Windows Analysis Report
npp.8.6.7.Installer.x64.exe

Overview

General Information

Sample name: npp.8.6.7.Installer.x64.exe
Analysis ID: 1531792
MD5: d401161afb56b8647202e031cec1ae78
SHA1: 6eb7ed61ccdb0bd5018271a3ec24b63b913fc281
SHA256: 81470eb5917705fa0df03181b8112422671842bdcec5252a7894975b38058c91
Infos:

Detection

Score: 26
Range: 0 - 100
Whitelisted: false
Confidence: 20%

Compliance

Score: 37
Range: 0 - 100

Signatures

Malicious sample detected (through community Yara rule)
Found API chain indicative of debugger detection
Checks if the current process is being debugged
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to create an SMB header
Contains functionality to dynamically determine API calls
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
EXE planting / hijacking vulnerabilities found
Found decision node followed by non-executed suspicious APIs
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Registers a DLL
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Explorer Process Tree Break
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004E9AD0 BCryptGenRandom, 10_2_00007FFE004E9AD0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004E9CA0 BCryptGenRandom, 10_2_00007FFE004E9CA0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE00507D76 CertOpenStore,GetLastError,CryptStringToBinaryA,CertFindCertificateInStore,CertFreeCertificateContext,CertCloseStore,_fread_nolock,MultiByteToWideChar,PFXImportCertStore,GetLastError,CertFindCertificateInStore,GetLastError,CertCloseStore,CertFreeCertificateContext, 10_2_00007FFE00507D76
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE0050A140 CertGetNameStringA,CertFindExtension,CryptDecodeObjectEx,CertFreeCertificateContext, 10_2_00007FFE0050A140
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004DC2E0 CryptAcquireContextA,CryptCreateHash,CryptReleaseContext,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext, 10_2_00007FFE004DC2E0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004DC410 CryptAcquireContextA,CryptCreateHash,CryptReleaseContext, 10_2_00007FFE004DC410
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004DC490 CryptHashData, 10_2_00007FFE004DC490
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004DC4A0 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext, 10_2_00007FFE004DC4A0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE0050A560 CryptQueryObject,CertAddCertificateContextToStore,CertFreeCertificateContext,GetLastError,GetLastError, 10_2_00007FFE0050A560
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE0050AA80 CertGetNameStringA,CertFindExtension,CryptDecodeObjectEx, 10_2_00007FFE0050AA80
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004EECD0 CryptAcquireContextA,CryptCreateHash,CryptReleaseContext, 10_2_00007FFE004EECD0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004EED50 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext, 10_2_00007FFE004EED50
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004EEDE0 CryptAcquireContextA,CryptCreateHash,CryptReleaseContext,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext, 10_2_00007FFE004EEDE0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004BF3B0 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext, 10_2_00007FFE004BF3B0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE00507B10 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext, 10_2_00007FFE00507B10
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_f17e4f4d-7
Contains functionality to create an SMB header
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: mov dword ptr [rbp+04h], 424D53FFh 10_2_00007FFE004F0430
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe EXE: regsvr32.exe Jump to behavior

Compliance
barindex
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe EXE: regsvr32.exe Jump to behavior
Uses 32bit PE files
Source: npp.8.6.7.Installer.x64.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Window detected: < &BackI &AgreeCancelThe best things in life are free. Notepad++ is free so Notepad++ is the best The best things in life are free. Notepad++ is free so Notepad++ is the bestLicense AgreementPlease review the license terms before installing Notepad++ v8.6.7.Press Page Down to see the rest of the agreement.COPYING -- Describes the terms under which Notepad++ is distributed.A copy of the GNU GPL is appended to this file.IMPORTANT NOTEPAD++ LICENSE TERMSCopyright (C)2021 Don HO <don.h@free.fr>. This program is free software; you may redistribute and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; Version 3 with the clarifications and exceptions described below. This guarantees your right to use modify and redistribute this software under certain conditions.This program is distributed in the hope that it will be useful but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.******************************************************************GNU GENERAL PUBLIC LICENSEVersion 3 29 June 2007Copyright (C) 2007 Free Software Foundation Inc. <https://fsf.org/>Everyone is permitted to copy and distribute verbatim copies of this license document but changing it is not allowed.PreambleThe GNU General Public License is a free copyleft license for software and other kinds of works.The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast the GNU General Public License is intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users. We the Free Software Foundation use the GNU General Public License for most of our software; it applies also to any other work released this way by its authors. You can apply it to your programs too.When we speak of free software we are referring to freedom not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish) that you receive source code or can get it if you want it that you can change the software or use pieces of it in new free programs and that you know you can do these things.To protect your rights we need to prevent others from denying you these rights or asking you to surrender the rights. Therefore you have certain responsibilities if you distribute copies of the software or if you modify it: responsibilities to respect the freedom of others.For example if you distribute copies of such a program whether gratis or for a fee you must pass on to the recipients the same freedoms that you received. You must make sure that they too receive or can get the source code. And you must show them these terms so they know their rights.Developers that use the GNU GPL protect your rights with two steps: (1) as
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Window detected: < &BackI &AgreeCancelThe best things in life are free. Notepad++ is free so Notepad++ is the best The best things in life are free. Notepad++ is free so Notepad++ is the bestLicense AgreementPlease review the license terms before installing Notepad++ v8.7.Press Page Down to see the rest of the agreement.COPYING -- Describes the terms under which Notepad++ is distributed.A copy of the GNU GPL is appended to this file.IMPORTANT NOTEPAD++ LICENSE TERMSCopyright (C)2021 Don HO <don.h@free.fr>. This program is free software; you may redistribute and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; Version 3 with the clarifications and exceptions described below. This guarantees your right to use modify and redistribute this software under certain conditions.This program is distributed in the hope that it will be useful but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.******************************************************************GNU GENERAL PUBLIC LICENSEVersion 3 29 June 2007Copyright (C) 2007 Free Software Foundation Inc. <https://fsf.org/>Everyone is permitted to copy and distribute verbatim copies of this license document but changing it is not allowed.PreambleThe GNU General Public License is a free copyleft license for software and other kinds of works.The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast the GNU General Public License is intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users. We the Free Software Foundation use the GNU General Public License for most of our software; it applies also to any other work released this way by its authors. You can apply it to your programs too.When we speak of free software we are referring to freedom not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish) that you receive source code or can get it if you want it that you can change the software or use pieces of it in new free programs and that you know you can do these things.To protect your rights we need to prevent others from denying you these rights or asking you to surrender the rights. Therefore you have certain responsibilities if you distribute copies of the software or if you modify it: responsibilities to respect the freedom of others.For example if you distribute copies of such a program whether gratis or for a fee you must pass on to the recipients the same freedoms that you received. You must make sure that they too receive or can get the source code. And you must show them these terms so they know their rights.Developers that use the GNU GPL protect your rights with two steps: (1) asse
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++ Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\c.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\cpp.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\java.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\cs.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\html.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\rc.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\sql.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\php.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\css.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\vb.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\perl.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\javascript.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\python.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\actionscript.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\lisp.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\vhdl.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\tex.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\xml.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\nsis.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\cmake.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\batch.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\coffee.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\BaanC.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\lua.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\autoit.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\cobol.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\typescript.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\powershell.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\gdscript.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\go.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\raku.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\c.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\cpp.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\java.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\cs.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\asm.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\bash.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\sql.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\php.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\cobol-free.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\cobol.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\perl.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\javascript.js.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\python.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\lua.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\ini.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\inno.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\vhdl.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\krl.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\nsis.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\powershell.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\batch.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\ruby.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\baanc.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\sinumerik.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\autoit.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\universe_basic.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\xml.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\ada.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\fortran.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\fortran77.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\haskell.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\rust.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\typescript.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\pascal.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\gdscript.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\raku.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\hollywood.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\nppexec.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\overrideMap.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\plugins Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\plugins\NppExport Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\plugins\mimeTools Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\plugins\mimeTools\mimeTools.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\plugins\NppConverter Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\updater Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\updater\GUP.exe Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\updater\libcurl.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\updater\gup.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\updater\LICENSE Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\updater\README.md Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\updater\updater.ico Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\plugins\Config Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\langs.model.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\stylers.model.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\contextMenu.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\shortcuts.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\nppLogNulContentCorruptionIssue.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\LICENSE Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\change.log Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\readme.txt Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\notepad++.exe Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\localization Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\localization\english.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\plugins\disabled Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\DarkModeDefault.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Black board.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Choco.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Hello Kitty.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Mono Industrial.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Monokai.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Obsidian.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Plastic Code Wrap.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Ruby Blue.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Twilight.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Vibrant Ink.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Deep Black.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\vim Dark Blue.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Bespin.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Zenburn.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Solarized.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Solarized-light.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\HotFudgeSundae.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\khaki.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\MossyLawn.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Navajo.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\DansLeRuSH-Dark.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\contextMenu Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\contextMenu\NppShell.msix Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\contextMenu\NppShell.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\uninstall.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\toml.xml
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\tex.xml
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\latex.xml
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\plugins\mimeTools\mimeTools.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\contextMenu\NppShell.dll
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Notepad++ Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe File created: C:\Program Files\Notepad++\readme.txt Jump to behavior
Source: npp.8.6.7.Installer.x64.exe Static PE information: certificate valid
Source: unknown HTTPS traffic detected: 84.32.84.219:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: npp.8.6.7.Installer.x64.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\sources\nppShell\x64\Release\NppShell.x64.pdb3 source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\sources\nppShell\x64\Release\NppShell.x64.pdb source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\sources\nppPluginList\bin64\nppPluginList.pdb source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Code function: 0_2_00402910 FindFirstFileW, 0_2_00402910
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Code function: 0_2_004069DF FindFirstFileW,FindClose, 0_2_004069DF
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Code function: 0_2_00405D8E CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00405D8E
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE0052DE00 FindFirstFileExW, 10_2_00007FFE0052DE00
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Code function: 14_2_00402910 FindFirstFileW, 14_2_00402910
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Code function: 14_2_004069DF FindFirstFileW,FindClose, 14_2_004069DF
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Code function: 14_2_00405D8E CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 14_2_00405D8E
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Code function: 17_2_00402910 FindFirstFileW, 17_2_00402910
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Code function: 17_2_004069DF FindFirstFileW,FindClose, 17_2_004069DF
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Code function: 17_2_00405D8E CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 17_2_00405D8E
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB455D4 FindFirstFileExW, 28_2_00007FFE0EB455D4
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE1150D270 FindFirstFileExW, 28_2_00007FFE1150D270
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE1A51D184 FindFirstFileExW, 28_2_00007FFE1A51D184
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 140.82.121.3 140.82.121.3
Source: Joe Sandbox View IP Address: 140.82.121.3 140.82.121.3
Source: Joe Sandbox View IP Address: 185.199.110.133 185.199.110.133
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004F25E0 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,WSAGetLastError,closesocket,closesocket,closesocket,closesocket, 10_2_00007FFE004F25E0
Source: global traffic HTTP traffic detected: GET /update/getDownloadUrl.php?version=8.67&param=x64 HTTP/1.1Host: notepad-plus-plus.orgUser-Agent: Notepad++/8.67 (WinGup/5.28)Accept: */*
Source: global traffic HTTP traffic detected: GET /notepad-plus-plus/notepad-plus-plus/releases/download/v8.7/npp.8.7.Installer.x64.exe HTTP/1.1Host: github.comUser-Agent: Notepad++/8.67 (WinGup/5.28)Accept: */*
Source: global traffic HTTP traffic detected: GET /github-production-release-asset-2e65be/33014811/abe46154-dbaa-4461-8680-a6be44a2f318?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20241011%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241011T183437Z&X-Amz-Expires=300&X-Amz-Signature=704e82536a38d3f76c1102d79c63a642f129936dda0fb3e51643ea485003fc9c&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Dnpp.8.7.Installer.x64.exe&response-content-type=application%2Foctet-stream HTTP/1.1Host: objects.githubusercontent.comUser-Agent: Notepad++/8.67 (WinGup/5.28)Accept: */*
Source: notepad++.exe, 0000001C.00000000.2476917701.00007FF6E5C4B000.00000002.00000001.01000000.0000000E.sdmp, notepad++.exe, 0000001C.00000002.2971138093.00007FF6E5C4B000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: ----------------------------------------------------------/select,explorerSelect a folder to add in Folder as Workspace panelSelectFolderFromBrowserStringhttp://FilePathNotFoundWarningThe file you're trying to open doesn't exist.File Openhttps://search.yahoo.com/search?q=$(CURRENT_WORD)https://duckduckgo.com/?q=$(CURRENT_WORD)https://www.google.com/search?q=$(CURRENT_WORD)https://Sorting ErrorRich Text FormatHTML Formathttps://stackoverflow.com/search?q=$(CURRENT_WORD)Find: Found the 1st occurrence from the bottom. The beginning of the document has been reached.Find: Found the 1st occurrence from the top. The end of the document has been reached.SortingErrorUnable to perform numeric sorting due to line $INT_REPLACE$.firefox.exeColumnModeTipThere are 3 ways to switch to column-select mode: equals www.yahoo.com (Yahoo)
Source: notepad++.exe, 00000009.00000000.2016361940.00007FF6E9C96000.00000002.00000001.01000000.0000000E.sdmp, notepad++.exe, 00000009.00000002.2319288862.00007FF6E9C96000.00000002.00000001.01000000.0000000E.sdmp, notepad++.exe, 0000000B.00000000.2022748994.00007FF6E9C96000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: ----------------------------------------------------------An attempt was made to execute the below command.explorerSelect a folder to add in Folder as Workspace panelSelectFolderFromBrowserStringShellExecute - ERRORFilePathNotFoundWarningThe file you're trying to open doesn't exist.File Open/select,https://duckduckgo.com/?q=$(CURRENT_WORD)https://www.google.com/search?q=$(CURRENT_WORD)https://http://Rich Text FormatHTML Formathttps://stackoverflow.com/search?q=$(CURRENT_WORD)https://search.yahoo.com/search?q=$(CURRENT_WORD)Column Mode TipSortingErrorUnable to perform numeric sorting due to line $INT_REPLACE$.Sorting Errorchrome.exefirefox.exeColumnModeTipThere are 3 ways to switch to column-select mode: equals www.yahoo.com (Yahoo)
Source: global traffic DNS traffic detected: DNS query: notepad-plus-plus.org
Source: global traffic DNS traffic detected: DNS query: github.com
Source: global traffic DNS traffic detected: DNS query: objects.githubusercontent.com
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://alternateidea.com/blog/articles/2006/01/03/textmate-vibrant-ink-theme-and-prototype-bundle)
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://architectshack.com/PoorMansTSqlFormatter.ashx
Source: notepad++.exe, 00000009.00000003.2182501875.000001ACC3A47000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A48000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315795906.000001ACC3A49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/Digi
