hxxps://notepad-plus-plus[.]org/downloads/v8[.]6[.]8/

Analysis

max time kernel
61s
max time network
63s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
12/09/2024, 22:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://notepad-plus-plus.org/downloads/v8.6.8/

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 4 IoCs

pid	Process
2608	npp.8.6.8.Installer.x64.exe
2164	notepad++.exe
4444	gup.exe
4968	notepad++.exe

Loads dropped DLL 15 IoCs

pid	Process
2608	npp.8.6.8.Installer.x64.exe
2608	npp.8.6.8.Installer.x64.exe
2608	npp.8.6.8.Installer.x64.exe
2608	npp.8.6.8.Installer.x64.exe
2608	npp.8.6.8.Installer.x64.exe
2608	npp.8.6.8.Installer.x64.exe
4500	regsvr32.exe
1764	regsvr32.exe
4444	gup.exe
2164	notepad++.exe
2164	notepad++.exe
2164	notepad++.exe
2164	notepad++.exe
2164	notepad++.exe
2164	notepad++.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Notepad++\functionList\raku.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\Vibrant Ink.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\DarkModeDefault.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\gdscript.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\shortcuts.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\rc.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\perl.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\ada.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\xml.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\overrideMap.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\updater\updater.ico	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\updater\GUP.exe	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\Monokai.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\java.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\lisp.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\hollywood.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\fortran77.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\localization\english.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\vim Dark Blue.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\vb.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\c.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\python.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\Hello Kitty.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\khaki.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\autoit.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\cobol.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\readme.txt	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\javascript.js.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\langs.model.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\contextMenu\NppShell.dll	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\uninstall.exe	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\nsis.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\java.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\php.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\cobol.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\cpp.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\Navajo.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\gdscript.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\sql.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\LICENSE	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\perl.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\nppexec.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\Twilight.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\css.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\batch.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\php.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\javascript.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\inno.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\autoit.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\plugins\mimeTools\mimeTools.dll	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\updater\LICENSE	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\ini.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\stylers.model.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\Zenburn.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\html.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\vhdl.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\lua.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\updater\gup.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\krl.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\nsis.xml	npp.8.6.8.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\sinumerik.xml	npp.8.6.8.Installer.x64.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\npp.8.6.8.Installer.x64.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	npp.8.6.8.Installer.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\*\shell\ANotepad++64	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ANotepad++64\ExplorerCommandHandler = "{B298D29A-A6ED-11DE-BA8C-A68E55D89593}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ANotepad++64\NeverDefault	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ANotepad++64\ = "Notepad++ Context menu"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\ = "notepad++"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\InProcServer32\ = "C:\\Program Files\\Notepad++\\contextMenu\\NppShell.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 123378.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\npp.8.6.8.Installer.x64.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3044	msedge.exe
3044	msedge.exe
1296	msedge.exe
1296	msedge.exe
4556	msedge.exe
4556	msedge.exe
1220	identity_helper.exe
1220	identity_helper.exe
3732	msedge.exe
3732	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2608	npp.8.6.8.Installer.x64.exe
4444	gup.exe
4968	notepad++.exe
2164	notepad++.exe
2164	notepad++.exe
2164	notepad++.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 4648	1296	msedge.exe	81
PID 1296 wrote to memory of 4648	1296	msedge.exe	81
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 4264	1296	msedge.exe	82
PID 1296 wrote to memory of 3044	1296	msedge.exe	83
PID 1296 wrote to memory of 3044	1296	msedge.exe	83
PID 1296 wrote to memory of 396	1296	msedge.exe	84
PID 1296 wrote to memory of 396	1296	msedge.exe	84
PID 1296 wrote to memory of 396	1296	msedge.exe	84
PID 1296 wrote to memory of 396	1296	msedge.exe	84
PID 1296 wrote to memory of 396	1296	msedge.exe	84
PID 1296 wrote to memory of 396	1296	msedge.exe	84
PID 1296 wrote to memory of 396	1296	msedge.exe	84
PID 1296 wrote to memory of 396	1296	msedge.exe	84
PID 1296 wrote to memory of 396	1296	msedge.exe	84
PID 1296 wrote to memory of 396	1296	msedge.exe	84
PID 1296 wrote to memory of 396	1296	msedge.exe	84
PID 1296 wrote to memory of 396	1296	msedge.exe	84
PID 1296 wrote to memory of 396	1296	msedge.exe	84
PID 1296 wrote to memory of 396	1296	msedge.exe	84
PID 1296 wrote to memory of 396	1296	msedge.exe	84
PID 1296 wrote to memory of 396	1296	msedge.exe	84
PID 1296 wrote to memory of 396	1296	msedge.exe	84
PID 1296 wrote to memory of 396	1296	msedge.exe	84
PID 1296 wrote to memory of 396	1296	msedge.exe	84
PID 1296 wrote to memory of 396	1296	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://notepad-plus-plus.org/downloads/v8.6.8/
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb13793cb8,0x7ffb13793cc8,0x7ffb13793cd8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,15994709062788179398,12810194586412523175,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1948,15994709062788179398,12810194586412523175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1948,15994709062788179398,12810194586412523175,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15994709062788179398,12810194586412523175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15994709062788179398,12810194586412523175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15994709062788179398,12810194586412523175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15994709062788179398,12810194586412523175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15994709062788179398,12810194586412523175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15994709062788179398,12810194586412523175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15994709062788179398,12810194586412523175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15994709062788179398,12810194586412523175,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15994709062788179398,12810194586412523175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1948,15994709062788179398,12810194586412523175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1948,15994709062788179398,12810194586412523175,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6716 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15994709062788179398,12810194586412523175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,15994709062788179398,12810194586412523175,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1948,15994709062788179398,12810194586412523175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1948,15994709062788179398,12810194586412523175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3732
- C:\Users\Admin\Downloads\npp.8.6.8.Installer.x64.exe
  "C:\Users\Admin\Downloads\npp.8.6.8.Installer.x64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2608
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\Program Files\Notepad++\contextMenu\NppShell.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4500
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files\Notepad++\contextMenu\NppShell.dll"
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:1764
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Program Files\Notepad++\notepad++.exe"
    3⤵
    PID:884
- - C:\Program Files\Notepad++\notepad++.exe
    "C:\Program Files\Notepad++\notepad++.exe" "C:\Program Files\Notepad++\change.log"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5080

