542b9a9d4e63f303c978af7dccfc6a969c3ccb1ddafb10b6f4f2939d54a09a0d

Analysis

user interaction
yes
max time kernel
37s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 08:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
naps2-8.2.1-win-x64.exe
Size 44.8MB
Sample260511-keytjsdt9s
SHA256 542b9a9d4e63f303c978af7dccfc6a969c3ccb1ddafb10b6f4f2939d54a09a0d
MD5 80dea4b7d4bc611384cbef1af6239326
SHA1 f6f22a4c10284a5663cc84fe1b2adfac1399baa7
SHA512 96433d0942abbbaa35629a8dd2061a601c272aade02c592fe2a3e270536e456febaba0398351aabcc99f3aeed0be22b494132dacc94865145d06fc91673ed852
SSDEEP 786432:Ql8sJbIQflNp18dkoVPvZiFAogb7El0TLWkhXWr6K+Nfi9Sop:QPJsQflN4koVvILgb7/9FW+K0aH
TLSH
T1C1A73323F2CBA13BF1AE86359976E66A1437AA9459124C26E7EC794CCE345D00D3F307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
4876	naps2-8.2.1-win-x64.tmp
3704	NAPS2.exe
3308	NAPS2.exe
3652	NAPS2.Worker.exe
4516	NAPS2.exe

Loads dropped DLL 64 IoCs

pid	Process
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3308	NAPS2.exe
3308	NAPS2.exe
3308	NAPS2.exe
3308	NAPS2.exe
3308	NAPS2.exe
3308	NAPS2.exe
3308	NAPS2.exe
3308	NAPS2.exe
3308	NAPS2.exe
3308	NAPS2.exe
3308	NAPS2.exe
3308	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3704	NAPS2.exe
3308	NAPS2.exe
3308	NAPS2.exe
3308	NAPS2.exe
3308	NAPS2.exe
3308	NAPS2.exe
3308	NAPS2.exe
3308	NAPS2.exe
3308	NAPS2.exe
3308	NAPS2.exe
3308	NAPS2.exe
3308	NAPS2.exe
3308	NAPS2.exe
3308	NAPS2.exe
3308	NAPS2.exe
3308	NAPS2.exe
3308	NAPS2.exe
3308	NAPS2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\NAPS2\lib\is-NF4T0.tmp	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\nb\is-R86S2.tmp	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\_win64\is-JDCOH.tmp	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\System.Net.Ping.dll	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\System.Net.Quic.dll	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\sr-CS\NAPS2.Lib.resources.dll	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\System.Runtime.InteropServices.RuntimeInformation.dll	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\si\NAPS2.Sdk.resources.dll	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\is-B24RS.tmp	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\Autofac.dll	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\nn\NAPS2.Sdk.resources.dll	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\is-N2DO3.tmp	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\nn\is-HPCI8.tmp	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\System.Linq.Parallel.dll	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\System.Drawing.Common.dll	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\System.Text.Encoding.Extensions.dll	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\de\WindowsFormsIntegration.resources.dll	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\is-QUGJU.tmp	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\is-CJDKK.tmp	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\is-9QFMS.tmp	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\tr\is-R4EB7.tmp	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\System.Core.dll	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\he\NAPS2.Sdk.resources.dll	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\System.Threading.Thread.dll	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\is-6TS6U.tmp	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\is-RBN1A.tmp	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\is-AITVK.tmp	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\System.Security.Cryptography.dll	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\System.dll	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\ja\System.Windows.Forms.resources.dll	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\is-A4UNT.tmp	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\is-1AJ1T.tmp	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\System.Text.Encoding.CodePages.dll	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\hr\NAPS2.Lib.resources.dll	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\zh-Hant\WindowsFormsIntegration.resources.dll	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\is-VCDG5.tmp	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\is-O9ADT.tmp	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\hr\is-BR9L9.tmp	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\System.Design.dll	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\is-EDKND.tmp	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\is-K52H0.tmp	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\is-KPU85.tmp	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\sl\is-6JS69.tmp	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\NAPS2.exe	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\ICSharpCode.SharpZipLib.dll	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\System.Configuration.dll	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\System.Net.NetworkInformation.dll	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\pl\System.Windows.Forms.resources.dll	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\is-IG3QC.tmp	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\is-O88F6.tmp	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\is-4E0B5.tmp	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\is-L6CM3.tmp	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\is-H3O57.tmp	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\bs\is-1PH5K.tmp	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\fi\is-AHMVR.tmp	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\Microsoft.Extensions.Logging.dll	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\is-NLJKN.tmp	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\af\is-4FU93.tmp	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\lt\is-0EDPD.tmp	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\pl\is-89T6C.tmp	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\System.Xml.Serialization.dll	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\hu\NAPS2.Sdk.resources.dll	naps2-8.2.1-win-x64.tmp
File opened for modification	C:\Program Files\NAPS2\lib\es\NAPS2.Sdk.resources.dll	naps2-8.2.1-win-x64.tmp
File created	C:\Program Files\NAPS2\lib\is-3KKDF.tmp	naps2-8.2.1-win-x64.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	naps2-8.2.1-win-x64.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NAPS2.Worker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	naps2-8.2.1-win-x64.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4944-0-0x0000000000F10000-0x0000000000FF4000-memory.dmp	innosetup
behavioral1/memory/4944-7-0x0000000000F10000-0x0000000000FF4000-memory.dmp	innosetup
behavioral1/memory/4944-868-0x0000000000F10000-0x0000000000FF4000-memory.dmp	innosetup