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2033340080.000000000040A000.00000004.00000001.01000000.00000003.sdmp, npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2174166347.000001ACC39C9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181972948.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A47000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190677875.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2173640520.000001ACC39C9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2027958592.000001ACC3C3F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317540774.000001ACC3C6B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315544527.000001ACC39C9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A48000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315795906.000001ACC3A49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A45000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2313157437.000001ACC3C68000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128239982.0000024DE5DFF000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128198327.0000024DE5E30000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128056315.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2127970528.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2497295510.000000000040A000.00000004.00000001.01000000.00000019.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2033340080.000000000040A000.00000004.00000001.01000000.00000003.sdmp, npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181972948.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182879569.000001ACC3B49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190677875.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2027958592.000001ACC3C3F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317540774.000001ACC3C6B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2314805121.000001ACC3722000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316508533.000001ACC3B4B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2313157437.000001ACC3C68000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128239982.0000024DE5DFF000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128198327.0000024DE5E30000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128056315.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2127970528.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2497295510.000000000040A000.00000004.00000001.01000000.00000019.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481628764.0000027384725000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738473E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384651000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2033340080.000000000040A000.00000004.00000001.01000000.00000003.sdmp, npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181972948.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A47000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190677875.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2027958592.000001ACC3C3F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317540774.000001ACC3C6B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A48000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315795906.000001ACC3A49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A45000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2313157437.000001ACC3C68000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128239982.0000024DE5DFF000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128056315.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2127970528.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2497295510.000000000040A000.00000004.00000001.01000000.00000019.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481628764.0000027384725000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738473E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2033340080.000000000040A000.00000004.00000001.01000000.00000003.sdmp, npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181972948.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190677875.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2027958592.000001ACC3C3F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317540774.000001ACC3C6B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2313157437.000001ACC3C68000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128239982.0000024DE5DFF000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128056315.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2127970528.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2130187479.0000024DE5E02000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2497295510.000000000040A000.00000004.00000001.01000000.00000019.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481628764.0000027384725000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738473E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2963626685.0000027384302000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://creativecommons.org/licenses/by/3.0/
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCert
Source: notepad++.exe, 00000009.00000003.2182501875.000001ACC3A47000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A48000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315795906.000001ACC3A49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredID
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2033340080.000000000040A000.00000004.00000001.01000000.00000003.sdmp, npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2174166347.000001ACC39C9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181972948.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190677875.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2173640520.000001ACC39C9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2027958592.000001ACC3C3F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317540774.000001ACC3C6B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315544527.000001ACC39C9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2313157437.000001ACC3C68000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128239982.0000024DE5DFF000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128198327.0000024DE5E30000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128056315.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2127970528.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2497295510.000000000040A000.00000004.00000001.01000000.00000019.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481628764.0000027384725000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738473E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: notepad++.exe, 00000009.00000003.2182501875.000001ACC3A47000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A48000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315795906.000001ACC3A49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A45000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertT
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2033340080.000000000040A000.00000004.00000001.01000000.00000003.sdmp, npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181972948.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182879569.000001ACC3B49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190677875.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2027958592.000001ACC3C3F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317540774.000001ACC3C6B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2314805121.000001ACC3722000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316508533.000001ACC3B4B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2313157437.000001ACC3C68000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128198327.0000024DE5E30000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128056315.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2127970528.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128274148.0000024DE5DF4000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2497295510.000000000040A000.00000004.00000001.01000000.00000019.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481628764.0000027384725000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738473E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384651000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2033340080.000000000040A000.00000004.00000001.01000000.00000003.sdmp, npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181972948.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190677875.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2027958592.000001ACC3C3F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317540774.000001ACC3C6B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2313157437.000001ACC3C68000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128239982.0000024DE5DFF000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128056315.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2127970528.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2497295510.000000000040A000.00000004.00000001.01000000.00000019.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481628764.0000027384725000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738473E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: notepad++.exe, 00000009.00000002.2317540774.000001ACC3C6B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A48000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315795906.000001ACC3A49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A45000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2313157437.000001ACC3C68000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128239982.0000024DE5DFF000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128056315.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2127970528.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2130187479.0000024DE5E02000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2497295510.000000000040A000.00000004.00000001.01000000.00000019.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481628764.0000027384725000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738473E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2963626685.0000027384302000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2033340080.000000000040A000.00000004.00000001.01000000.00000003.sdmp, npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181972948.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182879569.000001ACC3B49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190677875.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2027958592.000001ACC3C3F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317540774.000001ACC3C6B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2314805121.000001ACC3722000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316508533.000001ACC3B4B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2313157437.000001ACC3C68000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128198327.0000024DE5E30000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128056315.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2127970528.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128274148.0000024DE5DF4000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2497295510.000000000040A000.00000004.00000001.01000000.00000019.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481628764.0000027384725000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738473E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384651000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://dejavu.sourceforge.net/wiki/index.php/Main_Page
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ethanschoonover.com/solarized
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://framework.lojcomm.com.br/tmTheme2nppStyler/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://fsf.org/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kippura.org/zenburnpage/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://media.nodnod.net/Inconsolata-dz.otf.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://notepad-plus.sourceforge.net/commun/update/getDownLoadUrl.php
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2033340080.000000000040A000.00000004.00000001.01000000.00000003.sdmp, npp.8.6.7.Installer.x64.exe, 00000000.00000000.1708138105.000000000040A000.00000008.00000001.01000000.00000003.sdmp, npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 0000000E.00000002.2168985434.000000000040A000.00000008.00000001.01000000.00000019.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2497295510.000000000040A000.00000004.00000001.01000000.00000019.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000000.2174233824.000000000040A000.00000008.00000001.01000000.00000019.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2033340080.000000000040A000.00000004.00000001.01000000.00000003.sdmp, npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181972948.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182879569.000001ACC3B49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190677875.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2027958592.000001ACC3C3F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317540774.000001ACC3C6B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2314805121.000001ACC3722000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316508533.000001ACC3B4B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2313157437.000001ACC3C68000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128239982.0000024DE5DFF000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128198327.0000024DE5E30000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128056315.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2127970528.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2497295510.000000000040A000.00000004.00000001.01000000.00000019.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481628764.0000027384725000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738473E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384651000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2033340080.000000000040A000.00000004.00000001.01000000.00000003.sdmp, npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181972948.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A47000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190677875.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2027958592.000001ACC3C3F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317540774.000001ACC3C6B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A48000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315795906.000001ACC3A49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A45000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2313157437.000001ACC3C68000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128239982.0000024DE5DFF000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128056315.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2127970528.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2130187479.0000024DE5E02000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2497295510.000000000040A000.00000004.00000001.01000000.00000019.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481628764.0000027384725000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2033340080.000000000040A000.00000004.00000001.01000000.00000003.sdmp, npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2174166347.000001ACC39C9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181972948.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A47000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190677875.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2173640520.000001ACC39C9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2027958592.000001ACC3C3F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317540774.000001ACC3C6B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315544527.000001ACC39C9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A48000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315795906.000001ACC3A49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A45000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2313157437.000001ACC3C68000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128239982.0000024DE5DFF000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128198327.0000024DE5E30000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128056315.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2127970528.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2497295510.000000000040A000.00000004.00000001.01000000.00000019.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481628764.0000027384725000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2033340080.000000000040A000.00000004.00000001.01000000.00000003.sdmp, npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181972948.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A47000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190677875.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2027958592.000001ACC3C3F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317540774.000001ACC3C6B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A48000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315795906.000001ACC3A49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A45000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2313157437.000001ACC3C68000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128239982.0000024DE5DFF000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128056315.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2127970528.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2497295510.000000000040A000.00000004.00000001.01000000.00000019.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481628764.0000027384725000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738473E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0X
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://sourceforge.net/donate/index.php?group_id=95717
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://sourceforge.net/p/notepad-plus/patches/613/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://stackoverflow.com/questions/19246077/how-to-add-lua-functions-to-the-notepad-functionlist-xml
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://stackoverflow.com/questions/32126855/notepad-and-ada
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2168262353.000001ACC3AC0000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182879569.000001ACC3B49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316116082.000001ACC3ACB000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2962898421.0000027384000000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384651000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tortoisesvn.tigris.org/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wiseheartdesign.com/articles/2006/03/11/ruby-blue-textmate-theme)
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.3276.hu
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.ada-auth.org/standards/overview22.html
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2033340080.000000000040A000.00000004.00000001.01000000.00000003.sdmp, npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181972948.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182879569.000001ACC3B49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190677875.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2027958592.000001ACC3C3F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317540774.000001ACC3C6B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2314805121.000001ACC3722000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316508533.000001ACC3B4B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2313157437.000001ACC3C68000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128239982.0000024DE5DFF000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128198327.0000024DE5E30000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128056315.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2127970528.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2497295510.000000000040A000.00000004.00000001.01000000.00000019.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481628764.0000027384725000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738473E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384651000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com/CPS0
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.geoffray.be
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000002.2176204340.0000024DE5DA6000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.gnu.org/licenses/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.vim.org/scripts/script.php?script_id=190
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.vim.org/scripts/script.php?script_id=1987
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://zend.lojcomm.com.br/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ashkulz.github.io/NppFTP/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/rdipardo/dbgp
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273845DF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/rdipardo/dbgp/downloads/dbgpPlugin_v0.14.2.1_x64.zip
Source: notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/rdipardo/dbgpCZ.
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/rdipardo/htmltag/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/rdipardo/htmltag/downloads/HTMLTag_v1.4.4_x64.zip
Source: notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/rdipardo/htmltag/sZ
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/uph0/filefinder
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384651000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273845DF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/uph0/filefinder/downloads/FileFinder.v0.3.0.x64.bin.zip
Source: notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/uph0/filefinderoZ
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/uph0/sourcecookifier/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/uph0/sourcecookifier/downloads/SourceCookifier.v0.10.0.x64.bin.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.notepad-plus-plus.org/topic/11554/function-list-for-vhdl
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://creativecommons.org/licenses/by-nc-sa/3.0/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000002.2178452586.00007FFE00560000.00000002.00000001.01000000.00000010.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://curl.se/V
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, GUP.exe, 0000000A.00000002.2178244641.00007FFE00537000.00000002.00000001.01000000.00000010.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000002.2178452586.00007FFE00560000.00000002.00000001.01000000.00000010.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/copyright.htmlD
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, GUP.exe, 0000000A.00000002.2178244641.00007FFE00537000.00000002.00000001.01000000.00000010.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/hsts.html
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, GUP.exe, 0000000A.00000002.2178244641.00007FFE00537000.00000002.00000001.01000000.00000010.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dansleru.sh
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://editorconfig.org/.
