Overview

overview

8

Static

static

3

npp.8.9.8....64.exe

windows10-2004-x64

5

npp.8.9.8....64.exe

windows11-ltsc_2024-x64

6

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

8

$PLUGINSDI...al.ini

windows10-2004-x64

1

$PLUGINSDI...al.ini

windows11-ltsc_2024-x64

1

$PLUGINSDI...er.bmp

windows10-2004-x64

1

$PLUGINSDI...er.bmp

windows11-ltsc_2024-x64

1

$PLUGINSDI...rd.bmp

windows10-2004-x64

1

$PLUGINSDI...rd.bmp

windows11-ltsc_2024-x64

8

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    60s
  • max time network
    56s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/09/2026, 11:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    npp.8.9.8.Installer.x64.exe
  • Size 6.6MB
  • Sample260908-m849jayflb
  • SHA256 7b2a949bf460fb37a3888c9048698f43222a185a48323023df1c51e78a3ca1c2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
defense_evasiondiscoverypersistenceprivilege_escalationspywaretrojan

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 10 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\npp.8.9.8.Installer.x64.exe
    "C:\Users\Admin\AppData\Local\Temp\npp.8.9.8.Installer.x64.exe"
    1⤵
    • Drops file in Program Files directory
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" "C:\Program Files\Notepad++\notepad++.exe"
      2⤵
        PID:4996
      • C:\Program Files\Notepad++\notepad++.exe
        "C:\Program Files\Notepad++\notepad++.exe" "C:\Program Files\Notepad++\change.log"
        2⤵
        • Executes dropped EXE
        PID:1428
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2212
      • C:\Program Files\Notepad++\notepad++.exe
        "C:\Program Files\Notepad++\notepad++.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies registry class
        • Modifies system certificate store
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:1288
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4616

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            change.log
            • Path C:\Program Files\Notepad++\change.log
            • Size 2KB
            • SHA256 e9fb82db6721a63ef56cc7c60e7d41d9b2e3ce077c501c29d3730f5e51156597
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            langs.model.xml
            • Path C:\Program Files\Notepad++\langs.model.xml
            • Size 533KB
            • SHA256 6aaa58dfc6836f77587a0d8345d4e924847e734e29df4a271538cced9d6a58aa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            notepad++.exe
            • Path C:\Program Files\Notepad++\notepad++.exe
            • Size 8.1MB
            • SHA256 c5c20737cab116cb5f40a124cbe48eee03e1cc83fc3cda13dfcc0bfad3aa796c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nppPluginList.dll
            • Path C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll
            • Size 229KB
            • SHA256 dbd79981d441b65d25f5b21fa29c9093734afe99960e1f1e9e2fed3239c543a5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            NppConverter.dll
            • Path C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll
            • Size 203KB
            • SHA256 66673ce2a6bf711d01b3c2efbcd3d727a2d6db4dd5ccb916927a2df751ed1608
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            NppExport.dll
            • Path C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll
            • Size 155KB
            • SHA256 d51167f7c1144e0b9313b16d649de4f3af49c01041f5edae15df40bffd0e79a5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mimeTools.dll
            • Path C:\Program Files\Notepad++\plugins\mimeTools\mimeTools.dll
            • Size 146KB
            • SHA256 cf2420faf91d8252dffc0538927031d6f99db2cb766fd439f87bb8546be69750
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            stylers.model.xml
            • Path C:\Program Files\Notepad++\stylers.model.xml
            • Size 249KB
            • SHA256 7260cba0dd635201e9ab5b89ef15e22f2d86132e7367fb9660ad83ff2c5a5809
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            gup.exe
            • Path C:\Program Files\Notepad++\updater\gup.exe
            • Size 1.3MB
            • SHA256 50155027edb4c0e4abcd4c8265b6cb0f55c09b2ceb80b917264b218cc06b1390
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            InstallOptions.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsy126.tmp\InstallOptions.dll
            • Size 15KB
            • SHA256 dd0d1a8c4511261333e90a94d9912000592c46731b615aa7a37cd2b3eb6a8d58
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LangDLL.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsy126.tmp\LangDLL.dll
            • Size 5KB
            • SHA256 760df89c2341f9c39c0250c283cb9caad185244fd6b76e8157cdf49928dc1d8e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsy126.tmp\System.dll
            • Size 12KB
            • SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UserInfo.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsy126.tmp\UserInfo.dll
            • Size 4KB
            • SHA256 0893c4d31c7d9c2106eea64f10d6b17a00b742727662a883c39990bcee6a7d15
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ioSpecial.ini
            • Path C:\Users\Admin\AppData\Local\Temp\nsy126.tmp\ioSpecial.ini
            • Size 1KB
            • SHA256 0cabd2c97e86f83077e08bcff706a4d4cbbf64c647cd9f103f1daae0cbe5a15a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ioSpecial.ini
            • Path C:\Users\Admin\AppData\Local\Temp\nsy126.tmp\ioSpecial.ini
            • Size 1KB
            • SHA256 4f18545d4008d572f5c924d59dd09653b44cc88a621949e7fd8c87b71ed983d6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ioSpecial.ini
            • Path C:\Users\Admin\AppData\Local\Temp\nsy126.tmp\ioSpecial.ini
            • Size 1KB
            • SHA256 7a2ffb354a9e7e9d473ee4390c51c78754bb9263d49b1727a5c970fcb54a7a5d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            nsDialogs.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsy126.tmp\nsDialogs.dll
            • Size 9KB
            • SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            contextMenu.xml
            • Path C:\Users\Admin\AppData\Roaming\Notepad++\contextMenu.xml
            • Size 4KB
            • SHA256 cee7492b0f600d952da489f4b097896c47217959e1597f2529d5004fe1eb08aa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            langs.xml
            • Path C:\Users\Admin\AppData\Roaming\Notepad++\langs.xml
            • Size 532KB
            • SHA256 606260cf757bb875f68953b16d85511aee58eeaa189634bb7205b5e99ec7c0bb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            converter.ini
            • Path C:\Users\Admin\AppData\Roaming\Notepad++\plugins\config\converter.ini
            • Size 646B
            • SHA256 5b0a08439e8e93817772f84e1098f14152d9da36c2601a0600ddaae6f61359d0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            shortcuts.xml
            • Path C:\Users\Admin\AppData\Roaming\Notepad++\shortcuts.xml
            • Size 2KB
            • SHA256 4e7bc3a7a30fe8e84c17d23e9741fadfe1071d77bf44d07df92fee387d78e93b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            stylers.xml
            • Path C:\Users\Admin\AppData\Roaming\Notepad++\stylers.xml
            • Size 249KB
            • SHA256 3d4536b1c5e0dbd726bc59e41b4b6d1dad229f4f4d2bea6ac72b136260712642
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            markdown._preinstalled.udl.xml
            • Path C:\Users\Admin\AppData\Roaming\Notepad++\userDefineLangs\markdown._preinstalled.udl.xml
            • Size 6KB
            • SHA256 d686a666d17b38fe523ce0f477cf8f6468b1cd341f80c8e2cc06a70b617c959b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            markdown._preinstalled_DM.udl.xml
            • Path C:\Users\Admin\AppData\Roaming\Notepad++\userDefineLangs\markdown._preinstalled_DM.udl.xml
            • Size 6KB
            • SHA256 49857fab550093b68419e1a7df3bdeb103477c038effbc5782350c28124aaeed
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download