6b170127061feb082ffd1b14309ef6d4a783df3c0fd51999e1786067731a49f3

Analysis

max time kernel
42s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20220812-es
resource tags

arch:x64arch:x86image:win10v2004-20220812-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
05/02/2023, 02:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

npp.8.4.9.Installer.x64.exe
Size

4.4MB
MD5

d6aa41bc611e2cadf170902f7252f042
SHA1

97cdf9153424b3b5a8f2d26eadbc33729d4e6744
SHA256

6b170127061feb082ffd1b14309ef6d4a783df3c0fd51999e1786067731a49f3
SHA512

0b2e5a5a4af8473362a4ae90a8d1442e8fde9a93019f725dd6cf5309cf550ac3fca7d3c04850be5bbccd3d3103a7346c73dc922b805bd3ae886278dcf4efb203
SSDEEP

98304:ptvzZ0qLC1i63OgAg37pTCNpeVi/CGdY49FnbmokK6qV5tX:pt7Ze1iqO+lTwMVihd/9pbmokK6cT

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	notepad++.exe

Executes dropped EXE 3 IoCs

pid	Process
4268	notepad++.exe
2260	notepad++.exe
2288	gup.exe

Loads dropped DLL 15 IoCs

pid	Process
1740	npp.8.4.9.Installer.x64.exe
1740	npp.8.4.9.Installer.x64.exe
1740	npp.8.4.9.Installer.x64.exe
1740	npp.8.4.9.Installer.x64.exe
1740	npp.8.4.9.Installer.x64.exe
1740	npp.8.4.9.Installer.x64.exe
4684	regsvr32.exe
3224	regsvr32.exe
2288	gup.exe
4268	notepad++.exe
4268	notepad++.exe
4268	notepad++.exe
4268	notepad++.exe
4268	notepad++.exe
4268	notepad++.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\InprocServer32\ = "C:\\Program Files\\Notepad++\\NppShell_06.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Notepad++\autoCompletion\rc.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\python.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\krl.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\batch.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\Navajo.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\khaki.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\sql.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\cobol-free.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\sinumerik.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\DarkModeDefault.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\Vibrant Ink.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\Zenburn.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\perl.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\ini.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\Solarized.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\python.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\vhdl.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\overrideMap.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\updater\GUP.exe	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\css.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\inno.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\updater\gup.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\Bespin.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\DansLeRuSH-Dark.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\javascript.js.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\updater\updater.ico	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\nppLogNulContentCorruptionIssue.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\updater\nativeLang.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\Black board.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\Hello Kitty.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\tex.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\localization\english.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\Choco.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\updater\LICENSE	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\Plastic Code Wrap.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\autoit.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\baanc.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\updater\README.md	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\xml.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\cobol.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\cpp.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\nsis.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\cs.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\powershell.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\asm.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\universe_basic.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\updater\libcurl.dll	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\sql.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\shortcuts.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\html.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\contextMenu.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\c.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\cpp.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\vb.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\cs.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\perl.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\haskell.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\lua.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\Obsidian.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\typescript.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\lisp.xml	npp.8.4.9.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\java.xml	npp.8.4.9.Installer.x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 14 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\Settings\Dynamic = "1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\ = "ANotepad++64"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\InprocServer32\ = "C:\\Program Files\\Notepad++\\NppShell_06.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\Settings\Custom	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\Settings\ShowIcon = "1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ANotepad++64\ = "{B298D29A-A6ED-11DE-BA8C-A68E55D89593}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\Settings\Title = "Edit with &Notepad++"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\Settings\Path = "C:\\Program Files\\Notepad++\\notepad++.exe"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ANotepad++64	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\Settings	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\Settings\Maxtext = "25"	regsvr32.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1740	npp.8.4.9.Installer.x64.exe
1740	npp.8.4.9.Installer.x64.exe
1740	npp.8.4.9.Installer.x64.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2288	gup.exe
4268	notepad++.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 4684	1740	npp.8.4.9.Installer.x64.exe	86
PID 1740 wrote to memory of 4684	1740	npp.8.4.9.Installer.x64.exe	86
PID 1740 wrote to memory of 4684	1740	npp.8.4.9.Installer.x64.exe	86
PID 4684 wrote to memory of 3224	4684	regsvr32.exe	87
PID 4684 wrote to memory of 3224	4684	regsvr32.exe	87
PID 1740 wrote to memory of 4364	1740	npp.8.4.9.Installer.x64.exe	90
PID 1740 wrote to memory of 4364	1740	npp.8.4.9.Installer.x64.exe	90
PID 756 wrote to memory of 4268	756	explorer.exe	92
PID 756 wrote to memory of 4268	756	explorer.exe	92
PID 1740 wrote to memory of 2260	1740	npp.8.4.9.Installer.x64.exe	94
PID 1740 wrote to memory of 2260	1740	npp.8.4.9.Installer.x64.exe	94
PID 4268 wrote to memory of 2288	4268	notepad++.exe	95
PID 4268 wrote to memory of 2288	4268	notepad++.exe	95