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://fossil.2of4.net/npp_preview
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://fossil.2of4.net/npp_preview/zip/PreviewHTML64.zip%3Fname%3D%26uuid%3Dv1.3.2.0-64
Source: notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://fossil.2of4.net/npp_preview;
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039128456.00000000027BD000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499646834.0000000002784000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://fsf.org/
Source: notepad++.exe, 00000009.00000002.2316826565.000001ACC3B8F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2162879790.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3B8D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273845AC000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384651000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.c
Source: notepad++.exe, 00000009.00000002.2316826565.000001ACC3B8F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2162879790.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3B8D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.c/CSVLint/tyle
Source: notepad++.exe, 00000009.00000002.2316826565.000001ACC3B8F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2162879790.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3B8D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.cRosi/CADdyTools30c9101l
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/BdR76/CSVLint/
Source: notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/BdR76/CSVLint/64.zip.zip9
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/BdR76/CSVLint/releases/download/0.4.6.6/CSVLint_x64.zip
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/BdR76/CSVLint/tyle
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/BdR76/RandomValuesNPP/
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/BdR76/RandomValuesNPP/_x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182841442.000001ACC3C26000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317183499.000001ACC3C29000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/BdR76/RandomValuesNPP/releases/download/0.3/RandomValuesNppPlugin_x64.zip
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/BdR76/RandomValuesNPP/releases/download/0.3/RandomValuesNppPlugin_x64.zipP
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Chocobo1/nppAutoDetectIndent
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384634000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273845DF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Chocobo1/nppAutoDetectIndent/releases/download/2.3/x64.zip
Source: notepad++.exe, 00000009.00000003.2179624036.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Chocobo1/nppAutoDetectIndent/releases/download/2.3/x64.zipp.ini
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Chocobo1/nppAutoDetectIndentp
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Coises/ColumnsPlusPlus
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A47000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A48000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315795906.000001ACC3A49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Coises/ColumnsPlusPlus/releases/download/v1.0.6/ColumnsPlusPlus-1.0.6-x64.zip
Source: notepad++.exe, 00000009.00000002.2315754447.000001ACC3A34000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Coises/ColumnsPlusPlus/releases/download/v1.0.6/ColumnsPlusPlus-1.0.6-x64.zip$
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Coises/ColumnsPlusPlusg
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/DominicTobias/SecurePad
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182841442.000001ACC3C26000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317183499.000001ACC3C29000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/DominicTobias/SecurePad/releases/download/v2.4/SecurePad_v2.4_x64.zip
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/DominicTobias/SecurePadip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Dook1/Bookmarks-Dook
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Dook1/Bookmarks-Dook/releases/download/v4.0.4/BookmarksDook.64.4.0.4.zip
Source: notepad++.exe, 00000009.00000003.2182879569.000001ACC3B49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Dook1/Bookmarks-Dook/releases/download/v4.0.4/BookmarksDook.64.4.0.4.zip0
Source: notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Dook1/Bookmarks-Dook/releases/download/v4.0.4/BookmarksDook.64.4.0.4.zipM
Source: notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Dook1/Bookmarks-Dook1ZX
Source: notepad++.exe, 00000009.00000003.2169592451.000001ACC3811000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315303218.000001ACC3832000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2171729069.000001ACC382E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2170965269.000001ACC3815000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2029905481.0000021B95B71000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2042725815.0000021B95A31000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2038254217.0000021B95BF6000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2032828236.0000021B95BCE000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2043402615.0000021B95A36000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2043540267.0000021B95A4E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2045891135.0000021B95A53000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2033342504.0000021B95BD9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2031777396.0000021B95B7D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2042149234.0000021B95BFF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2043229028.0000021B95BFF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2033691922.0000021B95BE9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000002.2049815080.0000021B95A53000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2039572823.0000021B95BF9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2963626685.0000027384302000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001D.00000003.2496335382.0000025E0F247000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Edditoria/markdown-plus-plus
Source: notepad++.exe, 00000009.00000003.2169592451.000001ACC3811000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315303218.000001ACC3832000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2171729069.000001ACC382E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2170965269.000001ACC3815000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2029905481.0000021B95B71000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2038254217.0000021B95BF6000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2032828236.0000021B95BCE000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2033342504.0000021B95BD9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2031777396.0000021B95B7D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2042149234.0000021B95BFF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2043229028.0000021B95BFF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2033691922.0000021B95BE9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2039572823.0000021B95BF9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2963626685.0000027384302000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Edditoria/markdown-plus-plus/blob/master/LICENSE.txt
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Ekopalypse/EnhanceAnyLexer
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273845AC000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Ekopalypse/EnhanceAnyLexer/releases/download/v.1.4.0/EnhanceAnyLexer_x64_PluginAd
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Ekopalypse/EnhanceAnyLexerL
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Fruchtzwerg94/PlantUmlViewer
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182879569.000001ACC3B49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316508533.000001ACC3B4B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273845AC000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Fruchtzwerg94/PlantUmlViewer/releases/download/1.7.0.11/PlantUmlViewer_v1.7.0.11_
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Hsilgos/nppsaveasadmin
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Hsilgos/nppsaveasadmin/releases/download/1.0.211/NppSaveAsAdmin_1.0.211_x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Jiangshan00001/npp_MZC8051
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Jiangshan00001/npp_MZC8051/releases/download/0.0.1/MZC8051_x64.zip
Source: notepad++.exe, 00000009.00000003.2182501875.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Jiangshan00001/npp_MZC8051/releases/download/0.0.1/MZC8051_x64.zipY/v
Source: notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Jiangshan00001/npp_MZC8051/releases/download/0.0.1/MZC8051_x64.zip_
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Krazal/nppopenai
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Krazal/nppopenai/releases/download/v0.3.0.1/NppOpenAI_x64.zip
Source: notepad++.exe, 00000009.00000003.2182501875.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Krazal/nppopenai/releases/download/v0.3.0.1/NppOpenAI_x64.zipm/B
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Krazal/nppopenai45
Source: notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Krazal/nppopenaig
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/KubaDee/NppTextViz
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182841442.000001ACC3C26000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317183499.000001ACC3C29000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/KubaDee/NppTextViz/releases/download/v0.4.2/NppTextViz_x64_v0.4.2.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/KubaDee/SelectToClipboard
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/KubaDee/SelectToClipboard/releases/download/v1.0.3/SelectToClipboard_x64_v1.0.3.z
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3B8F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2162879790.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3B8D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/KvanTTT/NppGist
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/KvanTTT/NppGist/releases/download/1.5.1/NppGist-x64-1.5.1.35.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Leonard-The-Wise/NWScript-Npp
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Leonard-The-Wise/NWScript-Npp/releases/download/v1.2.0/nwscript-npp.v1.2.0-x64.zi
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316610460.000001ACC3B5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182920222.000001ACC3B5B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/MIvanchev/NppEventExec
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/MIvanchev/NppEventExec/releases/download/v0.9.0/NppEventExec-plugin-x64-0.9.0.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/MarioRosi/CADdyTools
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182879569.000001ACC3B49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/MarioRosi/CADdyTools/releases/download/1.1.3.7/CADdyTools_v1137_x64.zip
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/MarioRosi/CADdyTools30c9101l
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Megabyteceer/npp-task-list
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Megabyteceer/npp-task-list/releases/download/v2.6.0/NppTaskList_v2.6.0_x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pascal-Krenckel/NppGZipFileViewer
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273845AC000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pascal-Krenckel/NppGZipFileViewer/releases/download/v3.0.1/NppGZipFileViewerX64.t
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Predelnik/DSpellCheck
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Predelnik/DSpellCheck/releases/download/v1.5.0/DSpellCheck_x64.zip
Source: notepad++.exe, 00000009.00000003.2182501875.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Predelnik/DSpellCheck/releases/download/v1.5.0/DSpellCheck_x64.zip=/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316577282.000001ACC3B58000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/ScienceDiscoverer/CommentToggler
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182879569.000001ACC3B49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384651000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/ScienceDiscoverer/CommentToggler/releases/download/1.0.0/CommentToggler.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/SinghRajenM/nppURLPlugin
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182841442.000001ACC3C26000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317183499.000001ACC3C29000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/SinghRajenM/nppURLPlugin/releases/download/1.2.0.0/urlPlugin_x64.zip
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/SinghRajenM/nppURLPlugin/releases/download/1.2.0.0/urlPlugin_x64.zipW
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/StanDog/npp-zoomdisabler
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/StanDog/npp-zoomdisabler/raw/master/RELEASES/zoomdisabler_1.2.0.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273845AC000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/TaoK/PoorMansTSqlFormatter/releases/download/1.6.13/SqlFormatterNppPlugin.x64.1.6
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Zukaritasu/notepadpp_rpc
Source: notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182879569.000001ACC3B49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316508533.000001ACC3B4B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Zukaritasu/notepadpp_rpc/releases/download/v1.8.6/DiscordRPC_v1.8.6_x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/ahmoylaw/RegexTrainer-Descriptions
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/ahmoylaw/RegexTrainer-Descriptions/raw/master/Release-x64-1.2.0/RegexTrainer.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273845DF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/ashkulz/NppFTP/releases/download/v0.29.13/NppFTP-x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3B8F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2162879790.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3B8D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/azerg/NppBplistPlugin
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182879569.000001ACC3B49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/azerg/NppBplistPlugin/releases/download/2.0.0.3/NppBplistPlugin_x64.zip
Source: notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/azerg/NppBplistPlugin/releases/download/2.0.0.3/NppBplistPlugin_x64.zipd
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/azerg/NppBplistPluginory.v
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/blu3mania/npp-papyrus
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/blu3mania/npp-papyrus.2.2-x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182841442.000001ACC3C26000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317183499.000001ACC3C29000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/blu3mania/npp-papyrus/releases/download/v1.2.2/PapyrusPlugin-v1.2.2-x64.zip
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/blu3mania/npp-papyrus85I
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/bruderstein/PythonScript
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2963626685.0000027384302000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/bruderstein/PythonScript/releases/download/v2.0.0/PythonScript_Full_2.0.0.0_x64_P
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273845DF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/chcg/ImgTag/releases/download/2.0.1.8/ImgTag_2.0.1.8_x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182841442.000001ACC3C26000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2313894105.000001ACC1819000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317183499.000001ACC3C29000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384651000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/chcg/JumpList/releases/download/1.2.2.10/NppJumpList_1.2.2.10_x64.zip
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/chcg/JumpList/releases/download/1.2.2.10/NppJumpList_1.2.2.10_x64.zipO
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/chcg/NPP_ExportPlugin
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182841442.000001ACC3C26000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317183499.000001ACC3C29000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/chcg/NPP_ExportPlugin/releases/download/0.4.0/NppExport_0.4.0_x64.zip
Source: notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/chcg/NPP_ExportPlugin/releases/download/0.4.0/NppExport_0.4.0_x64.zips
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/chcg/NPP_HexEdit
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/chcg/NPP_HexEdit/releases/download/0.9.12/HexEditor_0.9.12_x64.zip
Source: notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/chcg/NPP_HexEdit/releases/download/0.9.12/HexEditor_0.9.12_x64.zip2
Source: notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/chcg/NPP_HexEditase.uZ
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182841442.000001ACC3C26000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317183499.000001ACC3C29000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/chcg/NppDocShare/releases/download/0.1.13/NppDocShare_0.1.13_x64.zip
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/chcg/NppDocShare/releases/download/0.1.13/NppDocShare_0.1.13_x64.zipF
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/chcg/SpeechPlugin
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182841442.000001ACC3C26000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317183499.000001ACC3C29000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/chcg/SpeechPlugin/releases/download/v0.4.0/SpeechPlugin_v0.4.0_x64.zip
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/chcg/npp-session-manager/releases/download/v1.4.4/SessionMgr_v1.4.4_x64.zip
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/chcg/npp-session-manager/releases/download/v1.4.4/SessionMgr_v1.4.4_x64.zipN
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/chcg/npp.connections/releases/download/1.1/npp.connections-1.1-x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/chcg/rustnpp/releases/download/1.0.2/rustnpp_1.0.2_x86_64.zip
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/chcg/rustnpp/releases/download/1.0.2/rustnpp_1.0.2_x86_64.zip%
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481893248.000002738469F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846A2000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/cmbsolutions/nppRandomStringGenerator
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028489315.000001ACC3BCD000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316978854.000001ACC3BD0000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169091363.000001ACC3BD0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/cmbsolutions/nppRandomStringGenerator/releases/download/v1.9.1/nppRandomStringGen
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/cpmcgrath/codealignment
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A47000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A48000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315795906.000001ACC3A49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A45000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384696000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/cpmcgrath/codealignment/releases/download/v14.1/CodeAlignmentNpp_v14.1_x64.zip
Source: notepad++.exe, 00000009.00000002.2315754447.000001ACC3A34000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/cpmcgrath/codealignment/releases/download/v14.1/CodeAlignmentNpp_v14.1_x64.zip.mo
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/cpmcgrath/codealignmentG
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/d0vgan/npp-XBracketsLite
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182841442.000001ACC3C26000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317183499.000001ACC3C29000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/d0vgan/npp-XBracketsLite/releases/download/v131/XBrackets_v131_dll_x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/d0vgan/nppexec
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/d0vgan/nppexec/releases/download/v088/NppExec_088_dll_x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/daddel80/notepadpp-multireplace
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/daddel80/notepadpp-multireplace/releases/download/3.0.0.12/MultiReplace-v3.0.0.12
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/dail8859/BetterMultiSelection
Source: notepad++.exe, 00000009.00000003.2182501875.000001ACC3A47000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A48000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315795906.000001ACC3A49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A45000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273845AC000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/dail8859/BetterMultiSelection/releases/download/v1.5/BetterMultiSelection_v1.5_x6
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/dail8859/DoxyIt
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/dail8859/DoxyIt/releases/download/v0.4.4/DoxyIt_v0.4.4_x64.zip
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/dail8859/DoxyIt/releases/download/v0.4.4/DoxyIt_v0.4.4_x64.zipA
Source: notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/dail8859/DoxyIt/releases/download/v0.4.4/DoxyIt_v0.4.4_x64.zipD
Source: notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/dail8859/DoxyItaZ
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/dail8859/DoxyItified1
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/dail8859/LuaScript
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/dail8859/LuaScript/releases/download/v0.12/LuaScript_v0.12_x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/dail8859/SurroundSelection
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/dail8859/SurroundSelection/releases/download/v1.4.1/SurroundSelection_v1.4.1_x64.
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/dail8859/SurroundSelectiona
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/davidsover/nppJSFunctionViewer
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/davidsover/nppJSFunctionViewer/releases/download/v1.1.0/JSFunctionViewer_x64.zip
Source: notepad++.exe, 00000009.00000002.2315754447.000001ACC3A34000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/davidsover/nppJSFunctionViewer/releases/download/v1.1.0/JSFunctionViewer_x64.zipE
Source: notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/davidsover/nppJSFunctionViewerd
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/deadem/notepad-pp-linter
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.000002738467B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273845DF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/deadem/notepad-pp-linter/raw/v0.1.0.0/bin/x64/linter.zip
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/deadem/notepad-pp-linter4
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/dinkumoil/NppUISpy
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182841442.000001ACC3C26000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317183499.000001ACC3C29000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/dinkumoil/NppUISpy/releases/download/v1.2/NppUISpy_v1.2_x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/dominikcebula/npp-java-plugin
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315754447.000001ACC3A34000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/dominikcebula/npp-java-plugin/releases/download/v0.4.0/NppJavaPlugin_v0.4.0_x64.z
Source: notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/dominikcebula/npp-java-pluginAP
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/editorconfig/editorconfig-notepad-plus-plus
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2963626685.0000027384302000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/editorconfig/editorconfig-notepad-plus-plus/releases/download/v0.4.0/NppEditorCon
Source: notepad++.exe, 00000009.00000002.2314048585.000001ACC185A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2177438511.000001ACC184E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/editorconfig/editorconfig-notepad-plus-plus4
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/eljefe7000/RestApiToText
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/eljefe7000/RestApiToText/raw/master/x64/Release/v1.4.0.1/RestApiToText.zip
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/eljefe7000/RestApiToTextL5E
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/ffes/indentbyfold/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/ffes/indentbyfold/releases/download/v0.7.3/IndentByFold-073-x64.zip
Source: notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/ffes/indentbyfold/zipyZ
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/ffes/nppsnippets/releases/download/v1.7.1/NppSnippets-171-x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028411660.000001ACC3BD4000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/ffes/npptags/releases/download/v0.9.1/NppTags-091-x64.zip
Source: notepad++.exe, 00000009.00000003.2179624036.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/ffes/npptags/releases/download/v0.9.1/NppTags-091-x64.zipenN
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182841442.000001ACC3C26000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317183499.000001ACC3C29000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/ffes/selectquotedtext/releases/download/v1.1.0/SelectQuotedText-110-x64.zip
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/ffes/selectquotedtext/releases/download/v1.1.0/SelectQuotedText-110-x64.zipB
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2162879790.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3B8D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/francostellari/NppPlugins
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182879569.000001ACC3B49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/francostellari/NppPlugins/raw/main/AutoSave/AutoSave_dll_2v00_x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/francostellari/NppPlugins/raw/main/LanguageHelp/LanguageHelp_dll_1v75_x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182879569.000001ACC3B49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316508533.000001ACC3B4B000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/francostellari/NppPlugins/raw/main/MenuIcons/MenuIcons_dll_2v07_x64.zip
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/francostellari/NppPlugins/raw/main/MenuIcons/MenuIcons_dll_2v07_x64.zipY
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/francostellari/NppPlugins/raw/main/OpenSelection/OpenSelection_dll_1v13_x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182841442.000001ACC3C26000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317183499.000001ACC3C29000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/francostellari/NppPlugins/raw/main/RunMe/RunMe_dll_1v61_x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182841442.000001ACC3C26000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317183499.000001ACC3C29000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/francostellari/NppPlugins/raw/main/TakeNotes/TakeNotes_dll_1v27_x64.zip
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/francostellari/NppPlugins/raw/main/TakeNotes/TakeNotes_dll_1v27_x64.zip9
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/francostellari/NppPlugins/raw/main/TakeNotes/TakeNotes_dll_1v27_x64.zipV
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/francostellari/NppPlugins/raw/main/TopMost/TopMost_dll_1v42_x64.zip
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/francostellari/NppPlugins=
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/francostellari/NppPluginsH5Y
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/francostellari/NppPluginsf
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/gallettube/MusicPlayer/releases/download/1.0.11/MusicPlayer_1.0.11x64.dll.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/gup4win/wingup).
