\DriverStore\Temp\{16b9555c-58c8-d840-9fd5-aa01c2a24ccc}\SETD27A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\a1c_a2fu_x64.inf_amd64_8a9066a454e6f0a0\A1C_A2FU_x64.inf	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\MSVCP50.DLL	Setup.exe
File created	C:\Windows\system32\PkWiaDrv20_A1C_x64.dll	Install64.exe
File opened for modification	C:\Windows\system32\PkImgFilter_x64.dll	Install64.exe
File created	C:\Windows\system32\PkWiaScanUI_x64.dll	Install64.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{16b9555c-58c8-d840-9fd5-aa01c2a24ccc}\A1C_A2FU_x64.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{16b9555c-58c8-d840-9fd5-aa01c2a24ccc}\SETD27A.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{16b9555c-58c8-d840-9fd5-aa01c2a24ccc}	DrvInst.exe
File created	C:\Windows\system32\spool\drivers\color\Filmbd99.rra	Setup.exe
File opened for modification	C:\Windows\system32\spool\drivers\color\Film Scanner(A2F).icm	Setup.exe
File opened for modification	C:\Windows\system32\PkWiaDrv20_A1C_x64.dll	Install64.exe
File created	C:\Windows\system32\PkSegFilter_x64.dll	Install64.exe
File opened for modification	C:\Windows\system32\PkSegFilter_x64.dll	Install64.exe
File opened for modification	C:\Windows\system32\PkWiaError_x64.dll	Install64.exe
File opened for modification	C:\Windows\system32\PkWiaScanUI_x64.dll	Install64.exe
File created	C:\Windows\System32\DriverStore\Temp\{16b9555c-58c8-d840-9fd5-aa01c2a24ccc}\SETD279.tmp	DrvInst.exe
File created	C:\Windows\SysWOW64\MSVCc00a.rra	Setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\InstallShield Installation Information\{086AA359-A8F0-46BB-B66D-21AE29420B81}\setup.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\module.ini	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\plkcom32.dll	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\Album.exe	Setup.exe
File created	C:\Program Files (x86)\Plustek\OpticFilm 8200i\actibfbc.rra	Setup.exe
File created	C:\Program Files (x86)\InstallShield Installation Information\{086AA359-A8F0-46BB-B66D-21AE29420B81}\datab905.rra	Setup.exe
File opened for modification	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\Obj61BB.tmp	Setup.exe
File created	C:\Program Files (x86)\Plustek\OpticFilm 8200i\Albubef1.rra	Setup.exe
File created	C:\Program Files (x86)\Plustek\OpticFilm 8200i\IM31bf3f.rra	Setup.exe
File created	C:\Program Files (x86)\Plustek\OpticFilm 8200i\Scanbd8a.rra	Setup.exe
File created	C:\Program Files (x86)\Plustek\OpticFilm 8200i\Quicbe74.rra	Setup.exe
File opened for modification	C:\Program Files (x86)\InstallShield Installation Information	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\IM31XBMP.DEL	Setup.exe
File created	C:\Program Files (x86)\Plustek\OpticFilm 8200i\Help\Quicbfcc.rra	Setup.exe
File created	C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\A1C_c838.rra	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\Usbscan.sy_	Setup.exe
File created	C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\PkWic876.rra	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\PkWiaDrv20_A2F.dll	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\PkSegFilter.dll	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\Scndrvu_x64.drv	Setup.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\Dot6168.tmp	Setup.exe
File opened for modification	C:\Program Files (x86)\InstallShield Installation Information\{086AA359-A8F0-46BB-B66D-21AE29420B81}\setup.skin	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\prndrv32.dll	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\QuickScan.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\IM31FAX.DIL	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\IM31PCD.DIL	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\IM31xpcx.del	Setup.exe
File opened for modification	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\Dot6168.tmp	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\scandrv.dll	Setup.exe
File created	C:\Program Files (x86)\Plustek\OpticFilm 8200i\prndbdd8.rra	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\devcon64.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\OpticFilmRes_x64.dll	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\PkWiaLang.ini	Setup.exe
File created	C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\PkWic886.rra	Setup.exe
File created	C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\PkImc8a5.rra	Setup.exe
File opened for modification	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\isp4159.tmp\iGdi.dll	Setup.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\IsP619B.tmp	Setup.exe
File created	C:\Program Files (x86)\InstallShield Installation Information\{086AA359-A8F0-46BB-B66D-21AE29420B81}\setub925.rra	Setup.exe
File opened for modification	C:\Program Files (x86)\InstallShield Installation Information\{086AA359-A8F0-46BB-B66D-21AE29420B81}\setup.inx	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\ScanApi_07b3_130d.ini	Setup.exe
File created	C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\Usbsc867.rra	Setup.exe
File created	C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\PkImc8b5.rra	Setup.exe
File created	C:\Program Files (x86)\Plustek\OpticFilm 8200i\tiffbf10.rra	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\A1C_A2FU.cat	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\GetInst32.dll	Setup.exe
File created	C:\Program Files (x86)\InstallShield Installation Information\{086AA359-A8F0-46BB-B66D-21AE29420B81}\_setup.dll	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\ImgLib_x64.dll	Setup.exe
File created	C:\Program Files (x86)\Plustek\OpticFilm 8200i\im31bed2.rra	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\IM31TIF.DIL	Setup.exe
File opened for modification	C:\Program Files (x86)\InstallShield Installation Information\{086AA359-A8F0-46BB-B66D-21AE29420B81}\layout.bin	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\DetectSession_x64.dll	Setup.exe
File created	C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\PkWic896.rra	Setup.exe
File created	C:\Program Files (x86)\Plustek\OpticFilm 8200i\Pcdlbdc8.rra	Setup.exe
File created	C:\Program Files (x86)\Plustek\OpticFilm 8200i\Optibfbc.rra	Setup.exe
File created	C:\Program Files (x86)\Plustek\OpticFilm 8200i\PkWic01a.rra	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\PkWiaDrv20_A2F_x64.dll	Setup.exe
File opened for modification	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\iKernel.rgs	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\Action_x64.dll	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\im31Gif.dil	Setup.exe
File created	C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\WIAAc867.rra	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\DPInst64.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\im31png_x64.dil	Setup.exe
File created	C:\Program Files (x86)\Plustek\OpticFilm 8200i\scanbcee.rra	Setup.exe
File opened for modification	C:\Program Files (x86)\Plustek\OpticFilm 8200i\ScanApi_07b3_1825-20241113.ini	Setup.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	Setinf.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem1.inf	DrvInst.exe
File created	C:\Windows\inf\oem1.inf	DrvInst.exe
File created	C:\Windows\System\Usbsb992.rra	Setup.exe
File opened for modification	C:\Windows\System\Usbscan.sys	Setup.exe
File opened for modification	C:\Windows\A2FU.INI	Setup.exe

Executes dropped EXE 11 IoCs

pid	Process
4676	install.exe
5488	Setup.exe
5568	Setup.exe
984	CheckSystemVersion.exe
10088	QuickScan_x64.exe
440	QuickScan_x64.exe
1220	Install64.exe
6776	Setinf.exe
9572	QuickScan_x64.exe
10144	ComScan.exe
9768	broadcast.exe

Loads dropped DLL 45 IoCs

pid	Process
5568	Setup.exe
5568	Setup.exe
5568	Setup.exe
5568	Setup.exe
5568	Setup.exe
5568	Setup.exe
5568	Setup.exe
5568	Setup.exe
5568	Setup.exe
5568	Setup.exe
5568	Setup.exe
5568	Setup.exe
5568	Setup.exe
5568	Setup.exe
5568	Setup.exe
5568	Setup.exe
5568	Setup.exe
5568	Setup.exe
5568	Setup.exe
5568	Setup.exe
5568	Setup.exe
5568	Setup.exe
5568	Setup.exe
5568	Setup.exe
5568	Setup.exe
5568	Setup.exe
10088	QuickScan_x64.exe
10088	QuickScan_x64.exe
10088	QuickScan_x64.exe
10088	QuickScan_x64.exe
10088	QuickScan_x64.exe
10088	QuickScan_x64.exe
440	QuickScan_x64.exe
440	QuickScan_x64.exe
440	QuickScan_x64.exe
440	QuickScan_x64.exe
440	QuickScan_x64.exe
9572	QuickScan_x64.exe
9572	QuickScan_x64.exe
9572	QuickScan_x64.exe
9572	QuickScan_x64.exe
9572	QuickScan_x64.exe
10088	QuickScan_x64.exe
10088	QuickScan_x64.exe
10088	QuickScan_x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OpticFilm 8200i_12L_V6.1.0.3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheckSystemVersion.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setinf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComScan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	broadcast.exe