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NAPS2\DefaultIcon	naps2-8.2.1-win-x64.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NAPS2\shell	naps2-8.2.1-win-x64.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\.pdf\OpenWithProgids\NAPS2	naps2-8.2.1-win-x64.tmp
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\.jpg\OpenWithProgids	naps2-8.2.1-win-x64.tmp
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\.tiff\OpenWithProgids	naps2-8.2.1-win-x64.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\.bmp\OpenWithProgids\NAPS2	naps2-8.2.1-win-x64.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NAPS2	naps2-8.2.1-win-x64.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\.jpg\OpenWithProgids\NAPS2	naps2-8.2.1-win-x64.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\.tiff\OpenWithProgids\NAPS2	naps2-8.2.1-win-x64.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\.tif\OpenWithProgids\NAPS2	naps2-8.2.1-win-x64.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NAPS2\ = "NAPS2"	naps2-8.2.1-win-x64.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NAPS2\DefaultIcon\ = "C:\\Program Files\\NAPS2\\NAPS2.exe,0"	naps2-8.2.1-win-x64.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NAPS2\shell\open	naps2-8.2.1-win-x64.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NAPS2\shell\open\command\ = "\"C:\\Program Files\\NAPS2\\NAPS2.exe\" \"%1\""	naps2-8.2.1-win-x64.tmp
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\.jpeg\OpenWithProgids	naps2-8.2.1-win-x64.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\.jpeg\OpenWithProgids\NAPS2	naps2-8.2.1-win-x64.tmp
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\.png\OpenWithProgids	naps2-8.2.1-win-x64.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NAPS2\shell\open\command	naps2-8.2.1-win-x64.tmp
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\.pdf\OpenWithProgids	naps2-8.2.1-win-x64.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\.png\OpenWithProgids\NAPS2	naps2-8.2.1-win-x64.tmp
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\.tif\OpenWithProgids	naps2-8.2.1-win-x64.tmp
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\.bmp\OpenWithProgids	naps2-8.2.1-win-x64.tmp

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4876	naps2-8.2.1-win-x64.tmp
4876	naps2-8.2.1-win-x64.tmp
3704	NAPS2.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3704	NAPS2.exe
Token: SeDebugPrivilege	3308	NAPS2.exe
Token: SeDebugPrivilege	3652	NAPS2.Worker.exe
Token: SeDebugPrivilege	4516	NAPS2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4876	naps2-8.2.1-win-x64.tmp

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 4876	4944	naps2-8.2.1-win-x64.exe	79
PID 4876 wrote to memory of 3704	4876	naps2-8.2.1-win-x64.tmp	81
PID 3704 wrote to memory of 3308	3704	NAPS2.exe	82
PID 3704 wrote to memory of 3652	3704	NAPS2.exe	83
PID 3704 wrote to memory of 4516	3704	NAPS2.exe	84

C:\Users\Admin\AppData\Local\Temp\naps2-8.2.1-win-x64.exe
"C:\Users\Admin\AppData\Local\Temp\naps2-8.2.1-win-x64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Users\Admin\AppData\Local\Temp\is-ICJDJ.tmp\naps2-8.2.1-win-x64.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-ICJDJ.tmp\naps2-8.2.1-win-x64.tmp" /SL5="$4017C,45816457,867840,C:\Users\Admin\AppData\Local\Temp\naps2-8.2.1-win-x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Program Files\NAPS2\NAPS2.exe
    "C:\Program Files\NAPS2\NAPS2.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3704
  - - C:\Program Files\NAPS2\NAPS2.exe
      "C:\Program Files\NAPS2\NAPS2.exe" worker 3704
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:3308
  - - C:\Program Files\NAPS2\lib\NAPS2.Worker.exe
      "C:\Program Files\NAPS2\lib\NAPS2.Worker.exe" 3704
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3652
  - - C:\Program Files\NAPS2\NAPS2.exe
      "C:\Program Files\NAPS2\NAPS2.exe" worker 3704
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NAPS2.exe

Path C:\Program Files\NAPS2\NAPS2.exe
Size 252KB
SHA256 d15d7bfdfa8f6470cbc096313a017509c7d7a52118f178d679fd6e7cdcd41d12
MD5 452717048acbf404c5261fbf863e53f2
SHA1 e075a011b8655ec536f44a2af0ce5a8fa4e72d07
SHA512 d90d33edd260c1d9e6b82880178384bb248dcc602d0a24c39a37a67e31b6c7ba9cd87c626a33add99e3d105dc1c45ef315e068796b8a0ee26906cf2afb149bcb
SSDEEP 3072:98t/5ZzDd5CQ4LBDaygsP4O5Q1gL3W5KBjNN3TVp2teXQgLe9o88xBJhsvM:98t/DzDjCQ4LBB9JNFVp1XzLe9o88xlP
TLSH
T141445A87B29801FAD5BBD235E8624852E7723C259BB052DF23A0F6760E737811D6F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Autofac.dll

Path C:\Program Files\NAPS2\lib\Autofac.dll
Size 373KB
SHA256 d53799c4f46bd1550c543822105f1c5e172ebccc4e0713f0a457804bb6d97f74
MD5 501e1c4750d5c235af685c12c53d71fa
SHA1 93a49726b911e104ef0ac8f85eeda3c6a45fca41
SHA512 4aaa13e2b41c3374d31b9243c75771a34b58f79bedeab77b5b9b5f2c83c0c6777e0defffe5cc1962d02753304d53ee7c0a02f1717adf2aaacd42fbccfb78eaff
SSDEEP 6144:L8qjiScVNUfyWQiFJr/jqZOCYWA66TV8WvPUFXkeRUS6Q:N/fwOnlD3C
TLSH
T1F3845B9323F81A1ED2EBCEBB653450414BFAFD0AA44DD70D6DD8A0ED0E62B048951B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eto.dll

Path C:\Program Files\NAPS2\lib\Eto.dll
Size 755KB
SHA256 61004e8ed18f37877781fc16be59f87558b96bfa93d07f078ee675e5ec781118
MD5 784a48f79c72e7724c9a60055ea68520
SHA1 019f48223bb3da2e7fe95033d0b57b19c4c7cdb0
SHA512 498cee3a769a243e8c9e51fc23aacb3d422b909598fa5c3baae1fd1fa4b9586548410fed624c66ddb4a0e9527cae7a7a40b773a9897f03590dfa797d94fe659d
SSDEEP 12288:pisyrkH34WHL/ip9gVpj15FU5Mqak9gkhVHPSogvhdhaAT/pdjuvM1:hH34WHL/ip9wpjvC5MqaqgkhVHa5fCv0
TLSH
T1F4F45C5D63BC8A2EEC9E5236F024043706F5E55B638AEB973554E9782D83BC21D402FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.Abstractions.dll