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2820
- C:\Program Files\Notepad++\notepad++.exe
  "C:\Program Files\Notepad++\notepad++.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2164
- - C:\Program Files\Notepad++\updater\gup.exe
    "C:\Program Files\Notepad++\updater\gup.exe" -v8.68 -px64
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:4444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Notepad++\change.log

Filesize
1KB

MD5
4d40de53fd437fcd71324b93e55a592f

SHA1
69bb82c62486c0bddf49a7767869b563d7c47955

SHA256
0d29d7d2e46307e51548d7184d36091fb17c696da8e0d14b873dde07ed19d646

SHA512
1a6159e559bde6137084addf40b958f4d4412e4b3c4efce8012268278bc4fc2360743f4e07574897a95bdebaba0e708a4585ab2ed97f492b100224a87cba0d93

Download Submit
C:\Program Files\Notepad++\contextMenu\NppShell.dll

Filesize
375KB

MD5
f0e9aeb16febf9b93e8b009627233bcd

SHA1
83bcff9f19ce9bbdbf317d0110ef40b1f88f8849

SHA256
13ae3f131636bc11438fabbeeddf0bb2dc2e66fe7747e6add82f95cd5e1cb795

SHA512
5a8a87e5bf50bbb9f7ee9fe395d8b77bdfe1feb86a118dee8a63248b160a8e40de61799276cca9001e220833ace05eeef1bd2997d6ca315573d7a6eb30ea6f42