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/gup4win/wingup/blob/master/vcproj/GUP.sln)
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/gurikbal/Merge-files-in-one
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/gurikbal/Merge-files-in-one#
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/gurikbal/Merge-files-in-one/releases/download/1.2.0.0/Merge.files.in.one_x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/gurikbal/Remove_dup_lines
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182841442.000001ACC3C26000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317183499.000001ACC3C29000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/gurikbal/Remove_dup_lines/releases/download/1.3.0.2/Remove_dup_lines_x64.zip
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/gurikbal/Remove_dup_lines/releases/download/1.3.0.2/Remove_dup_lines_x64.zip0
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/heldersepu/nppfavorites
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/heldersepu/nppfavorites/releases/download/1.0.0.1.21/NppFavorites_1.0.0.1.21_x64.
Source: notepad++.exe, 00000009.00000002.2316610460.000001ACC3B5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182920222.000001ACC3B5B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/heldersepu/nppfavoritesq
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/incrediblejr/nppplugins/releases/download/v3.0.1/nppplugin_ofis2_x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/incrediblejr/nppplugins/releases/download/v3.0.1/nppplugin_solutionhub_ui_x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/incrediblejr/nppplugins/releases/download/v3.0.1/nppplugin_solutionhub_x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/incrediblejr/nppplugins/releases/download/v3.0.1/nppplugin_solutiontools_x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182841442.000001ACC3C26000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317183499.000001ACC3C29000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/incrediblejr/nppplugins/releases/download/v3.0.1/nppplugin_svn_x64.zip
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/incrediblejr/nppplugins/releases/download/v3.0.1/nppplugin_svn_x64.zipk
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2183719114.000001ACC3B7C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2162879790.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316786683.000001ACC3B7D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384634000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/jcaillon/3P/releases/download/v1.8.8/3P_x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/jeanpaulrichter/nppcrypt
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182879569.000001ACC3B49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/jeanpaulrichter/nppcrypt/releases/download/1.0.1.6/nppcrypt_1.0.1.6_x64.zip
Source: notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/jeanpaulrichter/nppcrypt/releases/download/1.0.1.6/nppcrypt_1.0.1.6_x64.zipj
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/jeanpaulrichter/nppcryptD5M
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/jejemorg/NppPluginOpenHost/
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/jejemorg/NppPluginOpenHost/i
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182841442.000001ACC3C26000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317183499.000001ACC3C29000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384651000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/jejemorg/NppPluginOpenHost/releases/download/1.1/NppPluginOpenHost.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/joaoasrosa/nppxmltreeview/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/joaoasrosa/nppxmltreeview/releases/download/v2.0.0/NppXMLTreeViewPlugin_x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/jokedst/CsvQuery
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/jokedst/CsvQuery/releases/download/v1.2.9/CsvQuery-v1.2.9-x64.zip
Source: notepad++.exe, 00000009.00000003.2182501875.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/jokedst/CsvQuery/releases/download/v1.2.9/CsvQuery-v1.2.9-x64.zip%/
Source: notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/jokedst/CsvQuerye
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/kapilratnani/JSON-Viewer
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182879569.000001ACC3B49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316508533.000001ACC3B4B000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/kapilratnani/JSON-Viewer/releases/download/v2.0.7.0/NPPJSONViewer_x64.zip
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/kapilratnani/JSON-Viewer/releases/download/v2.0.7.0/NPPJSONViewer_x64.zipo
Source: notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/kapilratnani/JSON-Viewer/releases/download/v2.0.7.0/NPPJSONViewer_x64.zipx
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/leonardchai/FoldingLineHider
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/leonardchai/FoldingLineHider/releases/download/v1.1/FoldingLineHider1.1.x64.zip
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/leonardchai/FoldingLineHiderJ
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/lygstate/NotepadStarter/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/lygstate/NotepadStarter/releases/download/2.3.3.0/NotepadStarter_2.3.3.0_x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/mariusv-github/ElasticTabstops
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273845AC000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/mariusv-github/ElasticTabstops/releases/download/v1.5.0/ElasticTabstops_x64_1.5.0
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/megaboich/js-map-parser/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/megaboich/js-map-parser/releases/download/4.2/JsMapParser_NppPlugin_4_2_x64.zip
Source: notepad++.exe, 00000009.00000002.2315754447.000001ACC3A34000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/megaboich/js-map-parser/releases/download/4.2/JsMapParser_NppPlugin_4_2_x64.zipyp
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/michaelxzhang/Npp-Highlighter
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/michaelxzhang/Npp-Highlighter/releases/download/v1.0.0.1/Npp-Highlighter_x64.zip
Source: notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/michaelxzhang/Npp-Highlighterip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/mohzy83/NppMarkdownPanel
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/mohzy83/NppMarkdownPanel/releases/download/0.7.3.1/NppMarkdownPanel-0.7.3.0-x64.z
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182920222.000001ACC3B5B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/molsonkiko
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/molsonkiko/HugeFiles/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/molsonkiko/HugeFiles/releases/download/v0.4.1/Release_x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/molsonkiko/JsonToolsNppPlugin
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182879569.000001ACC3B49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/molsonkiko/JsonToolsNppPlugin/releases/download/v7.2.0/Release_x64.zip
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/molsonkiko/JsonToolsNppPlugin/releases/download/v7.2.0/Release_x64.zipK
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/molsonkikoSymbqqs
Source: notepad++.exe, 00000009.00000002.2316646936.000001ACC3B66000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/molsonkikoce581fa63b02
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/morbac/xmltools
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182841442.000001ACC3C26000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317183499.000001ACC3C29000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/morbac/xmltools/releases/download/3.1.1.13/XMLTools-3.1.1.13-x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273845AC000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/nea/MarkdownViewerPlusPlus/releases/download/0.8.2/MarkdownViewerPlusPlus-0.8.2-x
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/niccord/BracketsCheck/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/niccord/BracketsCheck/releases/download/v1.2.3/BracketsCheck_1-2-3_x64.zip
Source: notepad++.exe, 00000009.00000003.2182879569.000001ACC3B49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/niccord/BracketsCheck/releases/download/v1.2.3/BracketsCheck_1-2-3_x64.zipG
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/nika-begiashvili/rustnpp
Source: notepad++.exe, 00000009.00000003.2182501875.000001ACC3A47000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A48000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315795906.000001ACC3A49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A45000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2044763097.0000021B95A47000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2044730349.0000021B95D21000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2042725815.0000021B95A31000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2029222671.0000021B95A98000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2041184747.0000021B95D21000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2041437831.0000021B95D21000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2043402615.0000021B95A36000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000002.2050255961.0000021B95D24000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2044030812.0000021B95A46000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2043447852.0000021B95D21000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2041540864.0000021B95D21000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2963626685.0000027384302000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001D.00000003.2505551659.0000025E0EEFD000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001D.00000003.2497257481.0000025E0F2C6000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001D.00000003.2502280835.0000025E0F4DD000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001D.00000003.2503891095.0000025E0F2C8000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001D.00000003.2507447996.0000025E0EF2F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/notepad-plus-plus/notepad-plus-plus/blob/master/PowerEditor/installer/nativeLang/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/notepad-plus-plus/notepad-plus-plus/issues/4563
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/notepad-plus-plus/wingup/blob/master/src/translations/corsican.xml
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/npp-plugins/converter/
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/npp-plugins/converter/64.zipE.1
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/npp-plugins/converter/releases/download/v4.6/nppConvert.v4.6.x64.zip
Source: notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/npp-plugins/converter/releases/download/v4.6/nppConvert.v4.6.x64.zipm
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3B8F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2162879790.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3B8D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/npp-plugins/mimetools
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/npp-plugins/mimetools/releases/download/v3.1/mimetools.v3.1.x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182879569.000001ACC3B49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182920222.000001ACC3B5B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384651000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/npp-plugins/plugindemo/releases/download/v4.4/pluginDemo.v4.4.bin.x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/npp-plugins/plugintemplate/releases/download/v4.4/pluginTemplate.v4.4.bin.x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/npp-plugins/pork2sausage
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384651000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/npp-plugins/pork2sausage/releases/download/v2.5/pork2sausage.2.5.bin.x64.zip
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/npp-plugins/pork2sausage/releases/download/v2.5/pork2sausage.2.5.bin.x64.zipy
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/npp-plugins/selectnlaunch
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/npp-plugins/selectnlaunch/releases/download/v2.2/selectNLaunch.v2.2.bin.x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3B96000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/oleg-shilo
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3B96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/oleg-shilo.
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/oleg-shilo/cs-script.npp
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A47000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A48000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315795906.000001ACC3A49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/oleg-shilo/cs-script.npp/releases/download/v2.0.4.0/CSScriptNpp.2.0.4.0.x64.zip
Source: notepad++.exe, 00000009.00000002.2315754447.000001ACC3A34000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/oleg-shilo/cs-script.npp/releases/download/v2.0.4.0/CSScriptNpp.2.0.4.0.x64.zipVe
Source: notepad++.exe, 00000009.00000003.2182501875.000001ACC3A47000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A48000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315795906.000001ACC3A49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/oleg-shilo/cs-script.npp/releases/download/v2.0.4.0/CSScriptNpp.2.0.4.0.x64.zipW
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/oleg-shilo/scripts.npp/releases/download/v2.0.0.0/NppScripts.x64.zip
Source: notepad++.exe, 00000009.00000003.2180899116.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2183719114.000001ACC3B7C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2162879790.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316786683.000001ACC3B7D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/oleg-shiloy
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/oviradoi/npp-explorer-plugin
Source: notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/oviradoi/npp-explorer-plugin/releases/download/v1.9.9/Explorer_x64.zip
Source: notepad++.exe, 00000009.00000003.2182879569.000001ACC3B49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/oviradoi/npp-explorer-plugin/releases/download/v1.9.9/Explorer_x64.ziplulations.