Checks SCSI registry key(s) 3 TTPs 29 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000940e18cbc83cc7300000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801940e18cb0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101940e18cb000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3940e18cb00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6940e18cb00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{91814EBF-B5F0-11D2-80B9-00104B1F6CEA}\TypeLib\Version = "1.0"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C3C1B13-E59D-11D2-B40B-00A024B9DDDD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C3C1B16-E59D-11D2-B40B-00A024B9DDDD}\TypeLib	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{761C8359-55AF-4E7B-9C83-C1A927E0F617}\TypeLib	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9CFCFE67-0BB8-43E0-8425-378D0A02ACE4}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8415DDF9-1C1D-11D3-889D-00C04F72F303}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2067-CB55-11D2-8094-00104B1F9838}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{39040274-3D36-11D3-88EE-00C04F72F303}\TypeLib\Version = "1.0"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28FC629B-276F-4D7D-9A67-E748A7E036DB}\AppID = "{73938DFD-B098-4A0C-BE18-07D04C634722}"	ComScan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A74C06E4-12DF-4060-9AA7-83CFAA66D604}\ProxyStubClsid32	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2067-CB55-11D2-8094-00104B1F9838}\ = "ISetupStringTable"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7BB118F1-6D5B-470E-82D0-AFB042724560}\TypeLib	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D8B6332-D8B1-11D2-80C5-00104B1F6CEA}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AFED5DD0-0694-11D4-A934-00105A088FAC}\TypeLib\Version = "1.0"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B288F47-79AB-43A8-8494-D9F4D5985B29}	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E3CD7A86-04E4-4B47-88E8-3EE03A3DEE56}\ = "ISetupScriptEngine3"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BE0B3F76-166A-4DA5-A97C-318595E3D15C}\ProxyStubClsid32	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2061-CB55-11D2-8094-00104B1F9838}\TypeLib	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D4FF39B9-1A05-11D3-8896-00C04F72F303}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{761C8359-55AF-4E7B-9C83-C1A927E0F617}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E156322-57D4-448B-BAB4-35DC0C7ADF53}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83755DD1-086B-11D3-8868-00C04F72F303}	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ABF74802-8E5B-44EA-880E-8E128A06A113}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C3C1B11-E59D-11D2-B40B-00A024B9DDDD}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91CD1F51-7199-46FA-9629-9C89D2F1AE22}\ProxyStubClsid32	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DED5FEEC-225A-11D3-88AA-00C04F72F303}	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C3C1B13-E59D-11D2-B40B-00A024B9DDDD}	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9AEE3F7A-A79F-4B41-BC48-E7946FFEAB35}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2060-CB55-11D2-8094-00104B1F9838}	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0BA4BA22-2EF0-11D3-88C8-00C04F72F303}\TypeLib\Version = "1.0"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{39040274-3D36-11D3-88EE-00C04F72F303}	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65D37452-0EBB-11D3-887B-00C04F72F303}\ProxyStubClsid32	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{80FDE82A-2CAA-11D3-88C3-00C04F72F303}\ = "ISetupObjectReboot"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{94636247-BC39-4B8B-A728-2D1FBEBFA76A}	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BE6115A1-7DE5-48DC-AD2A-25060E00FCE2}\TypeLib	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8415DE38-1C1D-11D3-889D-00C04F72F303}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21D98482-146C-4EBF-AF1E-B04395110005}\ = "ISetupProgress3"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B12A5014-0AA8-451A-B621-F717998B0B53}\TypeLib	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8A3BF5A-8CC6-49F9-B88B-80960E67759C}	ComScan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE6115A1-7DE5-48DC-AD2A-25060E00FCE2}\TypeLib	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2069-CB55-11D2-8094-00104B1F9838}\TypeLib\Version = "1.0"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF57A6F0-4101-11D3-88F6-00C04F72F303}\TypeLib	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8415DDF9-1C1D-11D3-889D-00C04F72F303}	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8415DE38-1C1D-11D3-889D-00C04F72F303}\ProxyStubClsid32	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54DADAB2-28A6-11D3-88BA-00C04F72F303}\ = "ISetupCopyFiles"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D8B6332-D8B1-11D2-80C5-00104B1F6CEA}\ = "ISetupMainWindow"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{80FDE82A-2CAA-11D3-88C3-00C04F72F303}\TypeLib	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{761C8359-55AF-4E7B-9C83-C1A927E0F617}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EE77D8B-40C1-4A2A-9B77-421907F02058}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AFED5DD0-0694-11D4-A934-00105A088FAC}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CoPlkdrv.CoScannerCommander\CurVer\ = "CoPlkdrv.CoScannerCommander.1"	ComScan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D8B6332-D8B1-11D2-80C5-00104B1F6CEA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6494206F-23EA-11D3-88B0-00C04F72F303}\TypeLib	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B12A5014-0AA8-451A-B621-F717998B0B53}\ = "IInstallDriverVersion"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F1ABEE7-FEDB-45AF-A01B-0B4DE6887573}\ = "IMsiServer2001"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2A3A842-FBA3-49D4-8806-7734716364A2}\ProxyStubClsid32	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8415DDF9-1C1D-11D3-889D-00C04F72F303}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B288F47-79AB-43A8-8494-D9F4D5985B29}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B15A454-9067-4878-B10E-B9DFFE03049D}\ProxyStubClsid32	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C3C1B16-E59D-11D2-B40B-00A024B9DDDD}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F8CB9A40-3665-4D33-B239-32CA4C7B8DEA}\ProxyStubClsid32	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94F4A332-A2AE-11D3-8378-00C04F59FBE9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54DADAB3-28A6-11D3-88BA-00C04F72F303}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00A0DBE3-B12E-4DC3-8C27-4197CA4DF76B}\TypeLib\Version = "1.0"	Setup.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeBackupPrivilege	2220	vssvc.exe
Token: SeRestorePrivilege	2220	vssvc.exe
Token: SeAuditPrivilege	2220	vssvc.exe
Token: SeBackupPrivilege	2264	srtasks.exe
Token: SeRestorePrivilege	2264	srtasks.exe
Token: SeSecurityPrivilege	2264	srtasks.exe
Token: SeTakeOwnershipPrivilege	2264	srtasks.exe
Token: SeBackupPrivilege	2264	srtasks.exe
Token: SeRestorePrivilege	2264	srtasks.exe
Token: SeSecurityPrivilege	2264	srtasks.exe
Token: SeTakeOwnershipPrivilege	2264	srtasks.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
10088	QuickScan_x64.exe
10088	QuickScan_x64.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
10088	QuickScan_x64.exe
10088	QuickScan_x64.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2120	OpticFilm 8200i_12L_V6.1.0.3.exe
2120	OpticFilm 8200i_12L_V6.1.0.3.exe
10088	QuickScan_x64.exe
440	QuickScan_x64.exe
9572	QuickScan_x64.exe
10088	QuickScan_x64.exe
10088	QuickScan_x64.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 4676	2120	OpticFilm 8200i_12L_V6.1.0.3.exe	89
PID 4676 wrote to memory of 5488	4676	install.exe	90
PID 5488 wrote to memory of 5568	5488	Setup.exe	91
PID 5568 wrote to memory of 984	5568	Setup.exe	92
PID 5568 wrote to memory of 1220	5568	Setup.exe	105
PID 1220 wrote to memory of 9412	1220	Install64.exe	106
PID 9412 wrote to memory of 10084	9412	CMD.exe	108
PID 10084 wrote to memory of 10064	10084	net.exe	109
PID 1220 wrote to memory of 6800	1220	Install64.exe	110
PID 6800 wrote to memory of 2592	6800	CMD.exe	112
PID 2592 wrote to memory of 5888	2592	net.exe	113
PID 5568 wrote to memory of 6776	5568	Setup.exe	116
PID 5568 wrote to memory of 9572	5568	Setup.exe	118
PID 5568 wrote to memory of 10144	5568	Setup.exe	119
PID 5568 wrote to memory of 9768	5568	Setup.exe	120

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\OpticFilm 8200i_12L_V6.1.0.3.exe
"C:\Users\Admin\AppData\Local\Temp\OpticFilm 8200i_12L_V6.1.0.3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Users\Admin\AppData\Local\Temp\20251230-OpticFilm 8200i_12L_V6.1.0.3\install.exe
  "C:\Users\Admin\AppData\Local\Temp\20251230-OpticFilm 8200i_12L_V6.1.0.3\install.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Users\Admin\AppData\Local\Temp\20251230-OpticFilm 8200i_12L_V6.1.0.3\64bit\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\20251230-OpticFilm 8200i_12L_V6.1.0.3\64bit\Setup.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5488
  - - C:\Users\Admin\AppData\Local\Temp\20251230-OpticFilm 8200i_12L_V6.1.0.3\64bit\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\20251230-OpticFilm 8200i_12L_V6.1.0.3\64bit\Setup.exe" -deleter
      4⤵
      Drops file in Drivers directory
      Drops file in System32 directory
      Drops file in Program Files directory
      Drops file in Windows directory
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\{42FEA925-F7DC-4F11-9B07-35EBE0FDE4A4}\{086AA359-A8F0-46BB-B66D-21AE29420B81}\CheckSystemVersion.exe
        
        C:\Users\Admin\AppData\Local\Temp\{42FEA925-F7DC-4F11-9B07-35EBE0FDE4A4}\{086AA359-A8F0-46BB-B66D-21AE29420B81}\CheckSystemVersion.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:984
    - - C:\Users\Admin\AppData\Local\Temp\20251230-OpticFilm 8200i_12L_V6.1.0.3\64bit\Install64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\20251230-OpticFilm 8200i_12L_V6.1.0.3\64bit\Install64.exe" s
        5⤵
        Drops file in System32 directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1220
      - C:\Windows\system32\CMD.exe
        
        /c net stop stisvc
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:9412
        
        C:\Windows\system32\net.exe
        
        net stop stisvc
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:10084
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop stisvc
        8⤵
        
        PID:10064
      - C:\Windows\system32\CMD.exe
        
        /c net start stisvc
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:6800
        
        C:\Windows\system32\net.exe
        
        net start stisvc
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start stisvc
        8⤵
        
        PID:5888
    - - C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\Setinf.exe
        
        "C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\Setinf.exe"
        5⤵
        Drops file in Windows directory
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6776
    - - C:\Program Files (x86)\Plustek\OpticFilm 8200i\QuickScan_x64.exe
        
        "C:\Program Files (x86)\Plustek\OpticFilm 8200i\QuickScan_x64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:9572
    - - C:\Program Files (x86)\Common Files\Comscan\ComScan.exe
        
        "C:\Program Files (x86)\Common Files\Comscan\ComScan.exe" /regserver
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:10144
    - - C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\broadcast.exe
        
        "C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\broadcast.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:9768

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2220

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2264

C:\Program Files (x86)\Plustek\OpticFilm 8200i\QuickScan_x64.exe
"C:\Program Files (x86)\Plustek\OpticFilm 8200i\QuickScan_x64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:10088

C:\PROGRA~2\Plustek\OPTICF~1\QuickScan_x64.exe
C:\PROGRA~2\Plustek\OPTICF~1\QUICKS~2.EXE
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:3292

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{e3bf3da2-ccf3-144d-a176-547a27984f9c}\A1C_A2FU_x64.inf" "9" "403ece12f" "0000000000000190" "WinSta0\Default" "0000000000000194" "208" "C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:6304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ComScan.exe

Path C:\Program Files (x86)\Common Files\Comscan\ComScan.exe
Size 76KB
SHA256 579bdfe2bd4fe3fb8e5aa617cf795a1728a8e0d08d624383b6a889f53c3fae8b
MD5 253acde09ed8bdf5a06556e28eed4042
SHA1 2e02c53db307be2e56d7735f1919129010592290
SHA512 e867af27842cb5d1c095435b7495c908a1b2a529159abf62ed659baabfbc6500fa31705a3c80832568d5a7c3d9bf6b6f9ac52f41097a246527bb9bb2e77e9a63
SSDEEP 768:bqlqxEXTIpc8drKBaEi3LZ63f2wnqP3vjz43yiB95T6ZEzmKf/fFwe32l+njKRwo:bqtTIpc+mgOf2z4B28P3aDl+gpr
TLSH
T157739E33F6C088B2E31E40708C656B572BF9EE250F3289576B643ACE5E71AF69915703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetInstaller.exe

Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\DotNetInstaller.exe
Size 5KB
SHA256 4f9c15127e16eae3a7ddaed55817fb549ed31168f9861285c9349c468b260579
MD5 f89558047e71f655a4ddb99e893213ed
SHA1 68a0cd5af1aa62c46e965e8e5c85c33de4d4678a
SHA512 6ca5e7ba0db836f88685868d0788119fd441f47972907727f4eb711955f63cc74e3e818b93069a1c2baa5c49e387978acbe8ecfbbbc1723a7f40f4c0e41dac45
SSDEEP 48:67ndi0X7JBqVKk5YCfpZBAv8GPTUc4gQ+fzK/4hotiufsV5ZYNunoIwo8iwegMqu:4di0X7J0VJyopUwUQ+u/4FqsZYfNBsC
TLSH
T15AC17545E7E88336FDB78F3EBD7337824675BB108DA2976F05CE010A6C256608961B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ctor.dll

Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\ctor.dll
Size 68KB
SHA256 9620bdd78c1cad92a2118eab21e4dfa0ec8e9b59673adb84f917331b78402ad0
MD5 66cf4f30f925485e00191c16d00038c4
SHA1 80b576f6e5eebd5577cde81cbd6394136b9f08e6
SHA512 18072bdf7ab50132a08d620b5571c4c8ecb245124d91ebfda5cba1aac4fc41e020ae037cd7a49cfd119978b91c628428e85d2e7bf7ef362d319d9451e6c62cf3
SSDEEP 768:6mb6ReJQ+khADnEq+nZ15J8+DxhOHGyXClJS1NVCGJBVVgyw0oTH0w9nnbH67HIa:6q6ReJQlA5o0AhX7YnnwPJr67n
TLSH
T145633B1B23E3C5F1D7972332BB592B5E217E6E1531E1A3168F1349E32C3262BD662907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iGdi.dll

Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iGdi.dll
Size 184KB
SHA256 63671696aa87c0862e6381bc759116cd377c5331ab50ae6d05ba7cd29cf02580
MD5 298c79ac2f609736788cc7cacdeeef32
SHA1 1cce1dcc23a941e650edfeaa7de59327fa452ba2
SHA512 29fc496780a4fdac6a8c4af6b737973019e3087b5d3d8fe8625d4ce1de88e437eea0254d8900934846c6519ce0bffbcddfe1aa01cf5736b47dba58f06071fe23
SSDEEP 3072:QYHma2vpbx5asru0aotKiaSk7uH0pT/sm8yoHKrHpZkmJbGcLB+XGLkh:QYHmJx5aslJaSkikH/DN7ggkh
TLSH
T198049E0478E0C13FC7AF0272B9AB6F75E7FCE5210FA5458B97580E4C5F75A868A22247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iKernel.dll

Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iKernel.dll
Size 712KB
SHA256 3793e53ddac054f98f704399d2150d1c6a330b041cc65092a331eeffc7645b5a
MD5 104370cb3f834eba33fb5659b9f309b2
SHA1 03ba5b00a45582cafcf34d45f997d9b7cfd44d2f
SHA512 66981498abc544e809427fc789941b5d7e25e5bbe3817f96519a01c51ac39c569b275c2e62abd19d0ff8656db023a574d2aaf7703c22063e7b715acfa0ae6da2
SSDEEP 12288:lV93OHIzVStFXWD/z2/2nKN79VmT1XJy4VNnodcAHkbsnptT:lV9+HiOJWTz2/2nKN79Vm5ZZVNwcAHf3
TLSH
T173F48E1235B8C035F28E0232EA2C9B79E2FDDA654D3059473B588A5D6F75AC6C027F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iscript.dll

Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iscript.dll
Size 260KB
SHA256 a1c284e21ca49ef189e98e7847826556e64185c5542bd50c75ee30b25ea3d08a
MD5 84cfe010fd3403ad28835bb500a1a81b
SHA1 c57afea136a09266eae1af92bbd53d7c0b084ea0
SHA512 fce50dea91d5e34b6ede4a6dfa4978648062b0eb6fc167f12925002521674d513e978552b46ff3e693ae819bf695367d2fda70d5ee8e6fc7f44d205893e31ccb
SSDEEP 6144:TvOq2nKzn8ppgfI1ueM6Htmr3CTtJLON1:TvOq2KzCpgfI+nrUI
TLSH
T1AB447D1239B8C575C7DE0B31FA9A3F68A6FDE2248DF288430F594E1CDE37A45851252E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iuser.dll

Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iuser.dll
Size 188KB
SHA256 c25957200e1390b6a5facb4b1c52c55a8690bd3ca63dbb2f2cc770510e74448e
MD5 b54e00b79373514e838220436bd3f275
SHA1 9cea61a706a28439574d8f1aafe40cd040f5e156
SHA512 8efba669069d41c16e059cdf9bc74944e858b40e07f82a8160a3522e95ad770ab620bee78e0b10a184f31744931aeb790f4dcd4b895617875537ebd29b40a848
SSDEEP 3072:rR5V8qXjwUr2evAytiDQ6Vfo/x67VSKxE3hzHwJO4co5Ht/H157:95j8UrTtIuxmbxUrNYD/b
TLSH
T17214AE127AE0C47BD29B0132BF6B1F69B7FDD2448FF459878B100E9E9EB1946C422617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.dll

Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\setup.dll
Size 304KB
SHA256 8b70cbec0226a84516999cc24a921c2d750bd4213c88e617ab38569866b50af5
MD5 0dd582213ba9108b253822cf03122098
SHA1 0cdd47a5df2c3c2606d3e33f5a0fd619392feabe
SHA512 24fed8e3ac22ced561ada8a5af7df935d403215e7587d3255b69b60a19219fb75d3a16eaee67d77409fe5cffc674c90e868cc61e63ab0dc5ed5bc939e99bb98c
SSDEEP 6144:5KcG3qQUAOSeLfsNSJFFM2p66jmDHV5FsK6YrX81jjOuuk:5eqQUA2LcSJokd
TLSH
T1D964180276FA453AF2F72B30A97B1B655EBFBE615A38C04F4385154C1CB1AA5CA34723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IsP619B.tmp

Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\IsP619B.tmp
Size 101KB
SHA256 0858229878facde89776f9e4ec61e45cf14eca0bb6be9123234a9dedd0119c1a
MD5 fcd8f741b79248a1a25937cdc780ebc4
SHA1 f66ae868a445d4b802bfa369eff485f52b78782e
SHA512 c1854935c69b9c90ed8ffc8c8b9bdaf3dbbe5cafd835adf5732f19c1736b1b47e04842d3cf4cb0e813c39450c4c55f830145b196e8eb781465950b5c668aa3f0
SSDEEP 1536:ZEu4E2yFOSmAtonyhTwxv6F9ar1VqFtIqNG1lD+7NglO5/U:ZD4ERFTtEeQ6FfAzO5/U
TLSH
T1AFA35282FB82CAB3C40D0631581B63E61FB1E45A2E13B7573789536DAE733C1BB46664
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Objectps.dll

Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\Objectps.dll
Size 32KB
SHA256 b2278ce559b4d4cdce30c6b44f3664d1a6d1a5f0d9e1d99b87ba14bdcf31f4c5
MD5 f935e7f618e9fab282302c0951545417
SHA1 e04ea46a0445d78580839102164602a24e581464
SHA512 4f0f11b35415ad8879bd182de17dfdc43045133bc11107254cffb8478508ec21a5400c707d66186e042bfef865ddd628d5526b0d32e4e08d7ef8ceabf9d49218
SSDEEP 192:JnlX6cRWMxG4RMG180GoxMOSkA7sMC7znkDAa:B3B5Mcz6sMqgN
TLSH
T1E7E26412EAB659B1F68A40343C761577662D3C3148E9E073ABC2DD4E287D2F3856EB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IL_TIFF_x64.fmt

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\IL_TIFF_x64.fmt
Size 339KB
SHA256 d8111c9933dc9474606cce940a7ec435ff9714e68f640e9a808961d6e65210d7
MD5 fe29ff587081b66bc6743640b1732a95
SHA1 cd1cc43e6e596b07444b8f49166052ead7da0115
SHA512 a1f361f42cf480f33da4480cb296177a26b425dc460c66bf29fa49c064dd7cc231be388ef45e5b7de82a5e9f5563dd9461a2493b0f7ed4a66228628a9e30b48c
SSDEEP 6144:u1PxgH3c4tmOd5aKEUOo3weylhYNs78GBb4zGkwautpE1715vGKzTk2:u1uc4t1ToogeC0zGkeCeK
TLSH
T1E1748445DEE049ABD875803956F7C215F273B4493F02C78BA258B2313B527D429AB2FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IM31BMP.DIL

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\IM31BMP.DIL
Size 139KB
SHA256 c56678fe7b0a2daa1893b1642afe62f426edae03fe629ec16ebbffecd41236d1
MD5 7ab6ce592909a755fa42d62249a34359
SHA1 5427fd2011e41776e111c5fcec89cae4e5f2aa31
SHA512 37552eb4bdeb0d840575c712bc91cb1acb14ee886f240c388e10b0874b4e01d5cd681e902b273bd4cb735a60437e3c450619508e9b7fe725b80b5a943bea9de6
SSDEEP 3072:mUn/rzGuLl3WtZ7OKYEUVvs97NY/Kgsv/Ej:mU/rz9Ll3WtZ7OKYE6E97NBn
TLSH
T1F7D34C00E150D03DF6EB41FECAF3877BA6289731638524CB87E1A8EA97294E53D3156D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IM31FAX.DIL

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\IM31FAX.DIL
Size 76KB
SHA256 f66e93dcf02f423e35a3b45908a34f49f81e76f95b4d5c4721414852960e6fa7
MD5 019856fd9f1c254994445d738e569c16
SHA1 d27e1bedf51b2f005ba2348f2ce61224819cdeff
SHA512 56ec25d5c8e5880ad1e507a44e70bd5d8d1cf2d2785fbe7908e5e2ae8c2fed5079d0645eb08bad45dd4ef327f2eb49dee64e66430f522f6eba8e678b18e3119e
SSDEEP 1536:emLrGeeRQH7oL8Qz3btFuQs/kgzg2OMf:e8xEu7oLd3bhs/Lzg2xf
TLSH
T129732B42F51384BFF291463C14A2DB728F3E67FE8573C162BE51D179E4A31A36528E06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IM31IMG.DIL

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\IM31IMG.DIL
Size 33KB
SHA256 ccf44e659dfc13051ab8b777a0d8d51b6331f4c9710f54b0b1ed9bf041512f3b
MD5 bd640f1d6b2e18df2ef515b97a8b2809
SHA1 bf3c86ad4a0f8d2c16e3d1146aaaf5c483e8c2e4
SHA512 6fe7ef95c890d14e245fd3a526a73c8d27a64180306e0f9f3a4b37513cd955ba4d4c407a05c865225878362083550229f1d4aad302427e45f10a0fcefb32695f
SSDEEP 384:VpIvSLNwZPhWfPvzsGzZ9TMExqlngbPyPsmO0M4R++My0UsWDIJrFgeGuIDt6j7f:DQSOZPALrnxh0rO06dUsBFgXusogK
TLSH
T1A7F23A109BD405F6F187A67430F7AFB7AB3EBD4600968B47CB41D5B12C722A0B91A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IM31JPG.DIL

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\IM31JPG.DIL
Size 65KB
SHA256 7ff220d97487f863f0ed27bcbdb497995fa9005d148a99c64d5a046f11ff298e
MD5 3f16c6886b47c259cc9e99887ed8db9c
SHA1 e23d027d71bc3f769561773a131bf6149ff9644a
SHA512 4689a2db851cfb2a583c3bed7fff8fc534f2ff1b4ef18f0659a62bedd01520530e76e09e68055a55e44018160af05e513faa77b6b757f3204fc97ea663554f66
SSDEEP 1536:WIL2F9WDoJtXq0mZ+H7X7cV4pbt94T/dkguTh478g4grr:WISF9WDoJBq9s7X7hpbY/dLu674grr
TLSH
T1D9636C41B59488F2F055567D10F2EB328F3F6A714652C993CB20F6F268B32627D2E35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IM31PCD.DIL