Download Submit
C:\Program Files\Notepad++\langs.model.xml

Filesize
460KB

MD5
6dc18e98260a6d648c591200f14c9bf6

SHA1
c5d3343d3f91dbfe4db4abfe8ca762104b32b995

SHA256
e3c7749a2caf5ed7d5ad3ee5b6e341d1dcd5cbffe56d2ac9c910ee4bf7e8814e

SHA512
6c0fa09b4712f6aa2397927a7261a7c06fad4d528d8be1aca94bdb065614b83d070e91b484c1133bb9de9180a2f48724d5108c7e43da0aa65917cd7e543b66db

Download Submit
C:\Program Files\Notepad++\notepad++.exe

Filesize
7.1MB

MD5
e64efd5e853763cd9a17c9677f1753c7

SHA1
b4fb61430e6af6f1bd95c26c6123ba077960b079

SHA256
faa189d14b6a2b3a1f584a0fb966dc70045fe98b45e0ba1d67e7ecb87ae3f323

SHA512
574c930e96dc920cb614e4061957e5b4096f715bb436a661bcc2b9e164523fff2c456e64d32ca2b08e9585ae165b2616a228e85cd48fda8fffc7f98f75003670

Download Submit
C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll

Filesize
204KB

MD5
8cfb0c8708ef2d51fa71a3ceafc853a4

SHA1
071402b76b7cbdeb2f4c38f3986e1c413a899e09

SHA256
4f27f40993a7d0e4feec2ad4d171e3f41751b67293fbb62d1b22039a4fe6af7b

SHA512
d91e688ecd5452a1fe27bc1168a587f34b92259be94a90e8ee6a080f72392d177a65f02d7c4291a0f3d3c59a9a03de7d1bd05af359c869c78b0faffb047f4ed5

Download Submit
C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll

Filesize
198KB

MD5
7ed625f8bee3a9fdb809769c76ea9ccd

SHA1
03ec7b995b5d9650f5c68c231d2d1f5bb6be87c5

SHA256
9c6880765e64a7d8bbb9c2a360f3a58679bc20f761eb3a1af284c7877672f081

SHA512
b80ebdbd4950f148964e2e480f3072aeb5178cd4149e9f6042fc9449d7e15fd4071053c397c818449028c0bdc8528fe8dc226d041a49bc53b7bde54260eebe8a

Download Submit
C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll

Filesize
153KB

MD5
ed3c2c518f2cac99450e6c53a45d7b88

SHA1
831bcfe8f6469abc78696e370ed556f09cbca558

SHA256
944712505177c2845c38b4a7c856f9dc9ac9f4463119a5ffc2675f1b090eb0fb

SHA512
2622a48043a10fe5ad200674cb4be8ca6eac1ebe4888c714c30597682c98eae6ebe7cf790642311c4c9d5007581d2865d4a53ccde271158a1d3b5194a9e3b714

Download Submit
C:\Program Files\Notepad++\plugins\mimeTools\mimeTools.dll

Filesize
145KB

MD5
04bffc997203c4ffae747e55387bdc6e

SHA1
111f109fdd448a11cf7738a7705249dd74d091f9

SHA256
3e56aa34b7a25bf89d78f2bb3c35bb9aceea28eb2c8c81260517c9ca71b0d6c8

SHA512
77d293fb617ae1e7c8c945b339fab50dc95e518a3f6cfb291e91be761a734a242fe7ca3cf14bda948176970ce4f4e6531ce95bfcc2f3f3bbb0d3cde7dc728e9d