C:\Users\Admin\AppData\Local\Temp\npp.8.4.9.Installer.x64.exe
"C:\Users\Admin\AppData\Local\Temp\npp.8.4.9.Installer.x64.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s "C:\Program Files\Notepad++\NppShell_06.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Windows\system32\regsvr32.exe
    /s "C:\Program Files\Notepad++\NppShell_06.dll"
    3⤵
    - Loads dropped DLL
    - Registers COM server for autorun
    - Modifies registry class
    PID:3224
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" "C:\Program Files\Notepad++\notepad++.exe"
  2⤵
  PID:4364
- C:\Program Files\Notepad++\notepad++.exe
  "C:\Program Files\Notepad++\notepad++.exe" "C:\Program Files\Notepad++\change.log"
  2⤵
  - Executes dropped EXE
  PID:2260

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Program Files\Notepad++\notepad++.exe
  "C:\Program Files\Notepad++\notepad++.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Program Files\Notepad++\updater\gup.exe
    "C:\Program Files\Notepad++\updater\gup.exe" -v8.49 -px64
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Notepad++\NppShell_06.dll

Filesize
227KB

MD5
f972d1111a011530ffb512bf570dfa7f

SHA1
7233657287dd2c668176b6c94cb14e1db30cbfd5

SHA256
66282351d246b60e0212fc46e49c063d3a379e13757f440c9e1a7202ffd6be12

SHA512
68c727630bb5ee5b283e7a1af89caa246e47769348cad466495863d6fe23c19c4bb1591f52fd65343d92f432813236bf1ed82ba309032f7367bb381ec00aeefa

Download Submit
C:\Program Files\Notepad++\NppShell_06.dll

Filesize
227KB

MD5
f972d1111a011530ffb512bf570dfa7f

SHA1
7233657287dd2c668176b6c94cb14e1db30cbfd5

SHA256
66282351d246b60e0212fc46e49c063d3a379e13757f440c9e1a7202ffd6be12

SHA512
68c727630bb5ee5b283e7a1af89caa246e47769348cad466495863d6fe23c19c4bb1591f52fd65343d92f432813236bf1ed82ba309032f7367bb381ec00aeefa

Download Submit
C:\Program Files\Notepad++\NppShell_06.dll

Filesize
227KB

MD5
f972d1111a011530ffb512bf570dfa7f

SHA1
7233657287dd2c668176b6c94cb14e1db30cbfd5

SHA256
66282351d246b60e0212fc46e49c063d3a379e13757f440c9e1a7202ffd6be12

SHA512
68c727630bb5ee5b283e7a1af89caa246e47769348cad466495863d6fe23c19c4bb1591f52fd65343d92f432813236bf1ed82ba309032f7367bb381ec00aeefa