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\IM31PCD.DIL
Size 32KB
SHA256 d1cad80f13ee8694c1aca1bd877d1e6a5c6cfed9fa40ad74941b17db48a083a9
MD5 c846a6f7afe69267e6e1ca535009fe23
SHA1 81c5b2e8b4cbf688bac191adeea0b3ba8490c79d
SHA512 103d8c5a373ed923f5b96298a8d6b57eab6e8c9059c1b6d49c360a57277dd46e307a49794aae7dd90db519eb517c5967cdbdfa872382650b06d6b4d3da6f7902
SSDEEP 384:8Rn7Iyzl9TYeqO3VKyK902Cdq+CVyodgHXIJrFgeEWprtuj6/nS7:mPbYJR06Rd6eFgtWXlq7
TLSH
T19AE25B109A9404F6F1C6A63430FB6F73DB3EAD9605978A47CB12D5B11C71271BA2A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IM31PCX.DIL

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\IM31PCX.DIL
Size 59KB
SHA256 bdcb42aa403ae59289cf1d987243868d12cc73b75feddf6e7d6295cad917454c
MD5 4aa149128829862f1040389e966266d7
SHA1 7fda0fd052654b2ec7e2400def3ee823fbf0065c
SHA512 8a2af225d03c13c437e42b1ce29b2753e18295e8c9d829380ae1de9c7b8f483397e46824d6dbd4361dfb45cca772c5d9af7d4248dd3617b3e7e6d5284cf4e20c
SSDEEP 768:uU2r6/kRDGP7pTYDmPo7wufDYR4+QnIxGOkgIKgTeV4SKu:5/kx87ZYSehfDYR4+QnuZkgNgTZS
TLSH
T1D1535D01B69184F1F255573834F3AF328F3EAA664162C1A3CF25D6765CA32617E3E34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IM31PNG.DIL

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\IM31PNG.DIL
Size 53KB
SHA256 93eaa47e960fa286b5d3bea07f59459fedba007167e9a91196c51e3ec73cf461
MD5 ab5bfab13ae6c880de78bf6784c8327b
SHA1 1c74f854871731ef404339df7b2c2886320fa0da
SHA512 6b32d745e59bb164e1ec7c18b3be75ad4a778dd1c24a413173c78f1cc75155ba12eb35e821cffca85a33e727a7f7759d32ec8a40b0f02e53a05c1fcb81ee506f
SSDEEP 1536:OsA+u9R/aU+o5vQ59CHu3dlGxkCX6Amgr6Hg3sst:Xtu9R/aU+o5vy9CO3dl6nX6AmgOHY7t
TLSH
T1BA335C00DA8050F5F59267B874B3EB778F7D2E9247918D879F55D9A32A32270AE1230B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IM31TGA.DIL

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\IM31TGA.DIL
Size 34KB
SHA256 f6cdd7a0494d5e5fde0520ecd16387a553fb32187828bb863ea51c3fd232d5ab
MD5 fe160474ce2d320daa2083b76b00d57c
SHA1 f23e9319992562022dc07a352e99f0c46921ed65
SHA512 f75e77efeceb56011701580774c135ca34bdba4fe5414f526cd7106046fb5cb815b2f3bf80534f49b63f837c29a8784c3edc22a1cd8ba69a15979796726fde65
SSDEEP 384:yblYUzVbm/R4yzMq9TYqTGy39BKLFg3+VtIPtPsQBrFgemnt5DtDjb7Af:ybDqM8UcQDCP1Fgzn5DU
TLSH
T131F23B51DE9400F6F1DF767024B76F73EF3E795205BA9A478B42E4F618321A0E21A31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IM31TIF.DIL

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\IM31TIF.DIL
Size 80KB
SHA256 1facfad1b91babca4d1421a28eaf962b564c1073eb305165527211e02ffa9fb4
MD5 c0158ae69cc60b297d4e27d6b3fd38cb
SHA1 5e0b680a19cacc435a313cb8f96c72b1fa53737b
SHA512 cef2d5be3b2b4fcb26fbbfa50b8d28e72a49db6c0ef6ea4b726a79e15849efd76cf5ae934c8c9a45595887f31c0c2753abefac382e4e69b1f66e0df10db601e6
SSDEEP 768:/CKYZNWyi0jLyAKCdHYc7ptchV2mPmlnbtGcRowQ/azOkgC+KgvXQiUP:/ryrLUCBF7PchRulnbtG0ow0jkgAgvk
TLSH
T173832A02F5138CBFF695153804A69B726F3C23FA85738163BE11D176E8A31636D39E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IM31XBMP.DEL

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\IM31XBMP.DEL
Size 32KB
SHA256 89bfcb388440714ae9fb1e216ce4d9366fe6d23417b8c186f6971c3ce4ad9366
MD5 00a22b722c38a39c07f6a138f7595e0f
SHA1 a055051dd66aeba144ed14e9f1f919f5fe9b9676
SHA512 e6a6f11f3cab6990d63b252547428d579beceb8e0932af805db52fff4b367a3c053dbcbcfd6893c762c68fd1093c21fe8fd05829ccb56378b3055ff36cd8b3da
SSDEEP 384:sc3+6+/jXd+tscXP9TjKD5LXn8b0tAK+WavIti2m+IBrFgenUcMEHEtjvrq:sc3+j+ftKsbVCvti2GFgwUz
TLSH
T11AE24C109E9001F2F1C66A7470F65F73973DED96169786C7CF82D97128722B1BA2B30A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IMGLIB_x64.dll

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\IMGLIB_x64.dll
Size 305KB
SHA256 39f22d1a86b06cb2b22e6630210048320480394e1f251d5711f1942b9d53ac80
MD5 6c8122c338c132972d41d0736de69d24
SHA1 7a26963fc108e3f5733b1311c291a11b094bfd6a
SHA512 797d66e8f1be0054f5de61deb87373956e752571a2a55475eed89c9d22603e33ca467437b7aad582eb214a74dbebae616effeee886f291be415989929876cede
SSDEEP 6144:kiHyV3s5+qtNQCO4G3TTXRQHru81YGFBUohLU:1SV3C+uNHO3/4UoRU
TLSH
T160645F27F2531F54DA96427C86F2723187256C30EF561BAA4380BF253ED72E0A719EE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR100.dll

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\MSVCR100.dll
Size 808KB
SHA256 b4bfa27f677295b00a1df9a7e14db4b75cac2dd41b898d4e9a378eccce3699f0
MD5 aed6d63cfa5a3ef7021af9c457fee994
SHA1 f6ad746ef520b03df6cf0f5a2512d0df964c4688
SHA512 5573b17eb19d13cc96df5d66ef60cc8ff98e1ac9d8582a870ed2befa28ee271fb41741a92aa703234150fceadf4a436d10b8a6518c1816d0c804eb1261650d2d
SSDEEP 24576:C5e4L1vwTowTWqwVeeK7R/myyKgn9IrzOI:C5e4LfUWqAacn9Y
TLSH
T1EC059D9536A907F6D177D53DC996D206F2B2741513315BEB01A08AAE2F23FE09A3F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuickScan_x64.exe

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\QuickScan_x64.exe
Size 2.3MB
SHA256 ffa8e25970a60cd147e92004fd133bef50e60a6f3f10f40ff067674dc3fab9bc
MD5 3364c96a916685a565ca4ebfffa80638
SHA1 5efd2c17e3d73ca84402ad8dc865305cfe93b07d
SHA512 dbc365301c57217f43cf29b84b09cf0a2a4216ca8cb0aaefccd9e217885bfa1b3efc33ed709fc3709fc3afb2ca2be71610a75b8e8eeda8d1d4bb0b02cd809df4
SSDEEP 49152:93Rx57+3mH5VCULH4TwqO4fV1T1zhx20dWdJ7/U8NQB:r2mB8T9tdWdJYiM
TLSH
T10BB56A5BA6B8A1E4D06BC130C4479A4AE7F274618F3497CF406106AF9F736E24E79723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScanApi_07b3_130d.ini

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\ScanApi_07b3_130d.ini
Size 175B
SHA256 cd1f559617492dd050a69ba401b61af64d72d40611283d38a4274424fcb54e19
MD5 b154891d4d174d5ecebbb5edc6671dcf
SHA1 629676d373933ed96e01c87d439b8945ff4dc065
SHA512 c166a07f4fad732ac9db5f5d838e0db6768c16398248e8467cd4da3e61594c59c6919e021c4fc199f5c44d24d86e354170e5995d979c6bfbc43f2ced0606aeb5
TLSH
T1E1C080835D18413A104C43560B0DB1F5F95076DD915155635E4D116495704DDB75C615
MD5 SHA1 SHA512 TLSH

Submit Download

Scndrvu.drv

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\Scndrvu.drv
Size 1.8MB
SHA256 b071021ac3a25ac0853b957bb2e83f77fd71a575b776dbe1c3ecf51b884b7711
MD5 cd56ab5e35f8370e3c173579e2003731
SHA1 85e37e10bad45f6a5df709090fca6fa245ea19b1
SHA512 5802d1f1dc71ed72300fc51c5a37d8280225b60672787100a9843fdcdb56cde6a4ae120ffe8d47bcbfb8b381c5595cb1f354f716255855b57517507e9f7f73ab
SSDEEP 24576:5IGNAEBnV9O0AP5Rf751B+KdsAbHbwnWltqSHEDieiogTmOR:5gKnV9O0AP5Rf751cYHbwWltqS6eR
TLSH
T1F795F810F600A21DDFEB01B34EF7A2E7B1ACAF7013A410D76149BD78AB691E17D3456A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Scndrvu_x64.drv

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\Scndrvu_x64.drv
Size 2.4MB
SHA256 4847cb42407370159702c8ceed34210fa0247b76fa49400dcfc8961fc20459d9
MD5 c0e0c2fd90f876e36f68cebe5f944c45
SHA1 0187387448b031df1f3f4869c3f15c95e834d0b1
SHA512 8687f5cfb17065220ef2cae0c6dbd1e1fcb804f66bbccff8c372f65e6fe31a8aa6cbac43a1717fcc9a5193137cadc9ecec4c6255b2bb47a25fd8f206f88fa549
SSDEEP 49152:b1MGcjQscp9+7+ot4BRjmHngwv5NNBekn8y0HbyHXsJ8dW4QpZNrdnxf3Hz2q0:bWGcjQscp9o+ot4BRjBwx7gpfT
TLSH
T1D0C53147E77581A0C4B3813FD5662237E5203848CB34ABDF729A6ADF1BD27B046BA750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A1C_c838.rra