Download Submit
C:\Program Files\Notepad++\shortcuts.xml

Filesize
3KB

MD5
fb573784b83033dd4361f52006d02cb8

SHA1
0a2923a44ec1bd5e7e8bc7cace15857ae03bf63c

SHA256
37a24662cd55b627807bc2bb7cbba5bbf2abaf6da4dd7bbb949bfaa7903eae9c

SHA512
753b44b5e8bea858cf5cc5ddfdc38098a2f3f921949cf98706ead95bdfa1de7ab0c115e9d69237623a03c422969480204c69d3ba277141527458c68230d0c67c

Download Submit
C:\Program Files\Notepad++\stylers.model.xml

Filesize
190KB

MD5
9ff5fb88c47ac8e7c99f9f340f2d909a

SHA1
5c4abd414ed87fc4f16eb9f9b39c690f3cd1ca22

SHA256
070a560ecd7ab3f787bd7674bdde50aa906e895553f07beb74fd140b193627fb

SHA512
8c1af565b19803ee665147ee7d5dab420f591e2faba8d7f6db95e9e9b911bdf9586fca20851f04152fe4f7c98b354e3e16f84140dcab9aac22e0b2233c4cf4fc

Download Submit
C:\Program Files\Notepad++\updater\gup.exe

Filesize
784KB

MD5
773c362e58e96c892eacb85ca37d6ec9

SHA1
81789add8556450c23485a1fa234fd63450bd04d

SHA256
35de3d372fff37e13962e5f006718db8390f91a85ec40a28255113e3ded701bd

SHA512
967df83f887688ffe456d29b177b2067c827738f746db4fe60dad21581545b70a29438410339e9b0cb5c78ebf2690ea4ecb69d0334e41b52b6a7b7a69facebd0

Download Submit
C:\Program Files\Notepad++\updater\gup.xml

Filesize
4KB

MD5
abde55a0b1cb4a904e622c02f559dcd1

SHA1
1662f8445a000bbf7c61c40e39266658f169bf13

SHA256
92717951aae89e960b142cef3d273f104051896a3d527a78ca4a88c22b5216a5

SHA512
8fe75fb468f87be1153a6a0d70c0583a355f355bfe988027c88d154b500e97f2c5241d9557ebb981067205e2f23ad07b6a49c669cd3e94eaa728201173b235a0

Download Submit
C:\Program Files\Notepad++\updater\libcurl.dll

Filesize
732KB

MD5
243ebd041638ee5e04700350d29c9317

SHA1
87e8263b983157e8b9e81178c8fb7f880b3b9ec7

SHA256
cc07e5c497a04310f8cbfc89a77c04973f8ed1176c0c4ac035146d4455dcd834

SHA512
7c246ba4aabc7bacc26689865e74e2f833feb52b4392afd46c5371c16908e3483f5ffd981d8920ab9432c98a87bafac0b1e8de73602c1f71c452b2fbd8a60203

Download Submit
C:\Program Files\Notepad++\updater\updater.ico

Filesize
130KB

MD5
4550bd860351f6a78c739db8a37384dc

SHA1
b09e179b906d8477beee211724921e05d0126b41

SHA256
fb40c912b218a71bd7bc1aeef5530165df60d0b4f896929f989b8ff37a98d459

SHA512
29729d0244192370d6fb6d8b7243e4610cbdcea52ff69805b16f019b9e0b570ea71a0f1773bcc0b13ba39252cb201f2a12b473c2c1fe17b16f475261b723e032

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
302c3de891ef3a75b81a269db4e1cf22

SHA1
5401eb5166da78256771e8e0281ca2d1f471c76f

SHA256
1d1640e5755779c90676290853d2e3ca948f57cf5fb1df4b786e277a97757f58

SHA512
da18e7d40376fd13255f3f67a004c3a7f408466bd7ce92e36a4d0c20441279fe4b1b6e0874ab74c494663fb97bd7992b5e7c264b3fc434c1e981326595263d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9efc5ba989271670c86d3d3dd581b39