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/oviradoi/npp-explorer-plugin0
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/oviradoi/npp-explorer-pluginl
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/p0358/notepadpp-CodeStats
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A47000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315754447.000001ACC3A34000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A48000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315795906.000001ACC3A49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A45000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384696000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/p0358/notepadpp-CodeStats/releases/download/v1.1.1/notepadpp-CodeStats_x64.zip
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/p0358/notepadpp-CodeStatsP
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/peter-frentrup/NppMenuSearch
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/pnedev/compare-plugin
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip
Source: notepad++.exe, 00000009.00000003.2182879569.000001ACC3B49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zips
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/pnedev/comparePlus
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182879569.000001ACC3B49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316508533.000001ACC3B4B000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/pnedev/comparePlus/releases/download/cp_1.2.0/ComparePlus_cp_1.2.0_x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/pnedev/nppgtags
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182841442.000001ACC3C26000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317183499.000001ACC3C29000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/pnedev/nppgtags/releases/download/v5.1.2/NppGTags_v5.1.2_x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/querykuma/qkNppReverseLines
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028489315.000001ACC3BCD000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316978854.000001ACC3BD0000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169091363.000001ACC3BD0000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384651000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/querykuma/qkNppReverseLines/releases/download/v1.0.0.0/qkNppReverseLinesPlugin_v1
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384651000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/rainman74/NPPTextFX2
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182841442.000001ACC3C26000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317183499.000001ACC3C29000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/rainman74/NPPTextFX2/releases/download/1.4.1/NppTextFX2.1.4.1.x64.zip
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/rainman74/NPPTextFX2/releases/download/1.4.1/NppTextFX2.1.4.1.x64.zipq
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/rdipardo/nppFSIPlugin
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315754447.000001ACC3A34000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/rdipardo/nppFSIPlugin/releases/download/v0.2.2.0/NPPFSIPlugin_v0.2.2.0_x64.zip
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/rdipardo/nppFSIPluginH
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/rdipardo/nppQrCode
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182841442.000001ACC3C26000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317183499.000001ACC3C29000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/rdipardo/nppQrCode/releases/download/v0.0.0.2/NppQrCode-0.0.0.2-x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/shriprem/FWDataViz
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384651000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/shriprem/FWDataViz/releases/download/v2.6.3.1/FWDataViz_x64.zip
Source: notepad++.exe, 00000009.00000003.2182501875.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/shriprem/FWDataViz/releases/download/v2.6.3.1/FWDataViz_x64.zip5
Source: notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/shriprem/FWDataVizpEZT
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/shriprem/Goto-Line-Col-NPP-Plugin
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/shriprem/Goto-Line-Col-NPP-Plugin/releases/download/v2.4.3.0/GotoLineCol_x64.zip
Source: notepad++.exe, 00000009.00000002.2315754447.000001ACC3A34000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/shriprem/Goto-Line-Col-NPP-Plugin/releases/download/v2.4.3.0/GotoLineCol_x64.zipp
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182841442.000001ACC3C26000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317183499.000001ACC3C29000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/shtirlitz-dev/notepadpp-plugin/raw/master/64bit/ShtirlitzNppPlugin.zip
Source: notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182879569.000001ACC3B49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316508533.000001ACC3B4B000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/sieukrem/jn-npp-plugin/releases/download/2.2.185.9/jN_2.2.185.9_x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/sieukrem/jn-npp-plugin/wiki
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/sieukrem/jn-npp-plugin/wiki05q
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/sieukrem/jn-npp-plugin/wikiR
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/sunjw/jstoolnpp
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384651000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/superolmo/BigFiles
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273845DF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/superolmo/BigFiles/releases/download/v0.1.3.x64/BigFiles.zip
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/superolmo/BigFilesh
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/swhitley/ERPHelper/releases/download/v1.1.2/ERPHelper_x64.zip
Source: notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/swhitley/ERPHelper/releases/download/v1.1.2/ERPHelper_x64.zip;
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/swhitley/erphelper
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/swhitley/erphelperyle8
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/vinsworldcom/nppColumnTools
Source: notepad++.exe, 00000009.00000003.2182501875.000001ACC3A47000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315754447.000001ACC3A34000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A48000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315795906.000001ACC3A49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A45000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/vinsworldcom/nppColumnTools/releases/download/1.4.5.1/ColumnTools-v1.4.5.1-x64.zi
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/vinsworldcom/nppColumnToolsu
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/vinsworldcom/nppGitSCM
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/vinsworldcom/nppGitSCM/releases/download/1.4.9.1/GitSCM-v1.4.9.1-x64.zip
Source: notepad++.exe, 00000009.00000003.2182879569.000001ACC3B49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316508533.000001ACC3B4B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/vinsworldcom/nppGitSCM/releases/download/1.4.9.1/GitSCM-v1.4.9.1-x64.zip)
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3B8F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2162879790.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3B8D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/vinsworldcom/nppQuickText
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/vinsworldcom/nppQuickText/releases/download/0.2.5.1/QuickText-v0.2.5.1-x64.zip
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/vinsworldcom/nppQuickText5
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/vinsworldcom/nppQuickTextr
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273845AC000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/viper3400/NppRegExTractor/releases/download/2.1.0/NppRegExTractor_2.1.0_BUILD_6_x
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182841442.000001ACC3C26000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028411660.000001ACC3BD4000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/viper3400/RegExTractor/wiki/de_userdocumentation
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/vladk1973/npp.connections
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/wakatime/notepadpp-wakatime
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182841442.000001ACC3C26000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317183499.000001ACC3C29000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/wakatime/notepadpp-wakatime/releases/download/5.1.1/WakaTime-5.1.1-x64.zip
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/wakatime/notepadpp-wakatime/releases/download/5.1.1/WakaTime-5.1.1-x64.zipc
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182920222.000001ACC3B5B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/young-developer/nppNavigateTo
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273845AC000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/young-developer/nppNavigateTo/releases/download/v.2.6.4/NavigateTo_v.2.6.4_v142_x
Source: notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/young-developer/nppNavigateTol
Source: notepad++.exe, 00000009.00000002.2316826565.000001ACC3B8F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2162879790.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3B8D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.corldcom/nppColumnTools
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gitlab.com/dokutoku/rdmd-for-npp
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gitlab.com/dokutoku/rdmd-for-npp/uploads/8a16e1c6384fb6f14e12bf58ce6741f7/rdmd-ja-x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gitlab.com/dokutoku/rdmd-for-npp/uploads/d8a2c4156c0a9dea4726a247e692a8bd/rdmd-en-x64.zip
Source: notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3B96000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182920222.000001ACC3B5B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384651000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://jcaillon.github.io/3P/
Source: notepad++.exe, 00000009.00000003.2180899116.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2183719114.000001ACC3B7C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2162879790.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316786683.000001ACC3B7D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://jcaillon.github.io/3P/J
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://mfoster.com/npp/SessionMgr.html
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://nea.github.io/MarkdownViewerPlusPlus/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2033340080.000000000040A000.00000004.00000001.01000000.00000003.sdmp, npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181972948.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190677875.000001ACC3C5D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2027958592.000001ACC3C3F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317540774.000001ACC3C6B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2313157437.000001ACC3C68000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128239982.0000024DE5DFF000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128198327.0000024DE5E30000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2128056315.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000003.2127970528.0000024DE5E2C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2497295510.000000000040A000.00000004.00000001.01000000.00000019.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481628764.0000027384725000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738473E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://notepad-plus-plus.org/0
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039128456.00000000027BD000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499646834.0000000002784000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://notepad-plus-plus.org/VersionMajorVersionMinorNoModifyNoRepair/S=0K
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://notepad-plus-plus.org/community/topic/11059/custom-functions-list-rules
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://notepad-plus-plus.org/community/topic/12264/function-list-for-new-language
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://notepad-plus-plus.org/community/topic/12520/function-list-for-simatic
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://notepad-plus-plus.org/community/topic/12691/function-list-with-java-problems
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://notepad-plus-plus.org/community/topic/12742/functionlist-different-results-with-different-li
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://notepad-plus-plus.org/community/topic/12972/trouble-with-defining-a-function-list-entry/7
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://notepad-plus-plus.org/community/topic/13553/functionlist-xml-regular-expressions-not-parsing
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://notepad-plus-plus.org/community/topic/14494/functionlist-classrange-question
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://notepad-plus-plus.org/donate/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000002.2177595829.00007FF73E557000.00000002.00000001.01000000.0000000F.sdmp, GUP.exe, 0000000A.00000000.2020759345.00007FF73E557000.00000002.00000001.01000000.0000000F.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://notepad-plus-plus.org/downloads/openid_moreinfohttps://npp-user-manual.org/docs/upgrading/#n
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039128456.00000000027BD000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499646834.0000000002784000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://notepad-plus-plus.org/downloads/v7.9.2/This
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039128456.00000000027BD000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499646834.0000000002784000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://notepad-plus-plus.org/downloads/v7.9.2/open
Source: notepad++.exe, 00000009.00000003.2045047109.000001ACC5CDD000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2046458936.000001ACC5CDB000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2081536523.000001ACC5CD4000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2184805993.000001ACC5CDC000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2318232852.000001ACC5CDD000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2046688996.000001ACC5CDD000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2081344393.000001ACC5CCD000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2046153261.000001ACC5CDC000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2082385611.000001ACC5CD4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://notepad-plus-plus.org/downloads/v8.6.7/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 0000000A.00000002.2176204340.0000024DE5D8C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://notepad-plus-plus.org/update/getDownloadUrl.php
Source: notepad++.exe, 00000009.00000002.2315265086.000001ACC382D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169592451.000001ACC3811000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2176444833.000001ACC382D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2170965269.000001ACC3815000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2042725815.0000021B95A31000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2043907505.0000021B95A96000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2044225481.0000021B95A76000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000002.2049986089.0000021B95A96000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2043610808.0000021B95A68000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2043402615.0000021B95A36000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2043540267.0000021B95A4E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2044500137.0000021B95A7A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2043689865.0000021B95A92000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2043967910.0000021B95A73000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2043873004.0000021B95A6D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2044697241.0000021B95A96000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2963066257.000002738403E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001D.00000003.2505744176.0000025E0EEED000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001D.00000003.2505551659.0000025E0EEFD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://npp-user-manual.org/docs/config-files/#the-context-menu-contextmenu-xml
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://npp-user-manual.org/docs/function-list/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://npp-user-manual.org/docs/plugins/#how-to-develop-a-plugin
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://phdesign.com.au/assets/files/NppToolBucket-1.10-x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://phdesign.com.au/npptoolbucket/
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://planet-cnc.com/notepad-plugin/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://planet-cnc.com/wp-content/uploads/sw/Npp/PlanetCNCNpp64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/p/notepad-plus/discussion/331753/thread/5d9bb881/#e86e
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/p/notepad-plus/patches/597/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/analyseplugin
Source: notepad++.exe, 00000009.00000003.2182501875.000001ACC3A47000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2173450822.000001ACC39AF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315544527.000001ACC39BE000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2174166347.000001ACC39AF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A48000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315795906.000001ACC3A49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A45000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273845AC000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/analyseplugin/files/binaries/v01.13-R49/AnalysePlugin-v01.13-R49-x6
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/analyseplugin~
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/autocodepage
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A47000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A48000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315795906.000001ACC3A49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/autocodepage/files/v1.2.6/plugin/x64/AutoCodepage_v1.2.6_x64.zip
Source: notepad++.exe, 00000009.00000002.2315754447.000001ACC3A34000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/autocodepage/files/v1.2.6/plugin/x64/AutoCodepage_v1.2.6_x64.zip-10
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/autocodepage0
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384651000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/autoeolformat
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A47000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315754447.000001ACC3A34000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A48000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315795906.000001ACC3A49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A45000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/autoeolformat/files/v1.0.4/plugin/x64/AutoEolFormat_v1.0.4_x64.zip
Source: notepad++.exe, 00000009.00000003.2182501875.000001ACC3A47000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A48000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315795906.000001ACC3A49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/autoeolformat/files/v1.0.4/plugin/x64/AutoEolFormat_v1.0.4_x64.zipg
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/autoeolformatH
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/customlinenumbers
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/customlinenumbers/files/v1.1.9/plugin/x64/CustomLineNumbers_v1.1.9_
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/customlinenumbers300b4c0e8189
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/extsettings
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182879569.000001ACC3B49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/extsettings/files/v1.3.1/plugin/x64/ExtSettings_v1.3.1_x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/gedcomlexer/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273845AC000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/gedcomlexer/files/GedcomLexer-0.5.0-r170/GedcomLexer-0.5.0-r170-x64
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/imgtag/
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/imgtag/_x64.zipU
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/jsminnpp/files/Uni/JSToolNPP.1.2312.0.uni.64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A47000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A48000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315795906.000001ACC3A49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A45000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481893248.000002738469F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846A2000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/kered13-notepad-plugins/
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/kered13-notepad-plugins/E25
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A47000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A48000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315795906.000001ACC3A49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A45000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/kered13-notepad-plugins/files/Comment%20Wrap%20x64%20v1.0.0.7.zip
Source: notepad++.exe, 00000009.00000003.2182501875.000001ACC3A47000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A48000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315795906.000001ACC3A49000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/kered13-notepad-plugins/files/Comment%20Wrap%20x64%20v1.0.0.7.zip7
Source: notepad++.exe, 00000009.00000002.2315754447.000001ACC3A34000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/kered13-notepad-plugins/files/Comment%20Wrap%20x64%20v1.0.0.7.ziper
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.000002738455B000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/kered13-notepad-plugins/files/Python%20Indent%20x64%20v1.0.0.5.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/locationnav/
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/locationnav/C
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/locationnav/files/LocationNavigate_v0.4.8.1_x64.zip
Source: notepad++.exe, 00000009.00000003.2182501875.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/locationnav/files/LocationNavigate_v0.4.8.1_x64.zipU/z
Source: notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/locationnav/files/LocationNavigate_v0.4.8.1_x64.zipV
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/locationnav/files/LocationNavigate_v0.4.8.1_x64.zipt
Source: notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/locationnav/files/NewFileBrowser_v0.1.5_x64.zip
Source: notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/locationnav/files/NewFileBrowser_v0.1.5_x64.zipZ
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481893248.000002738469F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846A2000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/notepad-visualstudiolinecopy/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273845AC000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.0000027384696000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/notepad-visualstudiolinecopy/files/VisualStudioLineCopy%20x64%20v1.