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\A1C_c838.rra
Size 13KB
SHA256 04f091a49b42134d9ebeca35b56c00e299ed4f31669806698e660965ee001795
MD5 d5fe7683436eeb99bac45bc84d683d14
SHA1 f58fb6e90bbb6cd556b1c8ebe0cfb841ca697195
SHA512 79aace067cf1110b8096e9f8425c727cd86544f7bc782ed737d88a013014c6c2d66879b3b333545ffd13a1deffa6859d77fa6a856e82c12fc7fc1e0c8f93d4c0
SSDEEP 192:wBESpUzTvTii03q3CU41ws8jDtInMuW+Nrs4mhxrkgkdO3OEvB6:JSpUzTvTii4YInMONr+hxr2
TLSH
T19A5285C6D74F42F732CD519DF8821FFBBE598045435296AA0F50C20A9B9F58C8B162AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A1C_c838.rra

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\A1C_c838.rra
Size 11KB
SHA256 e9ebb14bf0867386e07c68f1187614736ada32fee47d1f50a56279024fe3c4cf
MD5 d34c0efebe3fb664167b2de68bd72f1d
SHA1 beab9468fb8ffa95aeb3bfafbc13c90dd99e64b9
SHA512 a655e998c8870fca544653d51bf7ac0288883999c19928854fe5a3253295416f766731045bcdeec8b2990db0773b3be53e06ee53de958d77d76e48eacf66d5d5
SSDEEP 96:BLLOiALAKeoSWuAKsoSVAyeoaWuAysoajAyeoaWuAysoat097CV7wlM9TCtj8lXY:pqBxAfIcMjLpszskgkd53BVNUM
TLSH
T158327685C79FC1F726CEA169F8411BFAFD59D00A4392D29A1F90C242CA5E5DC87212BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A1C_c848.rra

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\A1C_c848.rra
Size 11KB
SHA256 b6b7e067fccf51a6cfccda1cee9b45952ac87296532a92678e6032100c002f43
MD5 0201155c203fd3cb88ba034a16983c07
SHA1 ff6a012162ba3a0568303f2c38c93a799587d145
SHA512 52a8b6599074146c776cce26da835630a2d67abd51b02304c12d5b8f9c1c541ab9195b788e6bed428a324f9d86b5aff383a2d0379f50345d19b9aacff5bc4080
SSDEEP 192:1Ohtnyl7QaIRjzRvyyKwnsFWQFh9Z5q21eX01k9z3AORPC:Es72rnsFRHr5l8R9z3RPC
TLSH
T1753217E68A6D4086DDABAC3083D8E597BC3A67CB1C50956D21CBF7600DD23C5E70857E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A1C_c857.rra

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\A1C_c857.rra
Size 10KB
SHA256 8193d3578f9f974ae315209bdbf0e02a8122989a3406690b82649d2ab4300403
MD5 75b8e0baa20926e67b49f863e14aceee
SHA1 ff6dd73b3c818ca9973974be63695a14bd0f3cfa
SHA512 d10043c0e2ce4ec1d8ec0d7eecbe4d0be73d750ce155dedd9a463b8b1759d96174b46e2699a4eae65f6e24560beb9577c68c0e4d28e1b58ed9969edf518a421f
SSDEEP 192:Oi0yBKquIRjzRc/KQyKVFWQFtlSdxP3NGmVX01k9z3AWdnvu8j6Vn:poxFRKP3U0R9zDBGq6Vn
TLSH
T178321AE64A7C91C3FDAB6C6053E8E9973C3D27C71D00946922A2F7541E933C5EB1846D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Autoc876.rra

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\Autoc876.rra
Size 48KB
SHA256 22ccd6c2c2f606d910096903786c2fcf9cc9c6ebab770357d80e408d6b3663b0
MD5 e62a82fdcb35f188fb026b81a440c393
SHA1 4733f9c4e6135d6235564e5a16412800dda010eb
SHA512 86396364705a3c569af8803e83b1df299bc55f8e405dbbb98f3383a2dfe665c89289a234fe2b205eb2d0877c3e473bc4c6b04da5dcfab699f8a9882d45f1c86f
SSDEEP 384:zuUr/aoot+TrNtLdsHExG/ZFc37dvzX8fInNHyVNyCypvcun3Uz3XFvlR6aH7gOR:zVaD+TrNtZehFc3NHHwypvcKU1vlTE
TLSH
T11423390A6D5301A3F24E0A34D6E557E35FFE6D2336E260BFCF9015861CB11A9D066AF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetId1fc.rra

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\GetId1fc.rra
Size 16KB
SHA256 e60807c2396bb65f819c86f03cd95e0b674af2e6808201410df3727520f5f171
MD5 b6954539960ac958fe7e1bf79bc120b2
SHA1 401fe72f98c22ba34ad6544a19fb5b255a8212d9
SHA512 e913d9050098d2d2b53a0e4a3ef0dec582fb21dc929a6d162a84f112473fc21dd9cb306cd3f198f9edc7b1e0ae2b0669b5b88b43d911492643248b851a1597ad
SSDEEP 192:N6Hdmf+nQxAYZFpcwbM6hRW1o3skiHjL+28YeTcPshgF+57zfNxwyQJhIb/phqT:Nnf+QCYjIWW1o33iHQKXg7JxsJyVQ
TLSH
T19D721A53A7B85179E073E1796AF31B06EE753910633A62CF12605A4E3E227C1D53E336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetId1fc.rra

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\GetId1fc.rra
Size 15KB
SHA256 c42bf7cd15acbc3f22ab9113e95946faf65af19ad70d0cabfd98200e96b798be
MD5 36aa1f844be1dd06f548c1510a562afd
SHA1 b58e8d7c2ab5ed0812de11b26e741813072e5a19
SHA512 776d736af2fcfcbf4a9d18e293006c986d8a249b1de617578d6a2ad306f754844bcdbad28d9fd9a726c86359eebc5a9b75f70a2bdfa6ed4fc7851f4e7725207c
SSDEEP 192:fUNHVk/aCWBbudxbltqOm/x0LY3HbuKpzrwXSJf+wX7W5q+VIb/ehqTBZoYD+:f8xdk/O/mKiK6ShX7dnaQBtD
TLSH
T1A5622956BA805472D5E6527815BF2723893B7A70BB21EACBD301168A79303C3EDB4327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PkImc8a5.rra

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\PkImc8a5.rra
Size 25KB
SHA256 e582bf10d16a1b148300ac2fe78752fc28474f25e24dfd0ec81c8032696eeec8
MD5 8dedb3391625c3d9a48b27dc3afc74f9
SHA1 1b145b7df6a1c59825cba56dedcf678c62f7f14a
SHA512 c53aa195098b9741b913ad9a51490d24d166c9124310a074d8e38dee65020957ddf0ba5d7541a1c068c13436fb79b16e3c451b5d49d78fbf99b66b27d592f57e
SSDEEP 384:HG+vDiYMsUtBP29MnQKrfK7Vz1TBSjqJtQ89cNjpi+JAmuIBrDVf6FOXJy+7p21:HGSDfGlHK7pIqJtUUmogZyYC
TLSH
T184B26C605149A2BAF1CF11708768BB1A9A349B2217E141C75FC65DEEE9743F2FA38303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PkImc8b5.rra

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\PkImc8b5.rra
Size 32KB
SHA256 e0aa0ccf2f4593fab3eaf40bd8e77a5cbe97181371f3c7ffb37838a2bddb984f
MD5 90c48dde78ea90a8353646152b4d9ae5
SHA1 7dd560270e88c86275464b7ca61f49e98f2edc65
SHA512 e40d35027be14d9fb23708ec2e85e4baca7abe5d55c4015b51a71f923acb0baf6afd1ef82179d30cc4aea8578de51b0c3078cc157d27ce3cc75ef235a7788c1f
SSDEEP 384:CoMsPVQ5vTkYFGOsCuBuRbztIA8xW7Pyk/hm2z5CTBkSx2r3o9lYk5pAjbFlYqYF:Co5Q57kLuRTOk5d9p4u6Yop0nYqxOr
TLSH
T1F6E24A9326F4D0E8D6298175C7AB4D66EA323046230187DF17E4469E6FB3EE09B7F601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PkSec8b5.rra

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\PkSec8b5.rra
Size 9KB
SHA256 dd3fb9d7bd9b994086b7743d7d3bc3b8f4528eb67f388ca7ff25811710f26fee
MD5 dcfa80a79bf34f6ce351202a46d17283
SHA1 d5087711581c6aef9f6ada7dc087d4d2196d0167
SHA512 e953d55c78cd237a3e2f8f36b5c66c7bf7e076d9a3202c98f11c9611dd6d51e9dd2c741145deb5d44915710387eac3f1033c0a1d69c5c5f020355e55e2051046
SSDEEP 192:vXyDv1eSbK9BIE0jtmtDDtMMTzkd3D0QVD3rm4LAt77UnoNj:vXyD9eSeNgmtDBNTzkRD08D3r4q
TLSH
T1F4121713F61E81F6D2DE413A9117A5689B2E5210ABF423C32F934B7D2E281D6EE35206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PkSec8b5.rra

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\PkSec8b5.rra
Size 11KB
SHA256 93d91b8b2268a98cba6b57a58630451004f2fbab332535ad842f50829cdfc517
MD5 a1a3eba990759df42684ae7528a5ca22
SHA1 eb56bc215d62227d3c79346018b35cfe8b1e0201
SHA512 b814c6c32876befc4dadcb7838ef6f47da0e69421636780cb42fcff2c893cd9ec8c66a160b75b5be3dc5f73254baeabc3f8f7ee35b832c8a625e680a03596f13
SSDEEP 192:RGWy1fG4pLdZ0ajr3rnag24yavAC9mQ3MaOAVx7U:fy1u47fGwtoCMQLx
TLSH
T199321802BB30C5F9D51A40BD825F1C17FE3175106751A5DF1AA162692EBBBC2BB3C22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PkWic896.rra

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\PkWic896.rra
Size 10KB
SHA256 1d43ec8f4861aae10ffde1d2f14ad74c796cf1efbd75d60b0207e7fc5e023b65
MD5 117fdeb3b46380c44e8c5a9613543b28
SHA1 61a82b8c8ccd8ce7d9dc2bb3b6fcdd9b02cb25cf
SHA512 9216a729138ce922d5156a8136d5f05a09574c39dd6d086216de296658114f4bdff5cb9b8a84cd56bf7dfc234ec545d2ca21aaf9a60a25dd1351ee3dc1695d22
SSDEEP 192:BzTlJnHUwIwojFDDQ68iFGCJ8EsfwGlm4I3gAwh/VntZV:plJzIwoZDcjulfGlbVn5
TLSH
T1DB22C730B3E845A6F6FA1B309AB59B1A063ABC246FF553DB1A52411D08B83E0DD31323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PkWic896.rra

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\PkWic896.rra
Size 12KB
SHA256 9902c1dc2a35f18e4c3e81fcd434b795f0eff6f3d191c29cf34a58eba112d518
MD5 f7fb58d98cd6a062c9cfc3476df38bea
SHA1 c2889b8edcdc8082372d10e0cab5ed7fdf0ff55c
SHA512 0c0279961cbb0a44a85adbc51c476337b58bde9403cd1f80a49255d93cdd7bdd2ae22c78e750c8c6277d21f52f6b6dff4617592b4c88a612755caa0ac2bef358
SSDEEP 192:udXfjXXmTIbuJ16Qixo/rst3M5IAUv7CyUVntZV:EXqECf6PowtsVn5
TLSH
T14342C502EBB88266F4F21278957B1716E9767D00A772A2CF0670135E1C777C0AB7973A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setinf.exe