Path C:\Program Files\NAPS2\lib\Microsoft.Extensions.Logging.Abstractions.dll
Size 63KB
SHA256 0dce32c03f338e04a42bde3a364b45f22388a876979793098ba973048163d609
MD5 3a8a05c325944ba97efa2198b3e49622
SHA1 da688aad5f37e1a117de89f5fc09cf4d571d57a5
SHA512 86cbeaa8f7a913851944c78a63d02866da831294f7a436aadbd53a48046fcb37f0753d1df8607055e3755befce73cf228f8309bf38bc54d1b4748eaed24b98b5
SSDEEP 768:uz7ouSrbVozuvi53ReiJd/zk6cuAJU/JJZIAJF/tkJJQiS42hsmc1P+L/ib4XC4u:tuoVozugRhTWAJFmQFc1PYigC4dezJv
TLSH
T19F537C119BDC4377CBBE4C75E821D6935BB8D3676402D75B2CCCB468681BBC84A213BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Win32.SystemEvents.dll

Path C:\Program Files\NAPS2\lib\Microsoft.Win32.SystemEvents.dll
Size 102KB
SHA256 c8aa442f0bb0d2c2fa97212f3bc7aab9870df183ed1ffd56ff878ed842bba97d
MD5 f1f13621eca3bf7f9c3e5b7922f4ecaf
SHA1 b0bd950702179c81ae86e812b3e4ea7cd96af2cc
SHA512 0c07ac84e2ef202e05e1ed6bb8b6ee51ae9015d628a5d8872106aabc0d4c5a89b2bf8ca5e538a08cf3e9e6cd327fb5c13355dcb8a9d8e9838519434369bee640
SSDEEP 1536:DZr/0p1ve50FWlQEFwzcC6q140W/nGosIhdBA1eFYsXqwzm:Dip1vefQ81eun8IhdBlYsawC
TLSH
T16CA34B20B34482A5E6AF4D3A9923ED01A974F1D35712EFEF20CE544A4F63FC2A775252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NAPS2.Escl.dll

Path C:\Program Files\NAPS2\lib\NAPS2.Escl.dll
Size 100KB
SHA256 b59e470433fa935ea813701efac6d7ec9c19310d0ffa40fe72573bb72076b4a6
MD5 0a17a3728de751e7cc9a92a99986fe96
SHA1 6dd8088a09bce3fca329be8cb89e05d212968e15
SHA512 2a5c7bb7c59781653ed96262f75e11c3af3cc3a2ecfddc3bafc6de2bdf2198a39ce20d8409805110a84624e0a77538698b376381ee975fbf3f7ad4a09a401d70
SSDEEP 3072:pgUB+gV2TrP5ObDooovDiphfQqVDaH9Wv6:p1BVqrP5ObDooP89T
TLSH
T12AA31B6163680617CB6E57B87820C1118333B3663985D2DDAB8CF6C9B907B557B30EBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NAPS2.Images.Gdi.dll

Path C:\Program Files\NAPS2\lib\NAPS2.Images.Gdi.dll
Size 28KB
SHA256 cc564dc0f669021d29f7b0ddd5b2fca67cc2aa1cb337cfb8fe0140d9133946c3
MD5 2fc2c7c80c3157101f940c545784d995
SHA1 0d3766f51f16599d6ef9c5687084c010ac703f45
SHA512 858b461c6df2a629e95aa3fd29ca01905ee47694a02d262bf9f085d58f95dc53dfefe2394b18092ec5a5a52a0a9836ef38d572333daab334cc2a859bb864688c
SSDEEP 384:bi//SelGLMMRVvUWQaKsfv2HSr8xT5SB12JDodE6ki2y2imN8aAxnKzCKjd3gSG1:2//S8/+GWk4uHXK9P2wucnKzCKZikA
TLSH
T1EFD26C090BA9432BDEEA4EB5A4F886471E74E782A8C3DB4F2C1521BE5D0F7842F15356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NAPS2.Images.dll

Path C:\Program Files\NAPS2\lib\NAPS2.Images.dll
Size 129KB
SHA256 3f77330d2a2c11c0edd6bf9dda5fa76158179ad24bf395f7e1e4ac06dea8f638
MD5 e94c2d5b63f708b3f9b71e59f8c2531f
SHA1 dabb87ad31082e3e71665e194ffac14af7a63706
SHA512 553a96b9d67c406222e8c1e3b6968aa08d9e265072941a8718db501facfc2abf7649bbb7954332551b69012563c2815dec6c06974fc02fb241f117501cff93cf
SSDEEP 1536:1SLVEuX1aEMPQB1OHJtJ78wZkW/CdE9/StcjY26bT2TqfCxyxnTNrvj:0LzXoJ2+Bp6dbtGY2ATRvj
TLSH
T17ED35B2457184713CFAF57B5F0904D118236B3222642D7FEB7C8B6AAEC13B413B669A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NAPS2.Internals.dll

Path C:\Program Files\NAPS2\lib\NAPS2.Internals.dll
Size 94KB
SHA256 90d8ffea84f1731e9c1a4d07d5efc20a077df740a58fec98649632c36cfd463c
MD5 8979c9b4468040bdbbc714c7a590d088
SHA1 099812f83892ee8b57b8e1ce4f3bad687d578544
SHA512 38789935e313e5f840297d867fa3390126417658294c7725e05f29cdf46d09f23a1bb064e4ccda415d2a59587d891c1ea2df94f3c513e8ca5eadf0c392e9dc51
SSDEEP 1536:ULv+BX16sEB38gvrx7QBPoyO/5RhlT2TqfCxyxF7XNmvV:mI1wbrxEK5Rl7X0vV
TLSH
T17B933B6593980727CE6F56FAB850C0818331F3679941ABCEB6DCD7A9E403B512F32978
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NAPS2.Lib.WinForms.dll