SHA1
3ad714bcf6bac85e368b8ba379540698d038084f

SHA256
c2e16990b0f6f23efdcecd99044993a4c2b8ba87bd542dd8f6256d69e24b93b3

SHA512
c1bc0dc70ab827b54feb64ad069d21e1c3c28d57d126b08314a9670437881d77dba02b5cca57ef0f2aa7f8e7d4d163fbd2c6f246ea2d51ce201d61a89015e8b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
64KB

MD5
c86e1b32988ffbc37474c5ea5457a62e

SHA1
3b337c4d43ff0b4ff79f9bbcecff8143839c6cfe

SHA256
d94398ba2ed0b438809ec4203c64c002b4a0d960fbd34ab144b78fe7a49323fd

SHA512
58ac67c26bca36a29799d49ed95980a15b1e279282e425ce13620cbe93a8cff74e1c520b896f8e9545a6b7eb8266394547949d88ad96bcf2a879da65521e7f16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
20KB

MD5
ddecb50cf7f3cf6e0ebe9b3374ea2f6c

SHA1
dba013bcbc2aaadd3089cfcf720c42348a48817d

SHA256
9cea35a9fbde3b0328bc0e72f696919f707112dc8a15c3032becce86c48153c6

SHA512
38ca3a3421504ed4d5a6a9488fc2d686d99c0755970b713742ed2b24d8d0c3c971580d16669f187f1d3db428f2804ba8a463dd3c6ddca7cf6128cc97c9082648

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
20KB

MD5
0ffcdaa090cfd24e0a0bebf18b1ad24e

SHA1
36cf71bc3c1ed0a14cf786f4d9651c99b5773b33

SHA256
83fdad55618422cb653414d5649ae4021aceeda78d8f27a99457d5c8e2e329b0

SHA512
0dc3c1e57cf5e1f07c98369bf5c73c1e91a049c032c3421e82cc676657d2e200e489876f3a075ae1dffec930596cd8f96469712ca56ce4cf94433e5f045597bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
356e563d83140c82c8855923e1a718bf

SHA1
1ac4eb7f931f657261be3e99b777bc281e6db930

SHA256
d8109e731597888a157736ffc43d2385edb1541b0226ac0f84517291740d0d39

SHA512
2aec5e4eaa20448d5a8ec987d229b11acd8c211227835973d0c37badfd87e300ab29c46622976927b49365e0a45749c7e452baecf7889a10c2105764abceedca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bd52a714ee88198811b9e25f4aba73b7

SHA1
907ad65c24d791452b7e53c9eec66ea364538521

SHA256
cd2da058c830876938bcc8dbf152c856d5c0d02dedf3af752caf293df07d93bb

SHA512
2e85e19948f4bfad7972abccc9633be49e78e5338fed530a3c3fde2b3189f1011e0e23d815b70bc9cf1eef4bbdae1573a6781c13d865b7cb68d524877eea25e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
eea9b47d44eed2da991faa78d6c676e0

SHA1
62154b6dc20156e3604843ff4054be30836b7fad

SHA256
2c837c9b3fd4776588b9c4a1d81a93165c3a609d7cd1ad3704c281a67192cf18

SHA512
204242eb7301dc7523565996df5bc0e46c397d779397737d30226698899759e3e79906c102f717341b0cb11d404e3b6cd4e537a179ae1c190ebcde6374b5ab4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
afa44d30ed330086ae41685fc07abfde

SHA1
d979ec15592968c7be5f28143571baa605d76546

SHA256
9d44c66de7325df4dc3e0230f7e17db763b3598147d7da7c7d6bb01be4f57e49

SHA512
e57e4f6013e5b16f4982dae3f21efe7a97ab50030d96edbaaa21ab6e91a1047a4e4556357d480db40f7fd9733153e9d36d53f66fb7cf48e871dbd54d56ab77c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
199b5b5159b4a1a8264a99cd82af13e6