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\Setinf.exe
Size 64KB
SHA256 b72b5a916ca9e00bead9a3f63b19b4b08179914d01a6bf12ef0d872704e267b8
MD5 70006f43b4253c550e1ce5e29203361f
SHA1 70f760e730b0e5da98ce16683e5b1f5064d1a22a
SHA512 3c27b700ac0233877d8432d7fe4081ffaf1b802ca694f82fa9656b6e18e090785877dd70018288bcf9a4568c615bfd3957d4c134b20db5d72349882b57da6656
SSDEEP 768:VROP9RDpPqXtFwoOwTfqY3fdcl+gTITn4iHOsf86CJiB98Y7lxgymh5UwoPVQ:VROP9DqXMK92lV0TrHNbC/WlKnh/oPV
TLSH
T12253AE3338E2817BF14501B104B48F7BAB3F77100B225DC79798A9865D73AF6953A247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

broadcast.exe

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\broadcast.exe
Size 30KB
SHA256 3525eeb30f46854611070e1515de49aee28c5946af1a464e5e571c7fbc3565b2
MD5 5f900eab8e5370e9cf22cfe112d4d866
SHA1 be05b2a8f15b020ceba5fe7160025c770dbb8c52
SHA512 ef195aabc02142d08214e8c226b81c2a5118641d857ba635e3307042e3f3c19f46311f99da013d9028117878ef52a6d6945223adb53e389dde8504cfca9b4059
SSDEEP 384:ufpufJbpemlXJV1nyyQ3rh6oZo8Gha/iL:0spLnyxbh6otGhaw
TLSH
T1C6D26E976DA60A13D947857134F4DB0A6E3B33931BF488A3D258EC9A1F653D0283F35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devcon64.exe

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\Setup\devcon64.exe
Size 85KB
SHA256 82042f73fc462262df567bba293241c83343c7b3a661317afcb881ec6b397c64
MD5 c6506b90ba1fa62767baca2279c860d8
SHA1 f5bfe612868846e25926d84ad7948f240d379b7e
SHA512 c394016415e035c88f7f3cf601f3c720b017273316a65f43c46d004ebdf6da862a7b897fc8a58556e9ecf4b4be55b18e793d35ce3da6230c4fcb765a3e28e11f
SSDEEP 1536:VvVEnf70Qp85TfTCKwu2rlWD9nx0dSF4O7WYR1:Vd+v85Tzwu2rla9mdsRW81
TLSH
T11E83E90263E94609F2F77A346AB552351E777C919E3CC68E0298915D1FE3E90CC78BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

im31Gif.dil

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\im31Gif.dil
Size 36KB
SHA256 6db27d18cdfa0ef6fd22b02b2363800a1d6e0d01d3e28c7bac1e4bccaf7ddb31
MD5 2c999c1cb9fe052128a2ab58f2bb2a4d
SHA1 572fc0562debb8f16b68c4a01ecb62f1b5d933d0
SHA512 7fdd71b421413ccaa8472315373b104a90d124664d012cae64def48bf0c60810420c0fa97326a744efc57f6ab800cc6d9cf8b3a3af34af6e834ccc013d2792cf
SSDEEP 384:J0c7uvXUUr3rIyzZ9TDqnulmyH9c8+qByG+sCdkhEIJrFge2BanitZjRM63VD:J9uvEUDfnqscoVC+hjFgJBaGz3V
TLSH
T1E8F23A419B9104FAF19E797064B67B73DE3E6D52457A86938B02E8F218331A0E61E31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

im31png_x64.dil

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\im31png_x64.dil
Size 54KB
SHA256 e3e423c0ba97e73ea1eb7470cb1a33bf6758eae230c3dbcabe5943badaa4fa95
MD5 086a1a160af2ec82fb3e3112765a2b2f
SHA1 50c5e2ccf30566ead89db7b6479d10dabd6b2412
SHA512 da061bb6cb280a871e5566dded136c8f110773ab22960757117400144868db39971a437e711bebce0a44afd70df1035ee7e8547381137bffa9e23e1ab54629a0
SSDEEP 768:i7b3Z/S2TtgXjtq52ay2zs56CVpr1STUTnuBQulgCTnKWwNK1XjkD71y16i/P2:in3Z/r52ay2Y6CqUTnL7CTKW0atv/e
TLSH
T1F943F729E6B500F8E0B7933584B39A20FA72BC569374E38F56D5825E1FA27D0993C731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scandrv.dll

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\scandrv.dll
Size 74KB
SHA256 291e1dc0d6ec184718ce7841beb3d29bdebd49a2a5b2d084f6ec91b72bf676f4
MD5 aeed42e2a6411f71b3b5a04a61752bb5
SHA1 631c9473db1353cb0639577530c6f7db8dcf4646
SHA512 02e15c6a6818eb56b45ffeca05af4166e17b85c395b216f2b409be81494a121d0a851e6ee91a6a58b370eb0a12de767cc05152a8179db37d9b0c24bdc6dc4190
SSDEEP 1536:BKlwoFGJf07nwfOwDOWaMmgkOiTVtITr5Zyf:BKvUVqSg56r5Zy
TLSH
T166738E11B190C076D196153E80B6E7716EBDA8311FE005C7BBEA26FE5F702E1A27934B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scandrv_x64.dll

Path C:\Program Files (x86)\Plustek\OpticFilm 8200i\scandrv_x64.dll
Size 373KB
SHA256 ac3914bf548f4f41e8677407cab03c8553cd9795270ddd0c3c4cf9b69fb108d5
MD5 1c6119b23015a8ba2abd1173a1600a31
SHA1 8ac8ba481d37cbab0e3434749ee5f2d93db6bd13
SHA512 78beab51e4c2b860121ec0e95443ede9ba16408a9272d996f60be5fb20bf75c73eb685f3f59af81638e3836163b1898d084009c8b880da30533975f10fb5f7d6
SSDEEP 6144:BnDI0v0hOvzLdYb0DcDF2BBFkO+fap1YIly+ib3iDzHcIcf1MczGP:NI0sh6zLI2BBFkO+fap1Hly+i2Vym
TLSH
T1CB846B46F76009B5D177E23DCA630B15E9B23C1A4B21E78F23A843A60F23761697F725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MidrvA1C.dll

Path C:\Users\Admin\AppData\Local\Temp\20251230-OpticFilm 8200i_12L_V6.1.0.3\64bit\MidrvA1C.dll
Size 56KB
SHA256 4170ae6491be3d499a88267cafaad41a80d50e765ff9c758988c18ed891b6d44
MD5 43c6734f4c1f40ad70cc313aba8e0a6f
SHA1 7fe859216eacf4eab580630b2257d17367af6bfb
SHA512 3ddf9a7fe081bceb47a2d8e90ea2ef99f4e71b516afd848d67f2df340c4dfb132a97525f50316f50fbd2f6c868576509c96f663530abbdf98216dae42a994194
SSDEEP 768:8YWcBl7CZc4YbV3DTxZ2eBF/iB9HaFno5fUoiryL:8YWcvyoxTFDPaf+r
TLSH
T1D8437D3135E145B3E1D6827051F58B2B5EFE7E1206D198978F71289E3E22AF2E53A303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PkWiaDrv20_A1C.dll

Path C:\Users\Admin\AppData\Local\Temp\20251230-OpticFilm 8200i_12L_V6.1.0.3\64bit\PkWiaDrv20_A1C.dll
Size 67KB
SHA256 1dc998b71a666433b78de7ca35b769ece4da39ba686506734d0c15dbc297f61b
MD5 5ffbdfdd15b742dd9b717fb1608922b2
SHA1 c14a8f14a379c664b12c4183abcae6d37f3fb83a
SHA512 43a937436257784ab071d98f4cef7ccb6b28a34bca432497f61bae883b43e249463df08b31980c966d77c694c7847548291c1d755cb21930ffaf2f20a37cb32c
SSDEEP 1536:CrF8QKy/u9o30nzKuXBGua1IvFBlsejGGDKSMFM/KDOMZXP:Co9okzHXBGua1IvFBlRjsSAMSDOM1
TLSH
T166637D22B74573FAE6E21470B9BC372B95B6A93523A091CB57421E1D2D301D3BE39353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PkWiaDrv20_A1C_x64.dll

Path C:\Users\Admin\AppData\Local\Temp\20251230-OpticFilm 8200i_12L_V6.1.0.3\64bit\PkWiaDrv20_A1C_x64.dll
Size 84KB
SHA256 c5254c099cdc2a315c9aa2c663519502fa70c1b417943e97f7b9cdb986c27a0d
MD5 b4019591dcedbf79601cd1bd27187a6c
SHA1 82a9f5976d09662f11aa21b6d906faeb011e41fc
SHA512 383f47afb5cb870429e84227321a5185590acabe77ef27f5a14e00310a6580574b4de8d10e48be397a22cf754e5859455d270cd0d416e68b40fc8a4f651b4c95
SSDEEP 1536:tqQma0P5dd1ZNDKDh36FAVKJ+mRnaHilQbIfRzlJBum6CRmiTmVvOs1Hv7zk2:oagPZSxIJVRaHilQbIfRzlJf6C0iTMz9
TLSH
T14E834B267AE480D4E177D278C9BA8A22FBB1740833209BDF0762425D2F737D25E79365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Product.dat

Path C:\Users\Admin\AppData\Local\Temp\20251230-OpticFilm 8200i_12L_V6.1.0.3\64bit\Product.dat
Size 1KB
SHA256 aea2243072cbfd9d3185200e5cab64d5b22f7a67f3469efc774f832df92006ea
MD5 a333db6710f9b0d98bd7414da36d021b
SHA1 735ff973aa35d5896668ab5145da386aeeb4bce2
SHA512 8fbbb2ba0df4a0c5019d866be88340db75005871d36ea482ce5b22a76886b47159504ba2dd548bafe6caa06da661e1bf8fbebb1dc84aee5edadde514a2876ee8
TLSH
T1954171C53A0A2060103466B81EB2D8555E98E0FB84A33C4EFA6C59642F9433EB65D39B
MD5 SHA1 SHA512 TLSH

Submit Download

Setup.bmp

Path C:\Users\Admin\AppData\Local\Temp\20251230-OpticFilm 8200i_12L_V6.1.0.3\64bit\Setup.bmp
Size 122B
SHA256 b9bf35b50525b41151722a3ae30778d7375909a41c2bc214ccd079363d7a4b12
MD5 978a5760b0b7af194413b0deb92f8b8b
SHA1 bab531485e1f1e2fea6da512e135511cf5c6a6bd
SHA512 8c78d2cb1859f979682f7ebaae484d1345d0ea9b31d2f106131f0dcf2712ff19000e34d0a56d3c860d35420a2e47cefa725da6c143ec8ecc1d69a4b1a8dbf04d
TLSH
T139B00113726CC858D0004070880BCFBC0D00BC879855022737F1EF4FBCB47447446094
MD5 SHA1 SHA512 TLSH