Download Submit
C:\Program Files\Notepad++\change.log

Filesize
1KB

MD5
2442537c1841cd23208d0642ec182084

SHA1
122ca90de59d3455ace5e8d24ac0cbd0ef2c435b

SHA256
cafa2568caea5416e31803ae24d274ada05b059a64c3fab5f70b98612ca04426

SHA512
ecece7cc1a557e89518a7a3520d87a2c9eedbf69cde5b107d7e9c5820f71231b713ed4e5ed0717b339f67b4ea558f57b6699cd84a697a52eaf4ea8061540be10

Download Submit
C:\Program Files\Notepad++\langs.model.xml

Filesize
377KB

MD5
8037f2c76b0e4f4b7644bb031653b787

SHA1
e4cf47285be348ddf4a0ae6a5ec3e690eaea97af

SHA256
2223365ce0b0206c163a54640e654a5f7e4d01444ce631340fbd3654fea04873

SHA512
622d97e250822477c59accacd2e7a0306c2e7fe79ee5593d9b5ba4ba0cfe4b91677a5c1b6f20ca70085a407b14a9632402e60d461cd6c65cbc5f4a2aceece019

Download Submit
C:\Program Files\Notepad++\notepad++.exe

Filesize
6.1MB

MD5
5be76b396af91837c038ef58cc3ab0c8

SHA1
37711673676dcd542695e10b400d8fcc8bbc2438

SHA256
de844bae026e847b6bf54582e3ca331ae3d47abf6bd7729b174c921deaed70ae

SHA512
736e15f1caa9f685070c2fd0c3fc454b3472f42ee54d5d82ddb323fe7bbb229b2215886cf4b96d40dc242b4189e3bd1ca612bf381f9322a29dd9a85ef8f84eed

Download Submit
C:\Program Files\Notepad++\notepad++.exe

Filesize
6.1MB

MD5
5be76b396af91837c038ef58cc3ab0c8

SHA1
37711673676dcd542695e10b400d8fcc8bbc2438

SHA256
de844bae026e847b6bf54582e3ca331ae3d47abf6bd7729b174c921deaed70ae

SHA512
736e15f1caa9f685070c2fd0c3fc454b3472f42ee54d5d82ddb323fe7bbb229b2215886cf4b96d40dc242b4189e3bd1ca612bf381f9322a29dd9a85ef8f84eed

Download Submit
C:\Program Files\Notepad++\notepad++.exe

Filesize
6.1MB

MD5
5be76b396af91837c038ef58cc3ab0c8

SHA1
37711673676dcd542695e10b400d8fcc8bbc2438

SHA256
de844bae026e847b6bf54582e3ca331ae3d47abf6bd7729b174c921deaed70ae

SHA512
736e15f1caa9f685070c2fd0c3fc454b3472f42ee54d5d82ddb323fe7bbb229b2215886cf4b96d40dc242b4189e3bd1ca612bf381f9322a29dd9a85ef8f84eed

Download Submit
C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll

Filesize
185KB

MD5
1d2f430ef609e5b759a71a8475faa583

SHA1
1e32014edc08b98102bbb53431ba015566f65cba

SHA256
40823392fbfe0472e0a86c34e535b7f6c3c5d57fa5879b40a25e48edc8558610

SHA512
7df594be1e0636573a121a453fa62f6867c31898f537410db2ff85b2e27f0ca12a8b1662a901846750efd7c90e88225fe10a6270e0e946c38f4e9a9d8ec69b3e

Download Submit
C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll

Filesize
181KB

MD5
3dc36feb6fa37043dad9a8373b03f239

SHA1
fc8b793df87c4d9ca8e41e585739a2b3f041aeeb

SHA256
556b2266aba620c8d77b7348cd34874d2cbe81ca73cffb454a8ca4a0ac138527

SHA512
75757dea4f386a2f0732ff64bb2b55578aa33a195a8338d10f7392825047da355aa18299dfb2086fcbb4b111e29a345fa4687cc89bf7f0741099855dfe5f9e9a