Path C:\Program Files\NAPS2\lib\NAPS2.Lib.WinForms.dll
Size 123KB
SHA256 00617021026a09d4d70cd7f168a5c3020b771dd2a2d343db35c9c4363422ee27
MD5 9458eb478cc636734d9597bfb6fdceb5
SHA1 bc5c10595cb68f3d40a85925eac02fcd025d2558
SHA512 8dff9a704ed3619be067774a8ea1649490f8d8461e919e312d2b970d22606ba5d69067dcf1c60c033bfb17a2427282c259062dda026c77d3f2e9d1b3e6b89afb
SSDEEP 3072:vjgu3iB/Xf29jjj33WmkNrt7ElChdZmGvA:vtyNnlt7ElOWF
TLSH
T104C36B51A3284717CABF4BF9B4604041C731B3A3CAD1DBDD6EC8A79CE947B406B6067A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NAPS2.Lib.dll

Path C:\Program Files\NAPS2\lib\NAPS2.Lib.dll
Size 1.4MB
SHA256 fea68b2c5a382d3c4e9a7857e09c17cf1a10f1ae035444d20743107844fe935d
MD5 07c6ace41c207f9d4f8bb97814d3ede8
SHA1 c2b05ea27ea453c84b39259f0314f6fd173c08e6
SHA512 1cde1ec69bf21702705f4b7296fbdcb3eee97b87654b10772e02ba891587e078210a8b98a0ea37e5e737e5e0e64801f758a9a8b2f2135ac2485063ff06bc1c77
SSDEEP 24576:lmNI2O7z6pGo1hGheWgvwrxpjwfLpRJdvVR0d6kXmGVm:OfOKAo1hGheAp8fLrVR0dJfA
TLSH
T18B658D5237BC922EE0FF4A31A03040364BB7EC83B152E78EA669F9C91DB67434D45667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NAPS2.Sdk.dll

Path C:\Program Files\NAPS2\lib\NAPS2.Sdk.dll
Size 609KB
SHA256 a8b95f5937c4a52842a7b2337bc04a53e14304042a66162fc69fdadf7ee4cbc6
MD5 3b7576d5e93b3ec3365e28fc7b08d3c5
SHA1 7b3de15c5e74e7d0563b7d54c0592ec412e47b4c
SHA512 56629ee35d57ebfee625fb67ef87c64e0652e01a679c1e1a49f1b90159ffd6e931105c544180c519cfbad7739e56eee3b90ac1d384ea1b45a7ce640454f9d860
SSDEEP 6144:nQz79uA8xe99j6mp4tJTCnc3uvKaE17bDM7FZm41BFzy/77W772WmXrZET9vm/jS:nQ393c3uvA3MpZh1fyzC8awiJ/DTYub
TLSH
T1F3D46D0073BC6B2AD8DF8739B42205194FF9E607F566EB8F5548AAE51D83342CE503A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NAPS2.deps.json

Path C:\Program Files\NAPS2\lib\NAPS2.deps.json
Size 114KB
SHA256 ea64f7ae04c8d9ad4d93e3308b4a9830c109db5c9643b605c38883b76d040c52
MD5 f59616048c26874aed15a64c8dd26139
SHA1 7960c860ab8de845481ef4dbafa7885a0f978405
SHA512 87e511bfc52f3a4237d5d8e63d5d2e21533240a854f429c46fe485f101e5d6732933c25fe5721dbde09dd3540494d2e948441f014985e5c97fba0d47c8ae0df4
SSDEEP 768:TzKVctpMeR+ZteFR4guZ9GgCneSEnFX6z5H3HItqO3zICPgsiF01Xx:aVupMeRIteFR4guZ9GgCneS5V4gVCBx
TLSH
T140B39925CB945DA305766BA668348181F362432F60046C8FBCFC215DDFB3EAB52A5F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NAPS2.dll

Path C:\Program Files\NAPS2\lib\NAPS2.dll
Size 112KB
SHA256 094e725de7e9be9076825c4567ac6d1a983d6c9479aa7b55c510d64d7ca47819
MD5 0c003f7d37cd9ae934ee17d701d232b5
SHA1 4805a26ba47d9eb76e4e352398419e2a2771a5d4
SHA512 bbe57c8c9ad7d754c1bcc3f5a47e613d84d1808f53f61552fb221bdc0af6e00bc176e0a6e71f22480401649a48b0747179cc4cd7bafef43bcb5c6d21a75e370b
SSDEEP 768:ynBxtdYXhe1dMt+WCx01wK15VH8Ee9708xixH+nFFFFFFFFFFFFFFFFFFFFFFFFY:KteXxp3Le9o88xBjINwvdJ
TLSH
T13CB3E7DBBA1481B3EE7F8573F46798B21B702C66EAD010663198F79604B3713194BA1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NAPS2.runtimeconfig.json

Path C:\Program Files\NAPS2\lib\NAPS2.runtimeconfig.json
Size 673B
SHA256 3867d0d065b9fc352c3526d57eb13edd7b3ea274699283ea4b250a514d49b282
MD5 0f3475a84fc0c4d7279feb65ba9f23ba
SHA1 652d5f24661c353ae00fdfa2bbbca8797355bf73
SHA512 0dab14110a26924c635899abe0e6a90ca23628b4f459ce77511c5b587c0d243234df8f6feedaa9527c64d5cceb753718b1ce07f8ba54ce7394477c1074b80b9f
TLSH
T1C5017869CA692CBB08B5637AD936C1C3EA30573B00041C43B9FC081C6FBB9A52122F95
MD5 SHA1 SHA512 TLSH