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/npp-customize
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A5E000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2963626685.0000027384302000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/npp-customize/files/Customize%20Toolbar%20v5.3/CustomizeToolbar_5_3
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481893248.000002738469F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846A2000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/npp-plugins/files/NppDocShare/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/nppactivexplugin/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182501875.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2190559044.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179624036.000001ACC3A85000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273845AC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/nppactivexplugin/files/bin/ActiveX_x64_1_1_8_7.zip
Source: notepad++.exe, 00000009.00000002.2315700068.000001ACC3A02000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/nppactivexplugin/files/bin/ActiveX_x64_1_1_8_7.zip)
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/nppjumplist/
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/nppjumplist/:
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2313894105.000001ACC1819000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/nppmenusearch/files/v0.9.6/NppMenuSearch_v0.9.6_x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/nppmusicplayer
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/tagleet/
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/tagleet/4.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2182960138.000001ACC3C36000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181972948.000001ACC3C2E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317254649.000001ACC3C37000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/tagleet/files/v1.3.2/TagLEET_1.3.2.0.x64.zip
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vk.com/wall203102356_293
Source: notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vk.com/wall203102356_293m
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316439104.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wakatime.com
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.fesevur.com/nppsnippets
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2183719114.000001ACC3B7C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3B96000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2162879790.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028411660.000001ACC3BD4000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316786683.000001ACC3B7D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481893248.000002738469F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.fesevur.com/npptags
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.fesevur.com/selectquotedtext
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.fesevur.com/selectquotedtextD
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2033206449.000000000019A000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: https://www.gnu.org/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039128456.00000000027BD000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000000.2016361940.00007FF6E9C96000.00000002.00000001.01000000.0000000E.sdmp, notepad++.exe, 00000009.00000002.2319288862.00007FF6E9C96000.00000002.00000001.01000000.0000000E.sdmp, notepad++.exe, 0000000B.00000000.2022748994.00007FF6E9C96000.00000002.00000001.01000000.0000000E.sdmp, notepad++.exe, 0000000B.00000002.2050782359.00007FF6E9C96000.00000002.00000001.01000000.0000000E.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000003.2274660356.000000000079E000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499646834.0000000002784000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2497171401.000000000019A000.00000004.00000010.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000000.2476917701.00007FF6E5C4B000.00000002.00000001.01000000.0000000E.sdmp, notepad++.exe, 0000001C.00000002.2971138093.00007FF6E5C4B000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://www.gnu.org/licenses/
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000003.1820529024.0000000000703000.00000004.00000020.00020000.00000000.sdmp, npp.8.6.7.Installer.x64.exe, 00000000.00000003.1819486469.00000000006F3000.00000004.00000020.00020000.00000000.sdmp, npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039128456.00000000027BD000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000003.2274660356.000000000079E000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499646834.0000000002784000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gnu.org/licenses/why-not-lgpl.html
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000000.2016550409.00007FF6E9DFA000.00000002.00000001.01000000.0000000E.sdmp, notepad++.exe, 0000000B.00000002.2051541219.00007FF6E9DFA000.00000002.00000001.01000000.0000000E.sdmp, notepad++.exe, 0000001C.00000000.2477077881.00007FF6E5D62000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://www.google.com/search?q=$(CURRENT_WORD)
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964863640.0000027384534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.incrediblejunior.com/npp_plugins/
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.incrediblejunior.com/npp_plugins/(5y
Source: notepad++.exe, 00000009.00000003.2169198044.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3BA7000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180015578.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316826565.000001ACC3BA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.incrediblejunior.com/npp_plugins/;
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.orizens.com
Source: notepad++.exe, 00000009.00000003.2178986676.000001ACC36E3000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2314603190.000001ACC36E8000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179198025.000001ACC3704000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180738485.000001ACC36E8000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2044823919.0000021B95A3E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2042725815.0000021B95A31000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2044598331.0000021B95A3A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2043402615.0000021B95A36000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000002.2049858799.0000021B95A58000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2043540267.0000021B95A4E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000002.2049706542.0000021B95A3F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2044795186.0000021B95A56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000000B.00000003.2045891135.0000021B95A3F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2962898421.0000027384000000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2963626685.0000027384302000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001D.00000003.2505551659.0000025E0EEFD000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001D.00000003.2506615324.0000025E0EEFD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.php.net/$(CURRENT_WORD)
Source: notepad++.exe, 00000009.00000003.2178986676.000001ACC36E3000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2314603190.000001ACC36E8000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180738485.000001ACC36E8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.php.net/$(CURRENT_WORD)0
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317099334.000001ACC3BF5000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481928451.00000273846D9000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.seelisoft.net/Linefilter3/
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.seelisoft.net/Linefilter3/$5m
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481893248.000002738469F000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846A2000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481815436.0000027384696000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.seelisoft.net/Linefilter3/Linefilter3_x64.zip
Source: notepad++.exe, 00000009.00000003.2028539773.000001ACC3B86000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.seelisoft.net/Linefilter3/Linefilter3_x64.zip7
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2183719114.000001ACC3B7C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028163165.000001ACC3B96000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2162879790.000001ACC3B79000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028324897.000001ACC3B6C000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2028411660.000001ACC3BD4000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316786683.000001ACC3B7D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169091363.000001ACC3BE3000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2316978854.000001ACC3BE3000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000002.2964947782.00000273846BF000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 0000001C.00000003.2481707705.00000273846A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.sqlinform.com
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000002.2317143871.000001ACC3C12000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2163450175.000001ACC3B43000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2180899116.000001ACC3B5E000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2179261831.000001ACC3B56000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2181045311.000001ACC3C0D000.00000004.00000020.00020000.00000000.sdmp, notepad++.exe, 00000009.00000003.2169198044.000001ACC3B52000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.sqlinform.com/npp/SQLinFormNpp64_6.24.04.zip
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown HTTPS traffic detected: 84.32.84.219:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49748 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Code function: 0_2_00405846 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_00405846
Contains functionality to modify clipboard data
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB31FE0 SendDlgItemMessageW,SendDlgItemMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalAlloc,GlobalLock,GlobalUnlock,RegisterClipboardFormatW,SetClipboardData,CloseClipboard, 28_2_00007FFE0EB31FE0
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE11502A30 GlobalLock,WriteFile,MessageBoxW,GlobalUnlock,GlobalFree,SetClipboardData,GlobalFree,MessageBoxW, 28_2_00007FFE11502A30
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE11502900 GlobalLock,WriteFile,MessageBoxW,GlobalUnlock,GlobalFree,SetClipboardData,GlobalFree,MessageBoxW, 28_2_00007FFE11502900
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE11502B60 GlobalLock,WriteFile,MessageBoxW,GlobalUnlock,GlobalFree,SetClipboardData,GlobalFree,MessageBoxW, 28_2_00007FFE11502B60
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004BF3B0 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext, 10_2_00007FFE004BF3B0

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 17.2.npp.8.7.Installer.x64.exe.28ea1cb.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects SystemBC Author: ditekSHen
Source: 17.2.npp.8.7.Installer.x64.exe.288d26f.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects SystemBC Author: ditekSHen
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Code function: 0_2_00403645 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,CoUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403645
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Code function: 14_2_00403645 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 14_2_00403645
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Code function: 17_2_00403645 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,CoUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 17_2_00403645
Detected potential crypto function
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Code function: 0_2_00406DA0 0_2_00406DA0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4D7060 10_2_00007FF73E4D7060
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E54ED78 10_2_00007FF73E54ED78
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E504E6A 10_2_00007FF73E504E6A
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E515BCC 10_2_00007FF73E515BCC
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E5409B8 10_2_00007FF73E5409B8
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4CCA70 10_2_00007FF73E4CCA70
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4CE720 10_2_00007FF73E4CE720
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E516874 10_2_00007FF73E516874
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4CF570 10_2_00007FF73E4CF570
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4CD380 10_2_00007FF73E4CD380
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E501F1A 10_2_00007FF73E501F1A
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E509014 10_2_00007FF73E509014
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E531FD0 10_2_00007FF73E531FD0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4FEFD0 10_2_00007FF73E4FEFD0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E531080 10_2_00007FF73E531080
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4F0060 10_2_00007FF73E4F0060
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4FD090 10_2_00007FF73E4FD090
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4E50AB 10_2_00007FF73E4E50AB
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E543D94 10_2_00007FF73E543D94
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4C7D30 10_2_00007FF73E4C7D30
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4CADE0 10_2_00007FF73E4CADE0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E537E10 10_2_00007FF73E537E10
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E509DD4 10_2_00007FF73E509DD4
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E52FD9C 10_2_00007FF73E52FD9C
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E517E2C 10_2_00007FF73E517E2C
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4D8F10 10_2_00007FF73E4D8F10
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E535EE0 10_2_00007FF73E535EE0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4EDB70 10_2_00007FF73E4EDB70
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E513B48 10_2_00007FF73E513B48
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E523BCB 10_2_00007FF73E523BCB
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E52FB98 10_2_00007FF73E52FB98
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E531B98 10_2_00007FF73E531B98
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E50CC24 10_2_00007FF73E50CC24
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4E1C40 10_2_00007FF73E4E1C40
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E530CFC 10_2_00007FF73E530CFC
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4EFCB0 10_2_00007FF73E4EFCB0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E522984 10_2_00007FF73E522984
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E52F98C 10_2_00007FF73E52F98C
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4F695E 10_2_00007FF73E4F695E
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E512958 10_2_00007FF73E512958
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E530964 10_2_00007FF73E530964
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E51D938 10_2_00007FF73E51D938
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E5359D4 10_2_00007FF73E5359D4
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4E89C0 10_2_00007FF73E4E89C0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E519A50 10_2_00007FF73E519A50
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E51EA28 10_2_00007FF73E51EA28
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4F0AE0 10_2_00007FF73E4F0AE0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4E4763 10_2_00007FF73E4E4763
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E52F788 10_2_00007FF73E52F788
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E547774 10_2_00007FF73E547774
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4F0740 10_2_00007FF73E4F0740
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4FC880 10_2_00007FF73E4FC880
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E51A830 10_2_00007FF73E51A830
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E543900 10_2_00007FF73E543900
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4F58E0 10_2_00007FF73E4F58E0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4E1910 10_2_00007FF73E4E1910
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4E48FC 10_2_00007FF73E4E48FC
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E54D89C 10_2_00007FF73E54D89C
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4C9570 10_2_00007FF73E4C9570
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E52F57C 10_2_00007FF73E52F57C
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4E9570 10_2_00007FF73E4E9570
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4DF610 10_2_00007FF73E4DF610
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E5095EC 10_2_00007FF73E5095EC
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4EC600 10_2_00007FF73E4EC600
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E5015D4 10_2_00007FF73E5015D4
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4F3690 10_2_00007FF73E4F3690
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E5176F8 10_2_00007FF73E5176F8
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E53D708 10_2_00007FF73E53D708
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E54E6DC 10_2_00007FF73E54E6DC
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E50D698 10_2_00007FF73E50D698
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4EB6D0 10_2_00007FF73E4EB6D0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E51F6AC 10_2_00007FF73E51F6AC
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E54F37C 10_2_00007FF73E54F37C
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E52F378 10_2_00007FF73E52F378
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E506394 10_2_00007FF73E506394
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E524360 10_2_00007FF73E524360
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4F5380 10_2_00007FF73E4F5380
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E5033E8 10_2_00007FF73E5033E8
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E544414 10_2_00007FF73E544414
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E53B3D4 10_2_00007FF73E53B3D4
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E5323D4 10_2_00007FF73E5323D4
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4F23D0 10_2_00007FF73E4F23D0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4EA420 10_2_00007FF73E4EA420
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E5474F8 10_2_00007FF73E5474F8
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E50B4FC 10_2_00007FF73E50B4FC
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4DE4B0 10_2_00007FF73E4DE4B0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E54017C 10_2_00007FF73E54017C
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4F0170 10_2_00007FF73E4F0170
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E526160 10_2_00007FF73E526160
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E53F140 10_2_00007FF73E53F140
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E53C288 10_2_00007FF73E53C288
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4E6260 10_2_00007FF73E4E6260
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4C1230 10_2_00007FF73E4C1230
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E5252D8 10_2_00007FF73E5252D8
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E5092EC 10_2_00007FF73E5092EC
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004E49F0 10_2_00007FFE004E49F0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004F6CB0 10_2_00007FFE004F6CB0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004FEDB0 10_2_00007FFE004FEDB0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE00508E50 10_2_00007FFE00508E50
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004B73F0 10_2_00007FFE004B73F0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004E3A9A 10_2_00007FFE004E3A9A
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004CFAD0 10_2_00007FFE004CFAD0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE00507D76 10_2_00007FFE00507D76
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE0052207C 10_2_00007FFE0052207C
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE00532058 10_2_00007FFE00532058
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE0052C1F8 10_2_00007FFE0052C1F8
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE0051E258 10_2_00007FFE0051E258
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004DC2E0 10_2_00007FFE004DC2E0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004E6580 10_2_00007FFE004E6580
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004BE5E0 10_2_00007FFE004BE5E0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004D2680 10_2_00007FFE004D2680
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE0051875C 10_2_00007FFE0051875C
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE0052C8A8 10_2_00007FFE0052C8A8
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE0051E918 10_2_00007FFE0051E918
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE0051ABA0 10_2_00007FFE0051ABA0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE00504BC0 10_2_00007FFE00504BC0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE00518C68 10_2_00007FFE00518C68
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE0052CD3C 10_2_00007FFE0052CD3C
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE00500D70 10_2_00007FFE00500D70
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004F6F30 10_2_00007FFE004F6F30
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE00534F68 10_2_00007FFE00534F68
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004FB000 10_2_00007FFE004FB000
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004C9020 10_2_00007FFE004C9020
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE00521128 10_2_00007FFE00521128
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE0052B1BC 10_2_00007FFE0052B1BC
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE0051B1E8 10_2_00007FFE0051B1E8
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004E9250 10_2_00007FFE004E9250
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE0052132C 10_2_00007FFE0052132C
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE0052D3BC 10_2_00007FFE0052D3BC
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004BF3B0 10_2_00007FFE004BF3B0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE00521530 10_2_00007FFE00521530
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE00531870 10_2_00007FFE00531870
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004FF9E0 10_2_00007FFE004FF9E0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004BBA80 10_2_00007FFE004BBA80
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE00531AEC 10_2_00007FFE00531AEC
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE00521B74 10_2_00007FFE00521B74
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004E5C00 10_2_00007FFE004E5C00
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004DFD60 10_2_00007FFE004DFD60
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE0052DE00 10_2_00007FFE0052DE00
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004F3EF0 10_2_00007FFE004F3EF0
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Code function: 14_2_00406DA0 14_2_00406DA0
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Code function: 17_2_00406DA0 17_2_00406DA0
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB4AF14 28_2_00007FFE0EB4AF14
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB3D6DC 28_2_00007FFE0EB3D6DC
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB3BE90 28_2_00007FFE0EB3BE90
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB336A0 28_2_00007FFE0EB336A0
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB41FFC 28_2_00007FFE0EB41FFC
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB47F50 28_2_00007FFE0EB47F50
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB3BC8C 28_2_00007FFE0EB3BC8C
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB42490 28_2_00007FFE0EB42490
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB31C50 28_2_00007FFE0EB31C50
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB4B460 28_2_00007FFE0EB4B460
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB455D4 28_2_00007FFE0EB455D4
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB3CD4C 28_2_00007FFE0EB3CD4C
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB42B10 28_2_00007FFE0EB42B10
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB3DAE0 28_2_00007FFE0EB3DAE0
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB3BA80 28_2_00007FFE0EB3BA80
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB3C2A0 28_2_00007FFE0EB3C2A0
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB483EC 28_2_00007FFE0EB483EC
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB408FC 28_2_00007FFE0EB408FC
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB3C09C 28_2_00007FFE0EB3C09C
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB3B87C 28_2_00007FFE0EB3B87C
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB4E1C8 28_2_00007FFE0EB4E1C8
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB319A0 28_2_00007FFE0EB319A0
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE1150B944 28_2_00007FFE1150B944
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE11507A18 28_2_00007FFE11507A18
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE1150AE14 28_2_00007FFE1150AE14
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE115154B8 28_2_00007FFE115154B8
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE1150FF8C 28_2_00007FFE1150FF8C
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE11507C00 28_2_00007FFE11507C00
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE11507830 28_2_00007FFE11507830
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE115087C0 28_2_00007FFE115087C0
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE115082B8 28_2_00007FFE115082B8
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE11502250 28_2_00007FFE11502250
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE1150D270 28_2_00007FFE1150D270
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE1150FB00 28_2_00007FFE1150FB00
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE1150B2C4 28_2_00007FFE1150B2C4
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE1A511680 28_2_00007FFE1A511680
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE1A511A70 28_2_00007FFE1A511A70
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE1A523718 28_2_00007FFE1A523718
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE1A511AC0 28_2_00007FFE1A511AC0
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE1A511AD0 28_2_00007FFE1A511AD0
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE1A512FB0 28_2_00007FFE1A512FB0
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE1A511810 28_2_00007FFE1A511810
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE1A511CB0 28_2_00007FFE1A511CB0
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE1A5114F0 28_2_00007FFE1A5114F0
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE1A51D184 28_2_00007FFE1A51D184
Found potential string decryption / allocating functions
Source: C:\Program Files\Notepad++\notepad++.exe Code function: String function: 00007FFE0EB321E0 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Code function: String function: 00402DAB appears 50 times
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: String function: 00007FFE004C0A10 appears 332 times
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: String function: 00007FFE004C0AB0 appears 49 times
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: String function: 00007FFE004DF210 appears 34 times
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: String function: 00007FFE0051F720 appears 47 times
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: String function: 00007FFE004FABB0 appears 35 times
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: String function: 00007FFE004F5250 appears 37 times
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: String function: 00007FFE004C0920 appears 443 times
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: String function: 00007FFE004EC010 appears 48 times
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: String function: 00007FFE004F52C0 appears 78 times
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: String function: 00007FFE004DF160 appears 54 times
One or more processes crash
Source: C:\Program Files\Notepad++\notepad++.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6976 -s 1252
Sample file is different than original file name gathered from version info
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameNppExport.dll4 vs npp.8.6.7.Installer.x64.exe
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamebase64.dll4 vs npp.8.6.7.Installer.x64.exe
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameNppConverter.dll< vs npp.8.6.7.Installer.x64.exe
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamegup.exeJ vs npp.8.6.7.Installer.x64.exe
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibcurl.dllB vs npp.8.6.7.Installer.x64.exe
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamenppPluginList.dllT vs npp.8.6.7.Installer.x64.exe
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameNppShell.dll4 vs npp.8.6.7.Installer.x64.exe
Uses 32bit PE files
Source: npp.8.6.7.Installer.x64.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Yara signature match
Source: 17.2.npp.8.7.Installer.x64.exe.28ea1cb.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_EXEPWSH_DLAgent author = ditekSHen, description = Detects SystemBC
Source: 17.2.npp.8.7.Installer.x64.exe.288d26f.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_EXEPWSH_DLAgent author = ditekSHen, description = Detects SystemBC
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: * Step 2: Open [`vcproj\GUP.sln`](https://github.com/gup4win/wingup/blob/master/vcproj/GUP.sln) with VS2022.