Download Submit
C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll

Filesize
181KB

MD5
3dc36feb6fa37043dad9a8373b03f239

SHA1
fc8b793df87c4d9ca8e41e585739a2b3f041aeeb

SHA256
556b2266aba620c8d77b7348cd34874d2cbe81ca73cffb454a8ca4a0ac138527

SHA512
75757dea4f386a2f0732ff64bb2b55578aa33a195a8338d10f7392825047da355aa18299dfb2086fcbb4b111e29a345fa4687cc89bf7f0741099855dfe5f9e9a

Download Submit
C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll

Filesize
181KB

MD5
3dc36feb6fa37043dad9a8373b03f239

SHA1
fc8b793df87c4d9ca8e41e585739a2b3f041aeeb

SHA256
556b2266aba620c8d77b7348cd34874d2cbe81ca73cffb454a8ca4a0ac138527

SHA512
75757dea4f386a2f0732ff64bb2b55578aa33a195a8338d10f7392825047da355aa18299dfb2086fcbb4b111e29a345fa4687cc89bf7f0741099855dfe5f9e9a

Download Submit
C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll

Filesize
153KB

MD5
87ff98d87927162f5e0c5aa3c4bcd36e

SHA1
9ce297575cb9e1cfc3a7532be27da7df8dc85303

SHA256
6261a497a8757412aa97348bd48c61f8fb72f7475533309720ad2672fdd871a1

SHA512
33edc7dc958f317eb5258801c1467f10484e10d4c11c97a14d2d363471678fca8c1f354109a5cf8f3ff95f439d63ae00eea5e432db746b17d959c61fd4da9886

Download Submit
C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll

Filesize
153KB

MD5
87ff98d87927162f5e0c5aa3c4bcd36e

SHA1
9ce297575cb9e1cfc3a7532be27da7df8dc85303

SHA256
6261a497a8757412aa97348bd48c61f8fb72f7475533309720ad2672fdd871a1

SHA512
33edc7dc958f317eb5258801c1467f10484e10d4c11c97a14d2d363471678fca8c1f354109a5cf8f3ff95f439d63ae00eea5e432db746b17d959c61fd4da9886

Download Submit
C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll

Filesize
153KB

MD5
87ff98d87927162f5e0c5aa3c4bcd36e

SHA1
9ce297575cb9e1cfc3a7532be27da7df8dc85303

SHA256
6261a497a8757412aa97348bd48c61f8fb72f7475533309720ad2672fdd871a1

SHA512
33edc7dc958f317eb5258801c1467f10484e10d4c11c97a14d2d363471678fca8c1f354109a5cf8f3ff95f439d63ae00eea5e432db746b17d959c61fd4da9886

Download Submit
C:\Program Files\Notepad++\plugins\mimeTools\mimeTools.dll

Filesize
132KB

MD5
7f690946bb867b2dafa019a1e876eae2

SHA1
98e0656ba96b2832e47376825208ac2c62247c70

SHA256
090c75af87e63fbddae74025f84aa96b2fdd3e10b1b19bf2a056371103527244

SHA512
eab255b61d15030a2e27c387fa523ac040b12bd1588cbbffa25e77ae976d76259150b9fbf42174a45f1a28a4155623d116f75c8032f52f35c8b1516db685db5f

Download Submit
C:\Program Files\Notepad++\plugins\mimeTools\mimeTools.dll

Filesize
132KB

MD5
7f690946bb867b2dafa019a1e876eae2

SHA1
98e0656ba96b2832e47376825208ac2c62247c70

SHA256
090c75af87e63fbddae74025f84aa96b2fdd3e10b1b19bf2a056371103527244

SHA512
eab255b61d15030a2e27c387fa523ac040b12bd1588cbbffa25e77ae976d76259150b9fbf42174a45f1a28a4155623d116f75c8032f52f35c8b1516db685db5f