Submit Download

System.Collections.Concurrent.dll

Path C:\Program Files\NAPS2\lib\System.Collections.Concurrent.dll
Size 286KB
SHA256 2ab8bd5f82d1c0b1cc2bbf98d716c0c41f2c01e7e1d2492f65a22b18b85a9092
MD5 5c0854d9fede3d900d81a2b587584a3f
SHA1 f111a2e0e04f6983b39ba10249c4290e572f2d71
SHA512 ac194c79476d0231ffc492d02725acc2a521961d95c85e14f48ee5f3621c924131c0e4266dfbcbf6e85b21466fbbda24dc9655739c3936e82c37bc21816076a5
SSDEEP 6144:PmDqMEDvu0D1dQvx+19w5xF7c2fOggEdIQMJY:PmyjlDLsswFc2fOggZrY
TLSH
T1AB548D1173CD0616FE6F9A3A85A3C800D1BAB4A31312D1EB4335E658DE5FBC61ABF146
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.Immutable.dll

Path C:\Program Files\NAPS2\lib\System.Collections.Immutable.dll
Size 882KB
SHA256 289c5ae72d745ec399c1234c74f40f5cf77db7215b0083cf1021c5dfc3d1893f
MD5 f6d6fb9dcc514c7d5b6146242ef79b1c
SHA1 b0efc7ec7d2635ab5051f7eadd6094b70c689f02
SHA512 f2a74c2af5955a087058631200ffa0d035d401c85c2339c58e18d18eefc7910467036ca88ae2d17ac6367f1186b230e6bf09b3b9c15b73096f610e92f0d5ed61
SSDEEP 12288:8uV2tdE91lIg7UGiz7j7iPmOPcDw7FqHvx3ozpG+YLgPNJl1S4dQTVCqjy:D2tG91Zcr6qHvx3oT9PNlfdwjy
TLSH
T15F155B15EF8C0A96E92FB6BAD65381A4D668C0155322C1CB40DAF7B03F937C1A77B487
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.dll

Path C:\Program Files\NAPS2\lib\System.Collections.dll
Size 326KB
SHA256 f40ad8f400cd9ee968fddbca77bab337c4959f81d86aebc8af00c4e7cec86acc
MD5 0154db2b260f50c3ea4dd6aa6c763dd3
SHA1 68bbef807f13a5d6ecaba9b8c0206968e08c7f10
SHA512 59ca7bcfdede417d30c749513808a54a85ae71bcfb474d31d9c7a946e55afb3a693703884d7ae555e1a7fa6067f6ebfca7ae2c78b27947b0e18056f6a5183d3d
SSDEEP 6144:nAyQRx3ZZIzqptoZxZwZpwmghvmmHKiTsE4KjAkqERhe:LEZGqfSyMm4vmaw7k7Rhe
TLSH
T19D645B29738C6719ED6FC17AE593C061E479804283D182CB0A6DF6449EEBBC17EBE153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.EventBasedAsync.dll

Path C:\Program Files\NAPS2\lib\System.ComponentModel.EventBasedAsync.dll
Size 46KB
SHA256 94eb568f0f9fb398571745721f4df22a71458e415787ad038f30ad8ed961ebe3
MD5 a9211f5babd70640f81bbeed7786b998
SHA1 4e15617ea4c8499a7378925ebe99606daf355376
SHA512 2314b55d07d1e99a8e46710d3c167f36a584b3e7ef37d3d394459f4606d9a6bf7ab0cee1d3570b94805c3c555ed2d7a9288555cc451733587960758b8e45417e
SSDEEP 384:L9MWlwW2p3rDc1vdWBFEWi7m+9ieY4/RqfJV15QmIDX6O88+aEZ4j5wVqDNJRDJe:LBMipLvYy4fM8IVPtkjQtaSQZs49zot0
TLSH
T1BE236CB5439C4272FAA7467892B2CA125A78FACA9742C7DF2454E30D2ED33C0977126D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.dll

Path C:\Program Files\NAPS2\lib\System.ComponentModel.dll
Size 30KB
SHA256 3e2fc7f36b9b628df016d5676519165bb95bb51b6fe9077109957959436fd4d7
MD5 3110ea8304a64a92b0bba9bf0979ce01
SHA1 d55921e7b8f94579681ef64b44ba80c944a878ba
SHA512 154a26c293c56ca2eddf4de9822d62c10266249f1d64f8ebf9e3373a172b4e5c7d143aad86fadc9bab4f34f55264a51d3ac0a5f78d7a7751b5c380b1f69c0587
SSDEEP 384:zWl1W26vY+nMls9fLXmztvGHRN7OvNgYMTR9z2:WEXjQtaOvNNg9z
TLSH
T16CD24C9697684212EC5B0D7066FDDA437D3DB7C25A02C6AB1682F2490DD37C89F3463D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.TextWriterTraceListener.dll

Path C:\Program Files\NAPS2\lib\System.Diagnostics.TextWriterTraceListener.dll
Size 66KB
SHA256 018509d3131ce99daf4c69c0558b628d90f000d16df625ca9c14fd3fd5124422
MD5 ef272d973414fa99c2b959f81d66b137
SHA1 2d82e1abc64040af2eac8a0b93fda67f8de6eec2
SHA512 c23bf9dd0d501458a9bd3fac0c94ffdf6456125a19c8ba48c6ae82673b20a6c1a1696b3767c1bb540ff3e1271e1bb26ca13d3bb3b1a25b2da7144a8568a05006
SSDEEP 768:pZ/7UzW2NnYSSPXfW1uYL9EjL2MbS72sxmZC2yVkkC+AuFrjQta7x9zB:pd7utYFPPpqcBoe+AOQcPzB
TLSH
T187635B26A3E40A07EB7F96BD86238809E470F98B0311D5DF958AE95D0F877C0BF3155A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.TraceSource.dll

Path C:\Program Files\NAPS2\lib\System.Diagnostics.TraceSource.dll
Size 142KB
SHA256 fb800cc177198d5ece257100dcb30093e237b2a40a82c54c8b8acc756c5e19d3
MD5 20014cc2e2ecfb8b9b27386c96b7c5a5
SHA1 f367229d9577d6cd0c89c2ece4a530d755dd46c6
SHA512 46503a01a1d61dca3c2e1cf43d0c5d99a8c4ef21bb093a162e26d5ce8bb61996c8520013739f0227ca73c3c694a0508179afdc1ae6dfae6096890d3ec07d0202
SSDEEP 1536:YdM6oA14CEEajpj5ZHcoPd/dCXqYmBlM5m9iWRZrx31nDef4cjcx2CwF6uXczK:cpZkpFZHfOPm9XZ9JDef4cjcxb9uMG
TLSH
T1A1E36C3A37D84607DB6E1678816B8500DAB3D8C3170BD3CF098A9D580F937D5BEB909A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Linq.Expressions.dll