SHA1
68e9ac2e0891a6ef27514a4e21da6adb3c2b5eb5

SHA256
ead33476bee2a3f8de996b871ac17b81c10e7c9a1aed8db57ecba67a12dcbeea

SHA512
972e831b41892fa978e33aa293b81d1650c8a3e82af06f9f3d09ad6bd0eec088816325c07e2d20000cacf9082c989e6ebc011bf7da2a86f985ce1f5650cd10b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl147F.tmp\InstallOptions.dll

Filesize
15KB

MD5
d095b082b7c5ba4665d40d9c5042af6d

SHA1
2220277304af105ca6c56219f56f04e894b28d27

SHA256
b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c

SHA512
61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl147F.tmp\LangDLL.dll

Filesize
5KB

MD5
50016010fb0d8db2bc4cd258ceb43be5

SHA1
44ba95ee12e69da72478cf358c93533a9c7a01dc

SHA256
32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

SHA512
ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl147F.tmp\System.dll

Filesize
12KB

MD5
4add245d4ba34b04f213409bfe504c07

SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl147F.tmp\UserInfo.dll

Filesize
4KB

MD5
d458b8251443536e4a334147e0170e95

SHA1
ba8d4d580f1bc0bb2eaa8b9b02ee9e91b8b50fc3

SHA256
4913d4cccf84cd0534069107cff3e8e2f427160cad841547db9019310ac86cc7

SHA512
6ff523a74c3670b8b5cd92f62dcc6ea50b65a5d0d6e67ee1079bdb8a623b27dd10b9036a41aa8ec928200c85323c1a1f3b5c0948b59c0671de183617b65a96b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl147F.tmp\ioSpecial.ini

Filesize
1KB

MD5
dc6bddb394a361e651aee362280f5789

SHA1
c592d92588ab8826989035ff4bc388013efc22ee

SHA256
61290a7cb7be06315c11020bf8282c7959cdd5754b04447a7808e321bc3d2b0b

SHA512
23bf97b84c22f6ca53c30c2d369ceb3c3a187c2c7100bbbc22f7b08db2b71d707f8bef7ce2cc69ddf0d113b1d2f6ccd20dd453b96be97cc79fc33e83e11423b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl147F.tmp\ioSpecial.ini

Filesize
1KB

MD5
0f0aee6f047bf3eb98f12a3644388068

SHA1
428a2b5f47335d322dc36a40c7cd560cb81740de

SHA256
b08a6cfcd63687e1754d679ceec68b2aea48b5f81fd3d5a7105294523d56bca6

SHA512
574db18c26da85ad68cd947c1fe20fda2ddf07312994112f4ea65675183f605d010396129c906fd85cae1120f456f84270d761c6a21b0eff7fab30fa8e720295

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl147F.tmp\ioSpecial.ini

Filesize
1KB

MD5
e24c58623dbb3b439f0abfff57eb43f2

SHA1
127defce95c444a38db3f5440a41762e1feef6a8

SHA256
7a5110bf6db4211bb52514ed347c2f7fdf4fa963c316b8c1783a23515e69d28c

SHA512
6b3b12005106b36aa6423c91ec8eed0b1215d07d98ae6174afabd2a1f1e13ef093dda8364b9420dc1910e662235d5e60d47223345ca8c4dd093d335a94d6e4ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl147F.tmp\ioSpecial.ini

Filesize
1KB

MD5
5439533d43d789051b88972a86f82b0f

SHA1
78a16f223b7955f5629076955bc5bacccc186139

SHA256
4d7a643dabd6167f01e5c8d73ffcd2ffb2a3f23826d0e5401b9f740a58e9dbe8

SHA512
cda3bb6833975f6a3cc42f3497be60265f0dd0db7280e1c27c5a4162c8fe7870881bd521c414edfe905958519d200b9b319188d223adcf8c4fdf076186cc586b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl147F.tmp\nsDialogs.dll