Download Submit
C:\Program Files\Notepad++\plugins\mimeTools\mimeTools.dll

Filesize
132KB

MD5
7f690946bb867b2dafa019a1e876eae2

SHA1
98e0656ba96b2832e47376825208ac2c62247c70

SHA256
090c75af87e63fbddae74025f84aa96b2fdd3e10b1b19bf2a056371103527244

SHA512
eab255b61d15030a2e27c387fa523ac040b12bd1588cbbffa25e77ae976d76259150b9fbf42174a45f1a28a4155623d116f75c8032f52f35c8b1516db685db5f

Download Submit
C:\Program Files\Notepad++\shortcuts.xml

Filesize
3KB

MD5
fb573784b83033dd4361f52006d02cb8

SHA1
0a2923a44ec1bd5e7e8bc7cace15857ae03bf63c

SHA256
37a24662cd55b627807bc2bb7cbba5bbf2abaf6da4dd7bbb949bfaa7903eae9c

SHA512
753b44b5e8bea858cf5cc5ddfdc38098a2f3f921949cf98706ead95bdfa1de7ab0c115e9d69237623a03c422969480204c69d3ba277141527458c68230d0c67c

Download Submit
C:\Program Files\Notepad++\stylers.model.xml

Filesize
171KB

MD5
5c4e5f30be3f7e610cd129eb066afe8a

SHA1
6c4ffa91165ecdbc3d6b0080891becb8f31b73ca

SHA256
a961caf25faf0ca7c254e1a236f7e573824fd7c76c214ba1577b82c7786d5268

SHA512
cbac73d3b97efea1876771e2b0247f55f69da72c963a25f8d947ec55da84612abb6e6ceb8a7850adc8957c70b8005da5cd1b96b0ffbc976f39c62ed62361527e

Download Submit
C:\Program Files\Notepad++\updater\GUP.exe

Filesize
954KB

MD5
33a661540cd173898ff5bc3366aa7b26

SHA1
a74785482417e1b404b96b2046322892013515aa

SHA256
68a520463f0cb8792a61f97f47753156921de94e2238e68d9eee6c02b1e217c8

SHA512
dcc57d439f9596bf18d5ee933cb9ad512ca283bcc6e792510cf8bcbeb242fa00ab089a58bdf1b0a5f84ca4031f7b89d8d250b9ce29a2d673d4243ba57301de7a

Download Submit
C:\Program Files\Notepad++\updater\gup.exe

Filesize
954KB

MD5
33a661540cd173898ff5bc3366aa7b26

SHA1
a74785482417e1b404b96b2046322892013515aa

SHA256
68a520463f0cb8792a61f97f47753156921de94e2238e68d9eee6c02b1e217c8

SHA512
dcc57d439f9596bf18d5ee933cb9ad512ca283bcc6e792510cf8bcbeb242fa00ab089a58bdf1b0a5f84ca4031f7b89d8d250b9ce29a2d673d4243ba57301de7a

Download Submit
C:\Program Files\Notepad++\updater\gup.xml

Filesize
4KB

MD5
abde55a0b1cb4a904e622c02f559dcd1

SHA1
1662f8445a000bbf7c61c40e39266658f169bf13

SHA256
92717951aae89e960b142cef3d273f104051896a3d527a78ca4a88c22b5216a5

SHA512
8fe75fb468f87be1153a6a0d70c0583a355f355bfe988027c88d154b500e97f2c5241d9557ebb981067205e2f23ad07b6a49c669cd3e94eaa728201173b235a0

Download Submit
C:\Program Files\Notepad++\updater\libcurl.dll

Filesize
666KB

MD5
2abc3069ac7ebd1b3fcbe1fd823e5e74

SHA1
0655268ee39a985735d63aa6927ab59609ba77f5

SHA256
4892839008cd23a6e89fdfa64905cb3aaaab58f1e4bd14cd4b21b3009c7a0020

SHA512
7487da968b33ec9b071ac512de3ad9e18131ee9649de8884f697dc2ee944a5c05529fd86b5662a77fb2bc6c7b6a05c83a37312616921d973a27d183f5bcc2ef1

Download Submit
C:\Program Files\Notepad++\updater\libcurl.dll

Filesize
666KB

MD5
2abc3069ac7ebd1b3fcbe1fd823e5e74

SHA1
0655268ee39a985735d63aa6927ab59609ba77f5

SHA256
4892839008cd23a6e89fdfa64905cb3aaaab58f1e4bd14cd4b21b3009c7a0020

SHA512
7487da968b33ec9b071ac512de3ad9e18131ee9649de8884f697dc2ee944a5c05529fd86b5662a77fb2bc6c7b6a05c83a37312616921d973a27d183f5bcc2ef1

Download Submit
C:\Program Files\Notepad++\updater\nativeLang.xml

Filesize
1KB

MD5
d7752ef7501eb30094c4da3fedbc01eb

SHA1
5a1bcdad37fbc2d4c793f63524ec286c0d9b73b8

SHA256
bb8d443d23ab72d4f8ec39d7af28738b660ec38699876c8096c2c44be214c1b1

SHA512
3adb5195d8746905d3d282d31e5fc9413527eafd480932d5b53ec07630a8f475a61c9fcbc2398f7f95308b9316d5af507ac7277fcace91dd1ee7be609a129e20

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC1B1.tmp\InstallOptions.dll

Filesize
15KB

MD5
ece25721125d55aa26cdfe019c871476

SHA1
b87685ae482553823bf95e73e790de48dc0c11ba

SHA256
c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf

SHA512
4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC1B1.tmp\InstallOptions.dll

Filesize
15KB

MD5
ece25721125d55aa26cdfe019c871476

SHA1
b87685ae482553823bf95e73e790de48dc0c11ba

SHA256
c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf

SHA512
4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC1B1.tmp\LangDLL.dll

Filesize
5KB

MD5
68b287f4067ba013e34a1339afdb1ea8

SHA1
45ad585b3cc8e5a6af7b68f5d8269c97992130b3

SHA256
18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026

SHA512
06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC1B1.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC1B1.tmp\UserInfo.dll

Filesize
4KB

MD5
2f69afa9d17a5245ec9b5bb03d56f63c

SHA1
e0a133222136b3d4783e965513a690c23826aec9

SHA256
e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0

SHA512
bfd4af50e41ebc56e30355c722c2a55540a5bbddb68f1522ef7aabfe4f5f2a20e87fa9677ee3cdb3c0bf5bd3988b89d1224d32c9f23342a16e46c542d8dc0926

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC1B1.tmp\nsDialogs.dll

Filesize
9KB

MD5
6c3f8c94d0727894d706940a8a980543

SHA1
0d1bcad901be377f38d579aafc0c41c0ef8dcefd

SHA256
56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

SHA512
2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

Download Submit
C:\Users\Admin\AppData\Roaming\Notepad++\contextMenu.xml

Filesize
4KB

MD5
a27cbd2fc47815ef8dac7c86bbec7ac7

SHA1
c78f4cebd679e335c3f829e9904f40d7261ad214

SHA256
7fbff0b764605a533b72c77a4b803e8455f748ae6317e24f293aab619d59e005

SHA512
a5c52831e70435b587114ff72da23faf3d135c1a1f859d4fed45f8ff5e81839e2c39ab0b61d4631acab0de360b301f3aa1232ecc788575823159af2afa02e332

Download Submit
C:\Users\Admin\AppData\Roaming\Notepad++\langs.xml

Filesize
377KB

MD5
8037f2c76b0e4f4b7644bb031653b787

SHA1
e4cf47285be348ddf4a0ae6a5ec3e690eaea97af

SHA256
2223365ce0b0206c163a54640e654a5f7e4d01444ce631340fbd3654fea04873

SHA512
622d97e250822477c59accacd2e7a0306c2e7fe79ee5593d9b5ba4ba0cfe4b91677a5c1b6f20ca70085a407b14a9632402e60d461cd6c65cbc5f4a2aceece019