Submit Download

Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\20251230-OpticFilm 8200i_12L_V6.1.0.3\64bit\Setup.exe
Size 124KB
SHA256 8e9ffa702399b740faa62f6fa98b9fb68da16a0dd74eb4c78aef1570650b4624
MD5 6ecd3ea53863ae2c8efaa847d487e382
SHA1 1acb7dc1affeb317c4c0eee4325e2244a9366d5f
SHA512 7bc20a224820becfda89bcd30bf8dc8892748fdf36c97cc4ad4fd6d1da2dd38eb4c5578da3f5f341b34df94050cb3b5a2cd496deaecb8c01bbd6360ff36d786d
SSDEEP 3072:sGZUDfQSuSs9GY3YtpJnJGiuMcDUztJLtXz4:h6DfQSuSs9TYGj3UC
TLSH
T1C5C34A1277E1843AF5F30631B9B866728BBBBD311A38C50F9368654D1FB2AA5C564333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WIAA1C03.dll

Path C:\Users\Admin\AppData\Local\Temp\20251230-OpticFilm 8200i_12L_V6.1.0.3\64bit\WIAA1C03.dll
Size 86KB
SHA256 604e9008632a8d268f4c75f33a2b2038d63b06a30fe6f1dc8e1d83d797f55bfe
MD5 da0c1ed11cfcd83385d80fd811195dfd
SHA1 3ee4dc40c9202f7228ec0c6c642f251f4b2e2b6c
SHA512 c0f4be81d6fff66c597e9341c94793ca06a04eeec115723261f496720886d1fc40df6dc51ef02f8c52df5593cfe986f626c97c651600b36de72f1067b8314d2f
SSDEEP 1536:NUwRjIBJPf8XKc/NZLU7/oKu10sUPnKEL7zo/w85Xxyq7QreB:NUwaPEKc/3LU73ub29oI85Xxyq7QreB
TLSH
T147836C5BB3A950B6D01BC1B9CDA34786EB30744A4368578F1779868B2F233E15E3E316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data1.cab

Path C:\Users\Admin\AppData\Local\Temp\20251230-OpticFilm 8200i_12L_V6.1.0.3\64bit\data1.cab
Size 3.5MB
SHA256 2a4c9e0fd9fab17931fa5d12c59bff2ff6aa286a656b5d656b51f08299d65fb5
MD5 375798aa9cac11fd698bf2ef9783e56c
SHA1 c67d4e4b2dc3947c0663324f7fadc23650ec3b46
SHA512 f00371cf078a8f26a7c3bde3f6fbe8f0e179da3c487c7a3141a3a22e408818fd82e47a38f9658b41cd21bbe7a20a6147ce96c898762deb3f015139e2b4f62c80
SSDEEP 98304:ikbIIR/uNUhsLSUSV1t2A6UhYpWAk4YdpL44:ifituSDjt368kq4YdpLb
TLSH
T1FFF5333741ADADFBCA1A4EFE828F5809390387068334F5AFC7545237F1693EB6442926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data1.hdr

Path C:\Users\Admin\AppData\Local\Temp\20251230-OpticFilm 8200i_12L_V6.1.0.3\64bit\data1.hdr
Size 100KB
SHA256 d3a4d4dd19d12154936b98becb8bc25f6404e9becc5a12e1ac628082547e6f27
MD5 a570d6401e03b1fbb6cdf5d63cab38d8
SHA1 1cafab4bc9ac318225cc0a9cb2b156db224f8455
SHA512 05f27c5c7e6118c5aceb54f99d5d07a4a460b13906306232bf7555277987e851685318be131ab9a9ae5ebd4c7684930ce8a8c0e63289fefa0ee534b68dbafc7d
SSDEEP 1536:+1y3PYHSKTjjOL91QjtubcAsS8/byco0dpEDgqjj38eh8krQx:+lHSKvji1QScASXFpEDgqjj38eh8kru
TLSH
T181A3EA267F11F266DD0B3F3F6C27296A37B9F0C54156DF22138CA1247E6798A2D8C912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data2.cab

Path C:\Users\Admin\AppData\Local\Temp\20251230-OpticFilm 8200i_12L_V6.1.0.3\64bit\data2.cab
Size 11.6MB
SHA256 9f013336756c3b8916553f3d536bac2686063b60f77ff383a82f1b60a3788080
MD5 372661811fe10117a252f6b1570d8714
SHA1 ffdb8dd0050f09146a88d104319176cceb0dd3ae
SHA512 f5864b475e4d31bb41b3c8475b16f45d657a4c8dd09885964af7ccef9eb21f4e3fa1736c7783e22876b946ee1d6ffac5f5a85a898e749c6a996c6d9c00b25904
SSDEEP 196608:pa6ZouSpzvBQFSbl3270AegWPIKb76VXOTpC08jaGovFiUrBh8+WGxKpwpibXdAr:pFoHv5fcgsXOd7Wr4oUvnWKyYmARM2qW
TLSH
T1D2C633CB22E64C8FE19737BE583B8528B41A3515805758A32A5BFED13976FE040743AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

engine32.cab

Path C:\Users\Admin\AppData\Local\Temp\20251230-OpticFilm 8200i_12L_V6.1.0.3\64bit\engine32.cab
Size 448KB
SHA256 a48711a8b88bd8bf5b5d334e7655f2cc963880ad2892163437bb4393618327a7
MD5 6de89a3eea85c51d9afe883067be6fa8
SHA1 91165394ad910224782fffba8119d00b3af4da94
SHA512 15cd2d830c952d959b52cb7d48f8ebc9d8d7e4d4d94f4e987067d1a9829987b09b032d47f88cfae019d6527e0c5b6d6b4cf7ad32eedfcab5c346e71794c4b9e0
SSDEEP 12288:QITEhKvCQMKXklty+G12Mr9etpmFmO4l1Zxa8ax8w:PiKseklt/G12K9e34mO1XB
TLSH
T179A4239872153901FD0EE625D764BCB4536CE6C312E5C260B73AEBC83747EA654C8BE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

layout.bin

Path C:\Users\Admin\AppData\Local\Temp\20251230-OpticFilm 8200i_12L_V6.1.0.3\64bit\layout.bin
Size 686B
SHA256 d7bcef94ce5ba1c1753e869cc009354fe3a80bce5582a9e051398fa92aef9714
MD5 caece9b6beb4937369d44f987135a0f6
SHA1 f1d2a7e637911ffb35295ceaafffafc2eff6b2a3
SHA512 095ac2e7267b6e346205289768be6e26b3c7da2afd0f9953fbd5c81316e552672b8cfc9554df942fb7bf86fd7b77f42b881d4101ad38aea0970baab7d42030a3
TLSH
T1F301D16A35471D5AC0007975547BF52C7AD2FD713073CDD6E750100E5EAD035ED61355
MD5 SHA1 SHA512 TLSH

Submit Download

setup.ibt

Path C:\Users\Admin\AppData\Local\Temp\20251230-OpticFilm 8200i_12L_V6.1.0.3\64bit\setup.ibt
Size 426KB
SHA256 c1348b325f02a5c76e766af881eb87273246e3e750c7c0093842ac3cc8fa8a9a
MD5 534abef2221ea10cbc8bdd599f9bf759
SHA1 4e11527ce93effab87a92c0d51d031dbb1c364e3
SHA512 a57ef3e669947fe9b9b34f57dd8f757ea809cea9c37cdadf49cc903ccbffa625ad586aedde03524811fe72fbccf9890e6335905d5ccd4d3138412aea3b3c2f08
SSDEEP 12288:B34F+U0eTQrfzxi//eZQKqF/SK2ELsxeu+:VA+U0eTWt4tq+
TLSH
T110942262FEB1CB733FC19567E43063A2ED074A944702484756479ABEB283BD28857CA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.inx

Path C:\Users\Admin\AppData\Local\Temp\20251230-OpticFilm 8200i_12L_V6.1.0.3\64bit\setup.inx
Size 245KB
SHA256 eb7392dbc5d74856355d90a1d96723d687309f1e5d84dce4abb60ea78b190e6a
MD5 76a3e8edc92f77e0f0b869c3cc6806f2
SHA1 d1f35c164d07c32ab4ee18a5cf27041329e79d76
SHA512 fd6ee084a4a8639db5f965debfc53471d22aafdea67f379952e5226ee9ef485bd95960b55b89b56636fcfccef101a65fcebb92d4a4d04a4ab899b78b1ad56f70
SSDEEP 6144:jZFYWmenVqryoet4KekdCjKRXJk5DPpDmZ348ytQw:jZFYWvn6ethEHp+ytQw
TLSH
T10434BFA84DA60FCAB7388ADAE43708D036C5EC0DF1E54597A3F29690DF784F644DD09A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\20251230-OpticFilm 8200i_12L_V6.1.0.3\Install.exe
Size 42KB
SHA256 f087fd6f9c1e35c697ec56620f2b42247817c55dbb92a48b929f25a3f99ecc2e
MD5 ce97c22357b2c7f6ed37116980baf053
SHA1 e3faab15627cd95f6894a38aabd73cb0cdb9fe6c
SHA512 a67239007af3382886a95816f08b8d55863bffd157b3598473bc0e5431fb39f7b469f5fa33aa4f304323ee491e5d08207c5cfd6396200f8f5aab880822da2afa
SSDEEP 384:+TPtdmRGEupTbOj2M9xAGWoIVfn0FxwgfJIYiakMx1QSJIVE8E9VF0NydB:+bkupTyahtoofn0ELYixMl2EJ
TLSH
T1F8137E17B8518973D8429EF034E5F9299A776D011FF044932B29B68E9B32342ED3D36E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Setup.dll

Path C:\Users\Admin\AppData\Local\Temp\isp4158.tmp\_Setup.dll
Size 360KB
SHA256 ff6944c00f11ab10cc9bcbfe4f6f0cbab088b52448904282a695eea56787d82a
MD5 32fa757c64fb62f07f3205016656a0a7
SHA1 78c7d2f00878e2efa591a6e3ac80edab8242473b
SHA512 d87aef916ce072f16b6ca5978a424f2dc648d880241651019e6f21377834fdbba8dd424b002db373888840b358e13122c87e3db51a7bde6cdb1509fe74ac647a
SSDEEP 3072:C+zxGhVhyz5QpTOyGbs9nHoYgwQ/aQfn1SBLlwYK0yIrHb7SsFK6ZgRb4AtCHeoL:9khVh4yqiIY4uvfFZYCHe
TLSH
T19D74004366EA521CF5F36F71ADBF1DA1096A7D53A938C10D3201ED581CF0A64F9A3B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.ini