Path C:\Program Files\NAPS2\lib\System.Linq.Expressions.dll
Size 3.5MB
SHA256 4c08ded7327814783c368de42eda69c331d8ad846d1b836508cae2cbd2aacdb6
MD5 55b88cc240304c7dfae39c2c59bceeff
SHA1 e3f68383edfc3b266ee328be56fcebd7fdd6a4b5
SHA512 2d4fa199c58c2d3b936ca8b264dd9b01dc73c8df218bab52fa37328033ebf40be2e013c30a0eee8d2bf775f931933ac0f5e29952b3226124c6f7917cf1cf7e64
SSDEEP 49152:6cPBXnHrR9azkHxmxdiWMQd9tooEH7fX9MU3arlZa90syeFE:lPBjRklBs90syeFE
TLSH
T1A6062A2597BC0B04F327C0BE8BA6C652E8B4482567F595CB00FBCE154FA7BE162770A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Linq.dll

Path C:\Program Files\NAPS2\lib\System.Linq.dll
Size 642KB
SHA256 1b1c17d8d1bd8b74a8cd3703cc7aeb9eede83365bcef0a7bf86f3c37a46937fa
MD5 602baa483873d8ebdccd8d1bf11bac9a
SHA1 cad71233a2ce2bd3feed5163f40d7581ec9ce2b1
SHA512 77f77d6cd847d3fb67813ad3508f32371e5b6b63fdc3663c74211fce5984ae219188d4a2efdde22d803ba8d294bead7f02a4251f23d156df05a6e393373b2330
SSDEEP 12288:mkKGEbh7qnjsKqtT+CS2aBIPyp8xrjUDdnGG4hhh0ppppKMMMMMEVF8:mkPElqIKqkXePyp8xH5Vi
TLSH
T195E43B2DA7884A02C76E467AC573D171D6E09D928312E6CBA74CED842FB3FF16176324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Program Files\NAPS2\lib\System.Memory.dll
Size 158KB
SHA256 d1393e0205fac92113dd89bb6e009ce6f5d65555047b4d047ea9801a511a1c21
MD5 a9417351526a67727ebc85e9e7e6b716
SHA1 15f24b495e26ae16c7e6861fc810980aa7b13605
SHA512 298a996f80d1921f7f5e68184fa9441898f0ce096aefb6fd534830af8befa2cc0939ae03260ea6addf318a0410db55e2e4ecbc567acf1dfca5d4686811073081
SSDEEP 3072:Jo2ie8P+ZSX//vpjM+dXwayf11ojXM6JaI/h22KA6Qf:ieqpYMwayfWXM6j5XZ6Q
TLSH
T1CAF36B37C3980257D92FEAB9A5268E02D7337052970195CBE8D4E6846F53BD0FEB7422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.CoreLib.dll

Path C:\Program Files\NAPS2\lib\System.Private.CoreLib.dll
Size 14.6MB
SHA256 28d107b5b3b049eac7e953a02d35a289f6aa4de171efdcb5a5ea1966210f9b9f
MD5 9df28f64637440ec595519098040379b
SHA1 97207fadea7fb60ec42b1bc55c056165943514d9
SHA512 054ca9974c957aeb5da9215b1ffb0f0dcac9bd79fe5d53c085d32ae0a064d6fb25b0319fd39b3e23ce65c25b8fa078f3abde5e05c9d988a7b9171d3dc83d4432
SSDEEP 393216:TYV96mkL3budBIGRSBwArpqXFllllYKlKtr:UmeSBwYr
TLSH
T139F6AE50D3D84F96E16FC37DC1638162EA78F896872295EB1845EA482F63BC057373E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Xml.Linq.dll

Path C:\Program Files\NAPS2\lib\System.Private.Xml.Linq.dll
Size 390KB
SHA256 aea84282de239e466399d759c934cbbb57af841e2055f3f6b803efdfe06dea92
MD5 2bd91d2f15adeef3725613677c6c30e2
SHA1 5b0caf8dfada4b6e7e39c60f692ecf194240cebb
SHA512 e8292899927f2dc0c7d2b3d9eff727d61ee88e222a7698e5c5399fefcf8cabd9c30ef883a6174ce5271d6a93177fa4da14d961bd324af77eb1c44f2d2c55234f
SSDEEP 6144:YqbEinotTtiCb31rH2lRovr1uZ0tCyCj0ezpC:Yqoinotxmi8Z00Hj0eNC
TLSH
T1B2845B2DE3980A12DE1F91FCC6438218E1B2869243E1E7CF8558DDD5AE8F7C1A673167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Xml.dll

Path C:\Program Files\NAPS2\lib\System.Private.Xml.dll
Size 7.6MB
SHA256 465faa5cdee43422a58c971e6a71d438eb7d6047178e2c136175acc24456412f
MD5 cf93e0fd41a5a3e472ee75f3028ee8c7
SHA1 591b242ba6c68840c541d56539025b9727649070
SHA512 19829df39496015904ab27fbcb6015011942715a86f9f271a7af2e7aa3b729198210f57d20d02f37246e92acec3b8a0c89339995bdc5b9abf52a72cdcd39fbf6
SSDEEP 98304:teNPufqI5/fc864R7xN2dIR6ohP3QshILcY:tyuZNfrh1x6C6oh4c
TLSH
T114867C24A3D40A26D32FCABDC636C601E2F9F44353A696CF0514EBD92F837C29976563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.InteropServices.dll