Download Submit
C:\Users\Admin\AppData\Roaming\Notepad++\nativeLang.xml

Filesize
90KB

MD5
f847d7fc4cca35f4ec4a6c7c8868ed64

SHA1
e2fc78c10b375a66682dea0b945195dcb2c2f665

SHA256
7261e41ee80a9a8d258366177854e145fb2ab268391aea13fe768c9badb76a6d

SHA512
fcba93e3de848b72e6f22a04150f698b188249fabf1d9b83030608db3dda47ce915fbabd89fd9dc3b2779a005b0c379f478bc860e483869a6883f84ade1f0c8a

Download Submit
C:\Users\Admin\AppData\Roaming\Notepad++\shortcuts.xml

Filesize
3KB

MD5
fb573784b83033dd4361f52006d02cb8

SHA1
0a2923a44ec1bd5e7e8bc7cace15857ae03bf63c

SHA256
37a24662cd55b627807bc2bb7cbba5bbf2abaf6da4dd7bbb949bfaa7903eae9c

SHA512
753b44b5e8bea858cf5cc5ddfdc38098a2f3f921949cf98706ead95bdfa1de7ab0c115e9d69237623a03c422969480204c69d3ba277141527458c68230d0c67c

Download Submit
C:\Users\Admin\AppData\Roaming\Notepad++\stylers.xml

Filesize
171KB

MD5
5c4e5f30be3f7e610cd129eb066afe8a

SHA1
6c4ffa91165ecdbc3d6b0080891becb8f31b73ca

SHA256
a961caf25faf0ca7c254e1a236f7e573824fd7c76c214ba1577b82c7786d5268

SHA512
cbac73d3b97efea1876771e2b0247f55f69da72c963a25f8d947ec55da84612abb6e6ceb8a7850adc8957c70b8005da5cd1b96b0ffbc976f39c62ed62361527e

Download Submit
C:\Users\Admin\AppData\Roaming\Notepad++\toolbarIcons.xml

Filesize
2KB

MD5
a021f773fc816ecaddd307d3ccec1796

SHA1
d3c7ceff4e5b24b2707d74bac1203a77a7005756

SHA256
067ed480313383f2e1fdbadeb9bef8740160f489a0ba5bbdbb7929d44f230b7e

SHA512
4d57c32ec6dbfc05f31c7c95ab5e8c267b3777be0214b48713ca58c28ef4e7c29981cd16cd3cc4623bb1a892411801a53945d10b3bdbbafde51bd01eb7ec217c

Download Submit
C:\Users\Admin\AppData\Roaming\Notepad++\userDefineLangs\markdown._preinstalled.udl.xml

Filesize
6KB

MD5
672e6d5f89887666ec94711e442644e0

SHA1
8d069ae93347316eff0dcf7aff4d22da18a62af2

SHA256
b34fe6811dacfe49d77d434123867e866daf6e0e27387a0446887dabe8943f04

SHA512
8fc5e9bbe027826304fa6f329fb16e4c9e4e7a597d87e9c691ed6a9f505b7bc1967339b43c6426105432a030260b0654468ab8fcbb4312b2fb6ed6c6aa537edc

Download Submit
C:\Users\Admin\AppData\Roaming\Notepad++\userDefineLangs\markdown._preinstalled_DM.udl.xml

Filesize
6KB

MD5
3690cef1865e32fe6be1b2ec7656539a

SHA1
bc043bec63c310a60d9e242810036460c467945d

SHA256
e45e49f0895249d951df2c07e0f06ca1242e05c961dd921e5aa2781ae2e7ff25

SHA512
c2be869d96baec2018e13dcf5934dd9cf74146541e852cc2eedb4d83a8af23e2577cde7a0158fefaa11056416ff039df3a7725e320620193e9bfe72c8067c051

Download Submit