File scan report
Verdict Safe
Is Transcreen.
Only 1 of the 63 antivirus engines that checked it flagged this signed installer, while leading engines remained silent and the combined sandbox verdict found no high-risk…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 63 flagged
- Flagged 1
- No detection 62
- No result 12
- Code signing Shenzhen Photool Vision Technology Co., Ltd.
- Test run Completed
- First seen 2mo ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The lone VBA32 detection is not corroborated by any leading engine, behavioral finding, or external intelligence source. The valid publisher signature and clean combined sandbox verdict strongly indicate that the Dapato label is a false positive, although the publisher has no established history in our records.
Only 1 of the 63 antivirus engines that checked it flagged the installer, and that result came from a less reliable engine while all leading engines remained silent. The file carries a valid signature claiming Shenzhen Photool Vision Technology Co., Ltd., though that publisher has no established history in our records. The combined sandbox verdict was clean and recorded no named injection target or other high-risk technique. The mapping lacks the artifact needed to establish process injection and therefore carries no adverse weight. No malware-specific community rules, public sample-database listing, malicious child, or other independent evidence corroborates VBA32's Dapato label.
What We Detected
Only 1 of the 63 antivirus engines that checked it flagged the installer. VBA32 applied the label BScope.TrojanDropper.Dapato, but no leading engine or second independent detector supported it.
Threat Behavior
The combined sandbox verdict was clean, with no named process-injection target and no high-risk technique recorded. A T1055 mapping appeared without evidence identifying an injected process, so it does not demonstrate process injection. No sample network contacts were recorded, although a complete host-reputation cross-check was not available.
What To Do Now
The evidence strongly favors an isolated antivirus false positive. Obtain the installer from the expected vendor or distribution channel, verify that the publisher signature remains valid, and keep security software enabled during installation.
Where this verdict could be wrong3 caveats
- VBA32 labels the installer BScope.TrojanDropper.Dapato, although no other engine supports that detection.
- The publisher signature is valid, but there is no established signer history or curated publisher match.
- Our own static analysis was not available, so the installer contents were not independently inspected by that method.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No leading antivirus engine flagged the file.
- The installer has a valid signature claiming Shenzhen Photool Vision Technology Co., Ltd.
- The combined sandbox verdict was clean and recorded no named injection target.
- No malware-specific community rules or public malware-sample database listing matched the hash.
- No inspected file it created carried a malicious or suspicious result.
- VBA32 labels the installer as a Dapato trojan dropper.
- The valid publisher signature has no established history in our records.
- Our own static inspection of the installer bytes was not available.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 3 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 3isolated sandbox runs
- 5sandbox rule tags
- 3spawned processes
- 0network contacts
- 22filesystem & mutex artifacts
What this file did when executed
This file was detonated in 3 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
5MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1033· Reads user info
- T1055· Process injection
- T1082· System recon
- T1091· USB spreading
- T1120
Observed activity
Processes started
3Programs the file ran, with their command lines.
msiexec.exe"C:\Windows\system32\msiexec.exe" /I "C:\Users\<USER>\Desktop\Transcreen.msi" /qb ACCEPTEULA=1 LicenseAccepted=1msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\Transcreen.msi"msiexec.exeC:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 99BD8CB768CA88AC616136B75D9DB288 C
Files
20Files the file created, changed or deleted.
- Written
C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp - Written
C:\MSId3204.tmp - Written
C:\ProgramData - Written
C:\ProgramData\Microsoft\Windows\Templates - Written
C:\Users\user\AppData\Local\Temp\MSIB2A2.tmp - Written
C:\Users\user\AppData\Local\Temp\MSIC5AE.tmp
Show all 20 entries for files
- Written
C:\Users\user\AppData\Local\Temp\MSIC6D8.tmp - Written
C:\Users\user\AppData\Local\Temp\MSICFF1.tmp - Written
C:\Users\user\AppData\Local\Temp\MSID3A.tmp - Written
C:\Windows\Fonts - Deleted
C:\Users\<USER>\AppData\Local\Temp\MSI8CFF.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\MSI9107.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\MSI9137.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\MSI91A5.tmp - Deleted
C:\MSId3204.tmp - Deleted
C:\Users\user\AppData\Local\Temp\MSIB2A2.tmp - Deleted
C:\Users\user\AppData\Local\Temp\MSIC5AE.tmp - Deleted
C:\Users\user\AppData\Local\Temp\MSIC6D8.tmp - Deleted
C:\Users\user\AppData\Local\Temp\MSICFF1.tmp - Deleted
C:\Users\user\AppData\Local\Temp\MSID3A.tmp
Mutexes
2Named locks a program uses so only one copy runs; malware families often reuse them.
Global\_MSIExecute\BaseNamedObjects\Local\SM0:5780:304:WilStaging_02
Sandbox background — not the file
7The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc - VM process
lsass.exeC:\Windows\system32\lsass.exe - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time
Show all 7 entries for sandbox background — not the file
- VM process
msiexec.exeC:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache. 1 has no saved verdict and was not checked; that is missing coverage, not a finding.
- 4d7ef9c76a6cc56eedcf…a50d8eNot checkedno saved verdict
Chapter 04
Technical details
1 of the 63 antivirus engines that checked it flags it; signed by Shenzhen Photool Vision Technology Co., Ltd..
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- VBA32BScope.TrojanDropper.Dapato
File fingerprint
- Last analyzed
- Oct 23, 2026, 7:12 AM UTC
- SHA-256
5c66e09cbca126dd02bbf680314a573f48274c11c47b0a291cb2f23c723e96bf- SHA-1
a196dfb73a5e0db23a872a5e03f5ca6bbd875866- MD5
ac6a10718f2d8c79ac5c8780e88161c6
About this file
Transcreen.msi is a Windows Installer file of 15.8 MB.
- Type and size
- Windows Installer · 15.8 MB
- Signer
- Shenzhen Photool Vision Technology Co., Ltd.Valid code signature.
- First seen
- Jul 29, 2026On VirusTotal.
- Submitted by
- 13 distinct sources
First scanned
Antivirus consensus
1 of 63 engines flagged this file
12 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-233 engines0flagged
- Low-trust12 engines1flagged
View all 75 engine results
- VBA32Malicious: BScope.TrojanDropper.Dapato
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is Transcreen.msi safe?
What is Transcreen.msi?
How many antivirus engines detected Transcreen.msi?
Is Transcreen.msi digitally signed?
What is the SHA-256 hash of Transcreen.msi?
Is it safe to install Transcreen.msi?
How up to date is this analysis of Transcreen.msi?
Community
Member reviews and reports for this exact file hash.