Filesize
9KB

MD5
1d8f01a83ddd259bc339902c1d33c8f1

SHA1
9f7806af462c94c39e2ec6cc9c7ad05c44eba04e

SHA256
4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed

SHA512
28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

Download Submit
C:\Users\Admin\AppData\Roaming\Notepad++\contextMenu.xml

Filesize
4KB

MD5
fde4cc09d1c18c6cd7c1a4878e89d27e

SHA1
22fba21b254fed1a60da5de2b8af3cf6e132b647

SHA256
43ac0b7ba9b1f91fd8d4841b8119344e6212b307a1decccf61658f31d38bb425

SHA512
fcc87b93cb4dd0949e82edb7d2788d7abd317f9f4c5f046ceba1cd85a64b12b29c6baba3e8646265db02a48a2dc20c3b5e893a1334d9b1e91d26692b4e9c2d29

Download Submit
C:\Users\Admin\AppData\Roaming\Notepad++\plugins\config\converter.ini

Filesize
646B

MD5
f07150054a6afff4d8e9d58899167722

SHA1
e092cd960ab728667d91b37d64a02d7f6821518b

SHA256
5b0a08439e8e93817772f84e1098f14152d9da36c2601a0600ddaae6f61359d0

SHA512
8c86aa4c058a8ab5fd26f21cacc8ddaffa8ce6012bb329d3c5b817da00b4b43018a575c768d1921c6eeab7537f172c7cb3de658b014365ea52fb3c87547182b9

Download Submit
C:\Users\Admin\AppData\Roaming\Notepad++\toolbarIcons.xml

Filesize
2KB

MD5
bc4b775a277672fc7edf956120576ecb

SHA1
fe7c2db5b4d4c5a3f5603cf56c4d71cc9ee2d71d

SHA256
4ec98de37193f41242c1a47507bcc4c1af555e71154f7354272bc3e664e19877

SHA512
f87dc3ce52831ee308fbfa2b1b94c07e2811e7028360f046e012f8ea5a8f0ebcd362de7a663dee810c3da0791474c1485b1a2626c7867e76236156b125ff39b2

Download Submit
C:\Users\Admin\AppData\Roaming\Notepad++\userDefineLangs\markdown._preinstalled.udl.xml

Filesize
6KB

MD5
672e6d5f89887666ec94711e442644e0

SHA1
8d069ae93347316eff0dcf7aff4d22da18a62af2

SHA256
b34fe6811dacfe49d77d434123867e866daf6e0e27387a0446887dabe8943f04

SHA512
8fc5e9bbe027826304fa6f329fb16e4c9e4e7a597d87e9c691ed6a9f505b7bc1967339b43c6426105432a030260b0654468ab8fcbb4312b2fb6ed6c6aa537edc

Download Submit
C:\Users\Admin\AppData\Roaming\Notepad++\userDefineLangs\markdown._preinstalled_DM.udl.xml

Filesize
6KB

MD5
3690cef1865e32fe6be1b2ec7656539a

SHA1
bc043bec63c310a60d9e242810036460c467945d

SHA256
e45e49f0895249d951df2c07e0f06ca1242e05c961dd921e5aa2781ae2e7ff25

SHA512
c2be869d96baec2018e13dcf5934dd9cf74146541e852cc2eedb4d83a8af23e2577cde7a0158fefaa11056416ff039df3a7725e320620193e9bfe72c8067c051

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 123378.crdownload

Filesize
4.8MB

MD5
610cc0eab1102a9f619d32107f2dc874

SHA1
68f91f1b62d6127076eb0e70a78d8c3101b33ef5

SHA256
d9fd6944595083644a4711f0b18611d4547f0c75c89c944bb9de196d74375008

SHA512
5d884997e80b733792be860f1936ab9413203b50991cf9b34ad4cd6f630e274c0b99514ed543a4ca9ce6bb40a77e2db3aaea46f324f38b1945f888d22a1db5db

Download Submit
C:\Users\Admin\Downloads\npp.8.6.8.Installer.x64.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit