Well,first don't make double threads,and about the scans,it can be a hidden keylogger in the coding.
You need to see the coding before you can say.
But the first one is probably a virus or packed with Themida.
Last one probably not,it's because it's a hacking device.