Path C:\Program Files\NAPS2\lib\System.Runtime.InteropServices.dll
Size 110KB
SHA256 4600e49854c34551d9f9124327f0ab318278323a22ccfffddbf0164c19d2952d
MD5 b8b0f0c86f29375a2c03229afa00acc8
SHA1 0557c7989b22af021371bd2e271412c3c7335cad
SHA512 87cc095e2f6343566ef1fd9d8608db6b909450b5e1503cd29dca3ed637ec7cb81ef9093c18c91c0eb43ff94b8cc0475bdf1fac5e279dfde8c2fefb54af254b20
SSDEEP 1536:Fn7Pi3PvClOpYKnNPMGZ6d3WRFS/wM6ppOeKnhiVGXvzUizl:Fnu3PXpYKl8dmRFS4M6LzKnhiVGbUih
TLSH
T147B35A2437D8022BCE1A4778F877A9419AB3F7C60321E5DF5584888E0ED77C266737A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.dll

Path C:\Program Files\NAPS2\lib\System.Runtime.dll
Size 43KB
SHA256 3aa6be6d442bc08a0f685ba94ad3a8bcda5e50a3db996c9b08ca2dbe121a8e73
MD5 b0d42609fc2cb404327d00fc2c6f5b45
SHA1 e520c8eabf6f9f3297392381f6719938c170beaa
SHA512 34a78f9aa5ba008bbe9cdc5ea997ac99cded8e4c79b3dfea257fbd90fb5a4bf6c5fbff56e4faba7b3cd09416d7021cd6c1c0eeaa7e3611fa4fd217a1b99ae6f1
SSDEEP 768:ZLMmlf72E79fFFK/T5r57G52E3Jgz7c7u501uENPoL+0GfJT4YA96hKWTuV/5Ohr:0GSA3Yvp50v4bSRS0jnTXmz0
TLSH
T16C130875EE9A1333CE8A6372ECB3A4A00DF673C474775FBA444E961660CB3848235769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.Thread.dll

Path C:\Program Files\NAPS2\lib\System.Threading.Thread.dll
Size 15KB
SHA256 e26e2f33fa910923699fbc35d493f975486d2ec47c32a0032cd82ac7ae74d757
MD5 032a539ff33fae8030553b0f24aaeda8
SHA1 1d0bd19cdfe702b93ea96ba3403d2c9245d52171
SHA512 a9002a810744418278ba9838427246078c8d4f7753666546e5b408c5455d218eb019adafd84b66ab63b891a03dbb7e7d843ff3cbc19249f2d38e466079482ab4
SSDEEP 384:c4Zz2Eu8VgmWP7WdfLXmztvGHRN7lUR7i1R9zg42+:c492PajQtalUR7in9zu+
TLSH
T168726DA187AC0143EDA71DB091F5DA833C3E77C29911DA6E1696F2541867388DF3077D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.dll

Path C:\Program Files\NAPS2\lib\System.Threading.dll
Size 82KB
SHA256 a956f44e16c3f2cc6457012a606399a1bc6942bdc9b215639f2e06366d6306cb
MD5 e940aae6a2712693438c4a46adaad4d0
SHA1 ba13cbbe08b944b7d6f7f7e54f4c86f4b6a9c514
SHA512 6d41a1835f3b9554af052af6358f7f5c6d7e40e038da6a11add3c4b20d60f629d046f9a33fd677d3ab81e25688815e876fa4a082459eb73f578b5ac12bb9b8c9
SSDEEP 1536:B8W2vmB8Q4ogHwXQaJUDlRZdRbs98cOfon6Qcuz9D:B8WH8Q4oAwXulRZHgKcOfon6QBZ
TLSH
T141834822A3E8051AF67B837DC5B796058076FAD21B00C5CF5165D10E2EB7BC0A6F35AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Xml.ReaderWriter.dll

Path C:\Program Files\NAPS2\lib\System.Xml.ReaderWriter.dll
Size 21KB
SHA256 a48c3bb37b6a9d6da2ca5b0565d24f829707d746f27ee5dac5d0caf1017287c6
MD5 d2330e38890ea9da5103852fbecaf50e
SHA1 fc341edcf022c7be83ad9ae6a3932a8e5616591c
SHA512 3fcea427b6a8753d9b3270cd0a4822a0f9a585ed7c06fa11310411a70de77925bbafe92518e905891ad2502713c2f0f2e612cb64afbff8f05d05f6a80fbf0479
SSDEEP 384:c1G5qkxK67ex4FCPEqWPAWhwnHRN7qIBHR9zV/QeV:i6LsEzAX7f9zam
TLSH
T146A208A0CE74CE13ED6A7B70C6AFD5C33BF4629134729776D586D50B88A2384A633319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Xml.XDocument.dll

Path C:\Program Files\NAPS2\lib\System.Xml.XDocument.dll
Size 15KB
SHA256 2cfe827b367b8879175409867ab2af6ef577b88d434701a00d0a8a1cfc539ab0
MD5 438d40ecb385b470ea06e27689f11749
SHA1 83a6d95bb1d7bc47f0d291cc656c98feb87280ed
SHA512 241479231d6fc73661ddab8efa51368e165e618c347304c6b80116011e6d083dbc0048a569f2ce52eae1a56b8d67911fa5ef06c2574798949805e384bef961a7
SSDEEP 384:pueW2dWpGpwnHRN7m/FJBzxIPaR9z8E7op:s2OXm/FJBzxOW9zLcp
TLSH
T15D724AA257784643FEAB1E3062E9D9433F7C63E26821D62F1681F5861893784EB3032D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Xml.XmlSerializer.dll

Path C:\Program Files\NAPS2\lib\System.Xml.XmlSerializer.dll
Size 17KB
SHA256 786c656aa8210b564b0ba86fb9aba3460cfa4b1e7480d520d5b9df8d5f1039af
MD5 58696e54acb761ee764ae921b9f841bd
SHA1 949328465b0cda476ea35f35490d689c9de404c5
SHA512 3db3133004ea08dc66765a1179408b6df644207861701144fed7a958cfd5db0c11e88573e7fa09cb6c05fe53eb705f1a8f7f0a65dd4c36e07b517ae86c0970e1
SSDEEP 384:CM3a4ADWyvWK3fLXmztvGHRN79NviCksR9zVrACv:L3a4AZz3jQtajio9zek
TLSH
T1CE824D65C768CB23ED765F70D9AAE9833E7863C365328B69018DE2450897384C73DB6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clrjit.dll