Path C:\Users\Admin\AppData\Local\Temp\iss40A9.tmp\setup.ini
Size 713B
SHA256 331a02c864143117c2f264cb91ef89b0441b0565b84dc0b3f94821a5d3cbd919
MD5 86ce76ffab00a92d348bbc60ddc8d84c
SHA1 4a0ebc38ad0e246ac4a600ef620a55e0c0356837
SHA512 f118f7fcf1cc5a9b3bb45b1d451278732baf32b4e5c4daa3c9a0cfcdbc8b23c0abd7f146f3f828801419138f494aa184bb72a16fefcdd5160b14dac301b7a716
TLSH
T18D0123F3931910752008099E7A3C5D6057D0322E84C9E7C1C3CD5D1E8E96B55FF5C262
MD5 SHA1 SHA512 TLSH

Submit Download

setup.skin

Path C:\Users\Admin\AppData\Local\Temp\iss40A9.tmp\setup.skin
Size 238KB
SHA256 0fdba27d91c078413ee375c07efca3761ac1532a5b7c03e9d9208ab7f663fcc0
MD5 1759c159d53fa1b72a990452a5d5a589
SHA1 da8c2424f7f0f239a7cb817a58a43f96a6545a55
SHA512 4bcca3f84521bb237f4d180d99ab3c255fdcbe2c55a04e11bafe73d057fc7e178f7567849c18527f35b2e2869375c43871cc1d70a5d9ef27ff64dad9fa65a3f6
SSDEEP 3072:qtTiJXk4LomFIeY3hiS+Rnyc0HiznLYCzHlLDW:qdmUhmFIr3hKZ30HiLcCLhi
TLSH
T1E8349EB4FA222ECC5DF579CA3EF44C896925252FA7333B0D46C74538210AC9365CEE99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skin422f.rra

Path C:\Users\Admin\AppData\Local\Temp\skin422f.rra
Size 16KB
SHA256 fdd11ab9305abc14a917ad28aef1e1ff78d000c4b86dd04db1e97ba8f87a31a1
MD5 80e0658c8a14f8889688768f6b9056cc
SHA1 92f5453f7736c9a62facba2c2c47e8b88c2b578c
SHA512 e9521da869bdc42e75f7bcde908f8c50a8f8038a1371d44b70b4169db6b6405d9bae540d49f1c2eb47aee6b6bd3d7fa3ca4fef01767cd7a26a971773e11aee52
SSDEEP 192:Rp4NNmjRN9zFwFeSAWak8VeumfgAYidzvv:Rp4NNmlN0
TLSH
T10F72C6D88B37370BC5A2E5B32D6AC481052F53745BBFB0E0A61F15580A9B178C9F6CD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CheckSystemVersion.exe

Path C:\Users\Admin\AppData\Local\Temp\{42FEA925-F7DC-4F11-9B07-35EBE0FDE4A4}\{086AA359-A8F0-46BB-B66D-21AE29420B81}\CheckSystemVersion.exe
Size 54KB
SHA256 1bc8aa06a33f9eed2ed8fb92d59b07c14aee86d2d8bbdec389a0296b8714035d
MD5 e5f334be2996c5bdecbffe0ef46f6ee7
SHA1 99f6307b1653fbc50163656a3d2bd82b64beabd0
SHA512 64a7d7cc8dda824628e622b72ba8c6adf453c2db3c9cda5fc33f47ed57b4906acceb77560f8334cdf1a5251087aaf6219cf199ceed57c4b57eb46feefa65a919
SSDEEP 768:Ppc+jyiHCufDrr3IGgjU0U9gPhR6lrx95Yx34rK3Z6mLCpkrjYixM/2EOCyb:Bc4fDrPcfPYb5PoZ6mLCpkrj7xM/orb
TLSH
T145437E12B950C433C81645F125A5CA56EF7FA5231BA0818B3B9C46BE8F717C19F3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScanApi_07b3_1825.ini

Path C:\Users\Admin\AppData\Local\Temp\{42FEA925-F7DC-4F11-9B07-35EBE0FDE4A4}\{086AA359-A8F0-46BB-B66D-21AE29420B81}\ScanApi_07b3_1825.ini
Size 175B
SHA256 789a2cecc4b3c64f74624a6ac48f922a16e1be2ff51773a3ec15c183eb881dae
MD5 1c6d0e0bc2d2d1f79555177c9f1c6784
SHA1 c63b546eed311e35f42e6763181f9d84bde66b16
SHA512 cd26ed4f3670ca058735f8c0ebb5418e9ba4dbc7b407f57aece289d1a19f3c867997600bfd79f76b224aa95519cd165a3de1cfca6d2209c7ae5a619c8537c4ad
TLSH
T1CEC080839D14527E104C03560B0DB0F5F95076DD915054635D4C555455744DCB75C515
MD5 SHA1 SHA512 TLSH

Submit Download

_ISUser.dll

Path C:\Users\Admin\AppData\Local\Temp\{42FEA925-F7DC-4F11-9B07-35EBE0FDE4A4}\{086AA359-A8F0-46BB-B66D-21AE29420B81}\_ISUser.dll
Size 28KB
SHA256 494573db4b5214fac3c3698fb232843a0c37fd592a3c1eed93a332040d5f2571
MD5 af7cc78ad4a00accb958aa4d126d4af3
SHA1 6de0333424407d3c603ffb5e5155418831901f99
SHA512 ce58304c764e4aa711b7755e596c57fd6ea2344c68d1afaf0aa51f30a7d8f21f0fa97ad2afa1baa641257d3b20e65955f6ec696d05ac2762d30ff7ef4a92a061
SSDEEP 96:5vpIpyETjiO/oDJOLT4vBVfO/aJc9gLCJEnGNxd+v:5R6yLOwDCT4vPf0aJc9gLCJEnGN2v
TLSH
T16AD2CF1225817612D1FD1B71827A8FD48222EE45017C4AFEDA37F7B65270A69CEB390F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_IsRes.dll

Path C:\Users\Admin\AppData\Local\Temp\{42FEA925-F7DC-4F11-9B07-35EBE0FDE4A4}\{086AA359-A8F0-46BB-B66D-21AE29420B81}\_IsRes.dll
Size 356KB
SHA256 269f7f808409cbfce1a800221e28cf03f4743f5b3d98d5479ae4e8a6e3afb58b
MD5 acb826195230ba7c391b447c94910cce
SHA1 818affc0c770fab09a2f34fab3b2847623efd102
SHA512 7ada14e3829bac14d2fb5622109d7c594dcf9bf89e1fffb46308b58524779bd96e48d9cb341265738fbd9a7ad11c0bde972bd3b7f97ba31f896f4c9f9337c45a
SSDEEP 3072:nFnCQcfoskkkkknOpb9YfMX0E9QsJB9cWe7Ka2qJpSCQonNRf:n1GoskkkkknOpKluaRjNR
TLSH
T186740D03A6AA804EF1FE6A359CBF2E644AA53C17993082387954FD1D5CF1A50BC17F1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

isrt.dll

Path C:\Users\Admin\AppData\Local\Temp\{42FEA925-F7DC-4F11-9B07-35EBE0FDE4A4}\{086AA359-A8F0-46BB-B66D-21AE29420B81}\isrt.dll
Size 392KB
SHA256 bea0a8f8454b94bd4cb2bf35a5363e538f816fdddd1d231358703d005faee17e
MD5 ea8a40913840238aed96eeb9dc19af1e
SHA1 8f94967525d852a5aaa1fb5ef8cdb20a98709877
SHA512 94973dca8cb25abd65c83ba2a680b3fab4ea7401f2d2b28f95369f678fd15f134d7d1dcbc812f285d30ab8003765928ccbd11d3924d2363f4a6f25d5b3df969a
SSDEEP 12288:svy9vtLXxLR11fcZlgUFPZYDMkS0GazZfOfyBISxT:sKvt7xNcPnvadGKBdxT
TLSH
T1EE848D01F6F5C53BC26B0134FB296FE9A3FC56251D619883DB944A5C2F73982D326A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A2FU.INI

Path C:\Windows\A2FU.INI
Size 153B
SHA256 5f89bb0db71ca87f245f6eecb20094bac7b1aea188d3b4e92c5497cd58f830fa
MD5 03ef14874f1c912fc9bd021f7af10ae9
SHA1 086ddccddbd838118a1aff478d1cd503d59e7abc
SHA512 ff5fb42a883bb3240ac854b11b64199f11449c3407faeb230870cb0957044d186a4c373f5db600d36d3e262385dde10ee4b86a0bb59b31ec5ad53039d4fb1d7d
TLSH
T123C08C410A0951A0300402C33326E4E04B90C8FA22E45876A0D4E8218188E123E3A015
MD5 SHA1 SHA512 TLSH

Submit Download

USBSb992.rra

Path C:\Windows\SysWOW64\Drivers\USBSb992.rra
Size 8KB
SHA256 1593856c798d3714bdbb7f6e05107896ed008778d47c56f9be63a9b179fe23f3
MD5 45f1636265b41f9ecc4f33a721a411e1
SHA1 65bc65b47ef03c5725fa732733ee335561b121d9
SHA512 22aa1fd8791b95860acd2dd844112edf45f76b8b520412c067a8facdee631385f21ebb4708d3ffa5b7a11e5f70c68bfd89d7aacbfd875615dfba7821010ef072
SSDEEP 192:BQVm3XTz4C062IXVslbq0ghX4gDGpBWz7Wm:BHNXtslbqXVtDGpBWz7W
TLSH
T14A023A433BEA0937E2AA82F2CDA11139533F75706D2EABD53844652D2A6B911784273F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1c_a2fu_x64.inf_amd64_8a9066a454e6f0a0.ini

Path C:\Windows\System32\DriverStore\FileRepository\a1c_a2fu_x64.inf_amd64_8a9066a454e6f0a0.ini
Size 319B
SHA256 34d2c43608da617c9403e6767125035c8a6d6548d29e50a2065cfd82a73d71c6
MD5 2d3b8c116dd644d5b06ade5bb154d1e7
SHA1 f9f06a2503b0c1e8c436626baace0f5f8a088c7c
SHA512 339961d0ea384579373d8e1218e1aca48e91c7f0dd8d5a0bb1a4f8aa1cd5aae54b1fb9fd3dba96f7a765d62ebb440c66098e1e1254170205307d479c36d228d2
TLSH
T1DBE07D4201E753CD584E71AC957F0F35CC156A869E2474C23A0181F08E8ED20DBA8151
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5568-7770-0x00000000060F0000-0x00000000061B9000-memory.dmp

Download

memory/5568-7866-0x0000000006220000-0x0000000006231000-memory.dmp

Download

memory/5568-213-0x00000000058F0000-0x000000000593D000-memory.dmp

Download

memory/5568-7873-0x0000000006870000-0x00000000068B2000-memory.dmp

Download

memory/5568-271-0x0000000005A60000-0x0000000005A90000-memory.dmp

Download

memory/5568-7882-0x0000000006D20000-0x0000000006D84000-memory.dmp

Download

memory/5568-7890-0x0000000006F90000-0x0000000006FC0000-memory.dmp

Download

memory/5568-277-0x0000000005B20000-0x0000000005B7A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads