Technical Information
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\vuescan\vuescan.exe
- %WINDIR%\dpinst.log
- %TEMP%\vuescan\dpinst64.exe
- %TEMP%\vueb31f.tmp
- %TEMP%\vuescan\scadrv60.cat
- %TEMP%\vueb262.tmp
- %TEMP%\vuescan\scadrv60.inf
- %TEMP%\vueb148.tmp
- %WINDIR%\twain_64\vuescan.ds
- %TEMP%\vuescan\vuetw64.ds
- %TEMP%\vueadad.tmp
- %WINDIR%\twain_32\vuescan.ds
- %TEMP%\vuescan\vuetw32.ds
- %TEMP%\vuead3f.tmp
- %PROGRAMDATA%\microsoft\windows\start menu\vuescan x32.lnk
- C:\users\public\desktop\vuescan x32.lnk
- %TEMP%\{51ead002-f88c-2dac-259a-13018cf8ac2d}\setc33d.tmp
- %TEMP%\{51ead002-f88c-2dac-259a-13018cf8ac2d}\setc477.tmp
Moves the following files
- from %TEMP%\{51ead002-f88c-2dac-259a-13018cf8ac2d}\setc33d.tmp to %TEMP%\{51ead002-f88c-2dac-259a-13018cf8ac2d}\scadrv60.cat
- from %TEMP%\{51ead002-f88c-2dac-259a-13018cf8ac2d}\setc477.tmp to %TEMP%\{51ead002-f88c-2dac-259a-13018cf8ac2d}\scadrv60.inf
Network activity
TCP
HTTP GET requests
- http://st####.hamrick.com/feedback_v1.txt
- http://st####.hamrick.com/vuescan_version.txt
- http://st###.hamrick.com/v1/submit?Ev########################################################################################################################
UDP
- DNS ASK st####.hamrick.com
- DNS ASK st###.hamrick.com
Miscellaneous
Searches for the following windows
- ClassName: 'HPPhotoSmartPhotoScannerMediaDetectUtility' WindowName: ''
- ClassName: 'BlinkMainWndClass1234567890' WindowName: ''
- ClassName: 'NikonFrescoSource' WindowName: ''
- ClassName: 'NikonScan2' WindowName: ''
- ClassName: '' WindowName: 'Dimage Scan Dual'
- ClassName: '' WindowName: 'Dimage Scan Multi'
- ClassName: '' WindowName: 'Dimage Scan Speed'
- ClassName: '' WindowName: 'Dimage Scan Elite'
- ClassName: '' WindowName: 'MiraPhoto'
- ClassName: '' WindowName: 'HP PhotoSmart S20 Scanner'
- ClassName: '' WindowName: 'HP PhotoSmart Photo Scanner'
- ClassName: '#32770' WindowName: 'QuickScan Plus (Plustek OpticFilm 135)'
Creates and executes the following
- '%ProgramFiles(x86)%\vuescan\vuescan.exe' /install
- '%TEMP%\vuescan\dpinst64.exe' /sw /sa /path "%TEMP%\VueScan"
- '%TEMP%\vuescan\dpinst64.exe' /sw /sa /path "%TEMP%\VueScan"' (with hidden window)
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{52bf335d-538e-2801-227d-bc103e51eb1a} Global\{659fdc53-81d7-69f7-b209-ba0c09c5d70e} <DRIVERSTORE>\Temp\{1b744964-4a59-1e52-8fc6-bc1b...