Path C:\Program Files\NAPS2\lib\clrjit.dll
Size 1.9MB
SHA256 b7965711666ce4467570b3e7982e5b9dbedf88d0c6b5b39c33b559d7e913aaf4
MD5 0a31e429786d4fadf669ba70b8bbfa6c
SHA1 905a1fba18a0271e44926f34b9b84667851c3afb
SHA512 94b268e1323ec8d46fe7867b450f0d8178068eb1f6cf7162efeca62378755c5858d33bd7e1f1488869cb0aa1568fe71050333e586ea0db3231d53189322355a7
SSDEEP 49152:Tnj6I0gylyYzamvieVbBlmBYaYdSnfnDTZb5AXPm8DxGjo+XBR4usVfXi7lBZGaD:TJ0gBY6YzSnfnZ5mPvsrXnofXi5GU
TLSH
T1CA959D46A3AC00FCE1BB9174C5174E17EBB2B85623718BDF52F40A566F237E2262D319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

coreclr.dll

Path C:\Program Files\NAPS2\lib\coreclr.dll
Size 4.6MB
SHA256 b0e101864621c0edbeb9d3cf2ec6552d9e68b857928de2e645f4c142009a2a31
MD5 ad4ef772dd6b7471f83b3e572d9e7683
SHA1 3400e99accfb13592ef419dd9c9e36751ae9f489
SHA512 56644bda09e4ef6fb3d8fa2757a9f1ca7db10a786bca22e1922569e059f5ea00ebb6ced72dd8c0bcfcabab14d3a7a5028ee01ce64142bfcd95d37e12c35aac25
SSDEEP 49152:FQd/YGSNUe6L9OrdxrOuQ9gwQTzb7b7b7b7bJ7b7b7b7b73YIUfWIU1pmgr/tRP4:mJs6L9OrdxrOutXLWUaGMF7
TLSH
T1FB268E17B2BD0098D4BAC078C5D74A17FAB278555338EBEF06648AA11F27BE16B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\Program Files\NAPS2\lib\hostfxr.dll
Size 349KB
SHA256 bf74c117e359a9ab4b9e955e5af95d3b785657178893733f429191fd41ba76ad
MD5 0ffd9db103b9f33840700fcfff9b2b31
SHA1 71cd5286f3434a6573b36badb8c5c48657c3cfc0
SHA512 66c4a73a78d95ad5ca032717deacd7814c25b0e9c74a09a1e77d065e8f5215a0bd5d1b56cb45de26c068686d702e889f39d2643dc978cea202a63569273ee2d0
SSDEEP 6144:+sVH0bdlil1pg5eFQ2TVqp2P2dF1jY1Zub2SePFo0w:UEVgMQ2RPMGub299o0w
TLSH
T1A4742A12A6F801BCF1B7A3789A679901E7B778494770C6CF0350956A2F63BD0CE79722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostpolicy.dll

Path C:\Program Files\NAPS2\lib\hostpolicy.dll
Size 365KB
SHA256 4e295ae3d9c661ff7bdbbd29df14938c469d4a92efd1bda4998aca141bd0dd53
MD5 faae22ac38ea78fe9b60d3e61a8904aa
SHA1 a2234a7ad067881a638c7b30571bd888ad80e325
SHA512 d11cc3ffcded3e9a246926a23af9c37819bd0c18755f44862ab45f08586aaf645c67b6c12cd623b9aa3990b428c179b13fecf1a04fcf8bfb11581d67b51019e0
SSDEEP 6144:c+9+XL8MG74cMBZphprkltZRerITRLd/zEncMWa654vd:19M1DcMbphprkltZRDLdoOH5ed
TLSH
T142842B16E2EC01BCE1BBA2788A778902E7777C49077186CF1360956A2F77BD09E79311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naps2-8.2.1-win-x64.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-ICJDJ.tmp\naps2-8.2.1-win-x64.tmp
Size 3.4MB
SHA256 5742db332455f322599c3f20a3f9f26fe76286dfda36b36246f68d04dd4a2695
MD5 b37f14db2353475304733e89c774e4f1
SHA1 b3e00638640b3529cfe5168342233125cf2e5877
SHA512 0ee5607e29311139efa25988d9fdcc97476911b73d3bde8e3cefce96d49b37c7c57644c72fa650bb465c478683dc31aacf7ec835f47c2cbf7582994d036b6d69
SSDEEP 49152:zWwGHAkqMu7ot6SCiGoghuXs7+KXrmeSVrJuh52gu8v333TN:z9GdkJuXbeSVQdu8333T
TLSH
T134F55D23F34D653ED05B3E3D6A3792A0987B7A602D128C576BEC3A8C4F355801E2A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3308-875-0x000002CC7C570000-0x000002CC7C5A1000-memory.dmp

Download

memory/3704-874-0x000001F5772D0000-0x000001F577301000-memory.dmp

Download

memory/4516-879-0x000001DC81280000-0x000001DC812B1000-memory.dmp

Download

memory/4876-9-0x00000000032D0000-0x00000000032D1000-memory.dmp

Download

memory/4876-8-0x0000000000CD0000-0x0000000001047000-memory.dmp

Download

memory/4876-867-0x0000000000CD0000-0x0000000001047000-memory.dmp

Download

memory/4876-802-0x0000000000CD0000-0x0000000001047000-memory.dmp

Download

memory/4876-5-0x00000000032D0000-0x00000000032D1000-memory.dmp

Download

memory/4944-0-0x0000000000F10000-0x0000000000FF4000-memory.dmp

Download

memory/4944-7-0x0000000000F10000-0x0000000000FF4000-memory.dmp

Download

memory/4944-868-0x0000000000F10000-0x0000000000FF4000-memory.dmp

Download