Source: classification engine Classification label: sus26.evad.winEXE@33/380@3/4
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Code function: 0_2_00403645 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,CoUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403645
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Code function: 14_2_00403645 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 14_2_00403645
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Code function: 17_2_00403645 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,CoUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 17_2_00403645
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Code function: 0_2_00404AF2 GetDlgItem,SetWindowTextW,SHAutoComplete,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceExW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 0_2_00404AF2
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Code function: 0_2_004021AF CoCreateInstance, 0_2_004021AF
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB32380 FindResourceW,LoadResource,LockResource,SizeofResource,GlobalAlloc,GlobalLock,CreateDialogIndirectParamW,GlobalFree,CreateDialogParamW,GetLastError,MessageBoxA,SendMessageW, 28_2_00007FFE0EB32380
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe File created: C:\Program Files\Notepad++ Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe File created: C:\Users\user\AppData\Roaming\Notepad++ Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Mutant created: \Sessions\1\BaseNamedObjects\nppInstance
Source: C:\Windows\System32\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6976
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe File created: C:\Users\user\AppData\Local\Temp\nsgCB92.tmp Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Process created: C:\Windows\explorer.exe
Source: unknown Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Process created: C:\Windows\explorer.exe
Source: unknown Process created: C:\Windows\explorer.exe
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Process created: C:\Windows\explorer.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Process created: C:\Windows\explorer.exe
Source: npp.8.6.7.Installer.x64.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Program Files\Notepad++\contextmenu\NppShell.dll",CleanupDll
Source: GUP.exe String found in binary or memory: --help
Source: GUP.exe String found in binary or memory: --help
Source: GUP.exe String found in binary or memory: Usage : gup --help gup -options gup [-verbose] [-vVERSION_VALUE] [-pCUSTOM_PARAM] gup -clean FOLDER_TO_ACTION gup -unzipTo [-clea
Source: GUP.exe String found in binary or memory: Usage : gup --help gup -options gup [-verbose] [-vVERSION_VALUE] [-pCUSTOM_PARAM] gup -clean FOLDER_TO_ACTION gup -unzipTo [-clea
Source: GUP.exe String found in binary or memory: Usage :gup --helpgup -optionsgup [-verbose] [-vVERSION_VALUE] [-pCUSTOM_PARAM]gup -clean FOLDER_TO_ACTIONgup -unzipTo [-clea
Source: GUP.exe String found in binary or memory: Usage :gup --helpgup -optionsgup [-verbose] [-vVERSION_VALUE] [-pCUSTOM_PARAM]gup -clean FOLDER_TO_ACTIONgup -unzipTo [-clea
Source: notepad++.exe String found in binary or memory: <!--StartFragment-->
Source: notepad++.exe String found in binary or memory: <!--StartFragment-->
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe File read: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe "C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe"
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 /s "C:\Program Files\Notepad++\contextMenu\NppShell.dll"
Source: C:\Windows\SysWOW64\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe /s "C:\Program Files\Notepad++\contextMenu\NppShell.dll"
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe" "C:\Program Files\Notepad++\notepad++.exe"
Source: unknown Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: C:\Windows\explorer.exe Process created: C:\Program Files\Notepad++\notepad++.exe "C:\Program Files\Notepad++\notepad++.exe"
Source: C:\Program Files\Notepad++\notepad++.exe Process created: C:\Program Files\Notepad++\updater\GUP.exe "C:\Program Files\Notepad++\updater\gup.exe" -v8.67 -px64
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Process created: C:\Program Files\Notepad++\notepad++.exe "C:\Program Files\Notepad++\notepad++.exe" "C:\Program Files\Notepad++\change.log"
Source: C:\Program Files\Notepad++\updater\GUP.exe Process created: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe "C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe"
Source: C:\Program Files\Notepad++\updater\GUP.exe Process created: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe "C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe"
Source: C:\Program Files\Notepad++\notepad++.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6976 -s 1252
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Program Files\Notepad++\contextmenu\NppShell.dll",CleanupDll
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Program Files\Notepad++\contextmenu\NppShell.dll",CleanupDll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 /s "C:\Program Files\Notepad++\contextMenu\NppShell.dll"
Source: C:\Windows\SysWOW64\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe /s "C:\Program Files\Notepad++\contextMenu\NppShell.dll"
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe" "C:\Program Files\Notepad++\notepad++.exe"
Source: unknown Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: C:\Windows\explorer.exe Process created: C:\Program Files\Notepad++\notepad++.exe "C:\Program Files\Notepad++\notepad++.exe"
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Process created: C:\Program Files\Notepad++\notepad++.exe "C:\Program Files\Notepad++\notepad++.exe" "C:\Program Files\Notepad++\change.log"
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 /s "C:\Program Files\Notepad++\contextMenu\NppShell.dll" Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe" "C:\Program Files\Notepad++\notepad++.exe" Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Process created: C:\Program Files\Notepad++\notepad++.exe "C:\Program Files\Notepad++\notepad++.exe" "C:\Program Files\Notepad++\change.log" Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe /s "C:\Program Files\Notepad++\contextMenu\NppShell.dll" Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Program Files\Notepad++\notepad++.exe "C:\Program Files\Notepad++\notepad++.exe" Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Process created: C:\Program Files\Notepad++\updater\GUP.exe "C:\Program Files\Notepad++\updater\gup.exe" -v8.67 -px64 Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Process created: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe "C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Program Files\Notepad++\contextmenu\NppShell.dll",CleanupDll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 /s "C:\Program Files\Notepad++\contextMenu\NppShell.dll"
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe" "C:\Program Files\Notepad++\notepad++.exe"
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Process created: C:\Program Files\Notepad++\notepad++.exe "C:\Program Files\Notepad++\notepad++.exe" "C:\Program Files\Notepad++\change.log"
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Program Files\Notepad++\contextmenu\NppShell.dll",CleanupDll
Source: C:\Windows\SysWOW64\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe /s "C:\Program Files\Notepad++\contextMenu\NppShell.dll"
Source: C:\Windows\explorer.exe Process created: C:\Program Files\Notepad++\notepad++.exe "C:\Program Files\Notepad++\notepad++.exe"
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: aepic.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: twinapi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ninput.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: actxprxy.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: aepic.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: twinapi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ninput.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: actxprxy.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: smartscreenps.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: sensapi.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: slc.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: d2d1.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: dxcore.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: libcurl.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: slc.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: apphelp.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: dbghelp.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: version.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: sensapi.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: wininet.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: uxtheme.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: dwmapi.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: msasn1.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: windows.storage.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: wldp.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\regsvr32.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\regsvr32.exe Section loaded: aclayers.dll
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc_os.dll
Source: C:\Windows\System32\regsvr32.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\regsvr32.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\regsvr32.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\regsvr32.exe Section loaded: wldp.dll
Source: C:\Windows\explorer.exe Section loaded: aepic.dll
Source: C:\Windows\explorer.exe Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe Section loaded: userenv.dll
Source: C:\Windows\explorer.exe Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe Section loaded: propsys.dll
Source: C:\Windows\explorer.exe Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe Section loaded: wininet.dll
Source: C:\Windows\explorer.exe Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe Section loaded: wldp.dll
Source: C:\Windows\explorer.exe Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe Section loaded: netutils.dll
Source: C:\Windows\explorer.exe Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe Section loaded: ninput.dll
Source: C:\Windows\explorer.exe Section loaded: explorerframe.dll
Source: C:\Windows\explorer.exe Section loaded: actxprxy.dll
Source: C:\Windows\explorer.exe Section loaded: aepic.dll
Source: C:\Windows\explorer.exe Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe Section loaded: userenv.dll
Source: C:\Windows\explorer.exe Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe Section loaded: propsys.dll
Source: C:\Windows\explorer.exe Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe Section loaded: wininet.dll
Source: C:\Windows\explorer.exe Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe Section loaded: wldp.dll
Source: C:\Windows\explorer.exe Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe Section loaded: netutils.dll
Source: C:\Windows\explorer.exe Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe Section loaded: ninput.dll
Source: C:\Windows\explorer.exe Section loaded: explorerframe.dll
Source: C:\Windows\explorer.exe Section loaded: actxprxy.dll
Source: C:\Windows\explorer.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\explorer.exe Section loaded: edputil.dll
Source: C:\Windows\explorer.exe Section loaded: smartscreenps.dll
Source: C:\Windows\explorer.exe Section loaded: policymanager.dll
Source: C:\Windows\explorer.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\explorer.exe Section loaded: wintypes.dll
Source: C:\Windows\explorer.exe Section loaded: appresolver.dll
Source: C:\Windows\explorer.exe Section loaded: bcp47langs.dll
Source: C:\Windows\explorer.exe Section loaded: slc.dll
Source: C:\Windows\explorer.exe Section loaded: sppc.dll
Source: C:\Windows\explorer.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\explorer.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\explorer.exe Section loaded: apphelp.dll
Source: C:\Windows\explorer.exe Section loaded: pcacli.dll
Source: C:\Windows\explorer.exe Section loaded: mpr.dll
Source: C:\Windows\explorer.exe Section loaded: sfc_os.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: apphelp.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: dbghelp.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: version.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: sensapi.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: wininet.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: uxtheme.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: dwmapi.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: msasn1.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: windows.storage.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: wldp.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: cryptsp.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: rsaenh.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: cryptbase.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: textshaping.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: dataexchange.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: d3d11.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: dcomp.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: dxgi.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: twinapi.appcore.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: d2d1.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: dwrite.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: iconcodecservice.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: windowscodecs.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: textinputframework.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: coreuicomponents.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: coremessaging.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: ntmarta.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: wintypes.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: wintypes.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: wintypes.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: iertutil.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: propsys.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: resourcepolicyclient.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: d3d10warp.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: dxcore.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: apphelp.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: dbghelp.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: version.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: sensapi.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: wininet.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: uxtheme.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: dwmapi.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: msasn1.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: windows.storage.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: wldp.dll
Source: C:\Program Files\Notepad++\notepad++.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: Notepad++.lnk.0.dr LNK file: ..\..\..\..\..\Program Files\Notepad++\notepad++.exe
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe File written: C:\Users\user\AppData\Local\Temp\nsgCBE2.tmp\ioSpecial.ini Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Window found: window name: SysTabControl32 Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Automated click: OK
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Automated click: Next >
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Automated click: I Agree
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Automated click: Next >
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Automated click: Next >
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Automated click: I Agree
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Automated click: Install
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Window detected: < &BackI &AgreeCancelThe best things in life are free. Notepad++ is free so Notepad++ is the best The best things in life are free. Notepad++ is free so Notepad++ is the bestLicense AgreementPlease review the license terms before installing Notepad++ v8.6.7.Press Page Down to see the rest of the agreement.COPYING -- Describes the terms under which Notepad++ is distributed.A copy of the GNU GPL is appended to this file.IMPORTANT NOTEPAD++ LICENSE TERMSCopyright (C)2021 Don HO <don.h@free.fr>. This program is free software; you may redistribute and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; Version 3 with the clarifications and exceptions described below. This guarantees your right to use modify and redistribute this software under certain conditions.This program is distributed in the hope that it will be useful but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.******************************************************************GNU GENERAL PUBLIC LICENSEVersion 3 29 June 2007Copyright (C) 2007 Free Software Foundation Inc. <https://fsf.org/>Everyone is permitted to copy and distribute verbatim copies of this license document but changing it is not allowed.PreambleThe GNU General Public License is a free copyleft license for software and other kinds of works.The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast the GNU General Public License is intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users. We the Free Software Foundation use the GNU General Public License for most of our software; it applies also to any other work released this way by its authors. You can apply it to your programs too.When we speak of free software we are referring to freedom not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish) that you receive source code or can get it if you want it that you can change the software or use pieces of it in new free programs and that you know you can do these things.To protect your rights we need to prevent others from denying you these rights or asking you to surrender the rights. Therefore you have certain responsibilities if you distribute copies of the software or if you modify it: responsibilities to respect the freedom of others.For example if you distribute copies of such a program whether gratis or for a fee you must pass on to the recipients the same freedoms that you received. You must make sure that they too receive or can get the source code. And you must show them these terms so they know their rights.Developers that use the GNU GPL protect your rights with two steps: (1) as
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Window detected: < &BackI &AgreeCancelThe best things in life are free. Notepad++ is free so Notepad++ is the best The best things in life are free. Notepad++ is free so Notepad++ is the bestLicense AgreementPlease review the license terms before installing Notepad++ v8.7.Press Page Down to see the rest of the agreement.COPYING -- Describes the terms under which Notepad++ is distributed.A copy of the GNU GPL is appended to this file.IMPORTANT NOTEPAD++ LICENSE TERMSCopyright (C)2021 Don HO <don.h@free.fr>. This program is free software; you may redistribute and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; Version 3 with the clarifications and exceptions described below. This guarantees your right to use modify and redistribute this software under certain conditions.This program is distributed in the hope that it will be useful but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.******************************************************************GNU GENERAL PUBLIC LICENSEVersion 3 29 June 2007Copyright (C) 2007 Free Software Foundation Inc. <https://fsf.org/>Everyone is permitted to copy and distribute verbatim copies of this license document but changing it is not allowed.PreambleThe GNU General Public License is a free copyleft license for software and other kinds of works.The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast the GNU General Public License is intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users. We the Free Software Foundation use the GNU General Public License for most of our software; it applies also to any other work released this way by its authors. You can apply it to your programs too.When we speak of free software we are referring to freedom not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish) that you receive source code or can get it if you want it that you can change the software or use pieces of it in new free programs and that you know you can do these things.To protect your rights we need to prevent others from denying you these rights or asking you to surrender the rights. Therefore you have certain responsibilities if you distribute copies of the software or if you modify it: responsibilities to respect the freedom of others.For example if you distribute copies of such a program whether gratis or for a fee you must pass on to the recipients the same freedoms that you received. You must make sure that they too receive or can get the source code. And you must show them these terms so they know their rights.Developers that use the GNU GPL protect your rights with two steps: (1) asse
Source: C:\Program Files\Notepad++\notepad++.exe Window detected: Number of UI elements: 11
Source: C:\Program Files\Notepad++\notepad++.exe Window detected: Number of UI elements: 11
Source: C:\Program Files\Notepad++\notepad++.exe Window detected: Number of UI elements: 11
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++ Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\c.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\cpp.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\java.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\cs.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\html.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\rc.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\sql.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\php.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\css.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\vb.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\perl.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\javascript.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\python.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\actionscript.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\lisp.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\vhdl.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\tex.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\xml.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\nsis.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\cmake.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\batch.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\coffee.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\BaanC.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\lua.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\autoit.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\cobol.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\typescript.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\powershell.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\gdscript.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\go.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\autoCompletion\raku.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\c.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\cpp.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\java.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\cs.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\asm.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\bash.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\sql.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\php.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\cobol-free.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\cobol.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\perl.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\javascript.js.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\python.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\lua.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\ini.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\inno.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\vhdl.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\krl.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\nsis.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\powershell.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\batch.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\ruby.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\baanc.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\sinumerik.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\autoit.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\universe_basic.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\xml.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\ada.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\fortran.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\fortran77.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\haskell.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\rust.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\typescript.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\pascal.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\gdscript.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\raku.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\hollywood.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\nppexec.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\overrideMap.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\plugins Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\plugins\NppExport Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\plugins\mimeTools Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\plugins\mimeTools\mimeTools.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\plugins\NppConverter Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\updater Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\updater\GUP.exe Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\updater\libcurl.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\updater\gup.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\updater\LICENSE Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\updater\README.md Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\updater\updater.ico Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\plugins\Config Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\langs.model.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\stylers.model.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\contextMenu.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\shortcuts.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\nppLogNulContentCorruptionIssue.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\LICENSE Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\change.log Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\readme.txt Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\notepad++.exe Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\localization Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\localization\english.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\plugins\disabled Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\DarkModeDefault.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Black board.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Choco.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Hello Kitty.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Mono Industrial.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Monokai.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Obsidian.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Plastic Code Wrap.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Ruby Blue.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Twilight.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Vibrant Ink.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Deep Black.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\vim Dark Blue.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Bespin.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Zenburn.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Solarized.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Solarized-light.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\HotFudgeSundae.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\khaki.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\MossyLawn.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\Navajo.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\themes\DansLeRuSH-Dark.xml Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\contextMenu Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\contextMenu\NppShell.msix Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\contextMenu\NppShell.dll Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\uninstall.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\toml.xml
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\tex.xml
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\functionList\latex.xml
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\plugins\mimeTools\mimeTools.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Directory created: C:\Program Files\Notepad++\contextMenu\NppShell.dll
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Notepad++ Jump to behavior
Source: npp.8.6.7.Installer.x64.exe Static PE information: certificate valid
Source: npp.8.6.7.Installer.x64.exe Static file information: File size 4854296 > 1048576
Source: npp.8.6.7.Installer.x64.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\sources\nppShell\x64\Release\NppShell.x64.pdb3 source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\sources\nppShell\x64\Release\NppShell.x64.pdb source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\sources\nppPluginList\bin64\nppPluginList.pdb source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp, npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp
Contains functionality to dynamically determine API calls
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004F6CB0 WSAStartup,WSACleanup,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,GetSystemDirectoryA,LoadLibraryA,GetProcAddress,QueryPerformanceFrequency, 10_2_00007FFE004F6CB0
PE file contains sections with non-standard names
Source: NppExport.dll.0.dr Static PE information: section name: _RDATA
Source: mimeTools.dll.0.dr Static PE information: section name: _RDATA
Source: NppConverter.dll.0.dr Static PE information: section name: _RDATA
Source: libcurl.dll.0.dr Static PE information: section name: _RDATA
Registers a DLL
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 /s "C:\Program Files\Notepad++\contextMenu\NppShell.dll"
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4E0723 push C0950F00h; ret 10_2_00007FF73E4E0728
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004CC63F push 770001C3h; ret 10_2_00007FFE004CC649
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe File created: C:\Users\user\AppData\Local\Temp\nsd82AF.tmp\LangDLL.dll Jump to dropped file
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe File created: C:\Users\user\AppData\Local\Temp\nsgCBE2.tmp\InstallOptions.dll Jump to dropped file
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe File created: C:\Program Files\Notepad++\plugins\mimeTools\mimeTools.dll Jump to dropped file
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe File created: C:\Program Files\Notepad++\notepad++.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe File created: C:\Users\user\AppData\Local\Temp\nsd82AF.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe File created: C:\Users\user\AppData\Local\Temp\nsgCBE2.tmp\UserInfo.dll Jump to dropped file
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe File created: C:\Program Files\Notepad++\updater\libcurl.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe File created: C:\Users\user\AppData\Local\Temp\nsd82AF.tmp\InstallOptions.dll Jump to dropped file
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe File created: C:\Users\user\AppData\Local\Temp\nsgCBE2.tmp\LangDLL.dll Jump to dropped file
Source: C:\Program Files\Notepad++\updater\GUP.exe File created: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Jump to dropped file
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe File created: C:\Users\user\AppData\Local\Temp\nsgCBE2.tmp\nsDialogs.dll Jump to dropped file
Source: C:\Windows\System32\rundll32.exe File created: C:\Users\user\AppData\Local\Temp\temDE2B.tmp (copy) Jump to dropped file
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe File created: C:\Users\user\AppData\Local\Temp\nsgCBE2.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe File created: C:\Program Files\Notepad++\uninstall.exe Jump to dropped file
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe File created: C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll Jump to dropped file
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe File created: C:\Program Files\Notepad++\updater\GUP.exe Jump to dropped file
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe File created: C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe File created: C:\Users\user\AppData\Local\Temp\nsd82AF.tmp\nsDialogs.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe File created: C:\Users\user\AppData\Local\Temp\nsd82AF.tmp\UserInfo.dll Jump to dropped file
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe File created: C:\Program Files\Notepad++\contextMenu\NppShell.dll Jump to dropped file
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe File created: C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll Jump to dropped file
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe File created: C:\Program Files\Notepad++\readme.txt Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Notepad++\notepad++.exe Process information set: NOOPENFILEERRORBOX
Found decision node followed by non-executed suspicious APIs
Source: C:\Program Files\Notepad++\updater\GUP.exe Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd82AF.tmp\LangDLL.dll Jump to dropped file
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgCBE2.tmp\InstallOptions.dll Jump to dropped file
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Dropped PE file which has not been started: C:\Program Files\Notepad++\plugins\mimeTools\mimeTools.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd82AF.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgCBE2.tmp\UserInfo.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd82AF.tmp\InstallOptions.dll Jump to dropped file
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgCBE2.tmp\LangDLL.dll Jump to dropped file
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgCBE2.tmp\nsDialogs.dll Jump to dropped file
Source: C:\Windows\System32\rundll32.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\temDE2B.tmp (copy) Jump to dropped file
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgCBE2.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Dropped PE file which has not been started: C:\Program Files\Notepad++\uninstall.exe Jump to dropped file
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Dropped PE file which has not been started: C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll Jump to dropped file
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Dropped PE file which has not been started: C:\Program Files\Notepad++\updater\GUP.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd82AF.tmp\nsDialogs.dll Jump to dropped file
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Dropped PE file which has not been started: C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd82AF.tmp\UserInfo.dll Jump to dropped file
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Dropped PE file which has not been started: C:\Program Files\Notepad++\contextMenu\NppShell.dll Jump to dropped file
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Dropped PE file which has not been started: C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll Jump to dropped file
Found evasive API chain (date check)
Source: C:\Program Files\Notepad++\updater\GUP.exe Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Found large amount of non-executed APIs
Source: C:\Program Files\Notepad++\notepad++.exe API coverage: 1.3 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Notepad++\notepad++.exe TID: 1712 Thread sleep time: -504000s >= -30000s Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe TID: 5756 Thread sleep time: -2317000s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Program Files\Notepad++\notepad++.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe File Volume queried: C:\Program Files FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe File Volume queried: C:\Program Files FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe File Volume queried: C:\Program Files\Notepad++ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe File Volume queried: C:\Program Files\Notepad++ FullSizeInformation
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Code function: 0_2_00402910 FindFirstFileW, 0_2_00402910
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Code function: 0_2_004069DF FindFirstFileW,FindClose, 0_2_004069DF
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Code function: 0_2_00405D8E CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00405D8E
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE0052DE00 FindFirstFileExW, 10_2_00007FFE0052DE00
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Code function: 14_2_00402910 FindFirstFileW, 14_2_00402910
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Code function: 14_2_004069DF FindFirstFileW,FindClose, 14_2_004069DF
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Code function: 14_2_00405D8E CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 14_2_00405D8E
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Code function: 17_2_00402910 FindFirstFileW, 17_2_00402910
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Code function: 17_2_004069DF FindFirstFileW,FindClose, 17_2_004069DF
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Code function: 17_2_00405D8E CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 17_2_00405D8E
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB455D4 FindFirstFileExW, 28_2_00007FFE0EB455D4
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE1150D270 FindFirstFileExW, 28_2_00007FFE1150D270
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE1A51D184 FindFirstFileExW, 28_2_00007FFE1A51D184
Source: npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <KeyWord name="Get-NetEventVmNetworkAdapter" />
Source: npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <KeyWord name="Remove-NetEventVmNetworkAdapter" />
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <KeyWord name="OMGVMCID" />
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <KeyWord name="VirtualMachineError" />
Source: explorer.exe, 0000001B.00000002.2959986429.0000000000CD5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\*m
Source: npp.8.7.Installer.x64.exe, 00000011.00000002.2499974685.0000000002859000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <KeyWord name="Add-NetEventVmNetworkAdapter" />
Source: npp.8.6.7.Installer.x64.exe, 00000000.00000002.2039340973.000000000288A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <KeyWord name="SUNVMCID" />
Source: GUP.exe, 0000000A.00000002.2176204340.0000024DE5DA6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe API call chain: ExitProcess graph end node

Anti Debugging
barindex
Found API chain indicative of debugger detection
Source: C:\Program Files\Notepad++\updater\GUP.exe Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep
Checks if the current process is being debugged
Source: C:\Program Files\Notepad++\notepad++.exe Process queried: DebugPort Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Process queried: DebugPort Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E50034C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 10_2_00007FF73E50034C
Contains functionality to dynamically determine API calls
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004F6CB0 WSAStartup,WSACleanup,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,GetSystemDirectoryA,LoadLibraryA,GetProcAddress,QueryPerformanceFrequency, 10_2_00007FFE004F6CB0
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE0052F6EC GetProcessHeap, 10_2_00007FFE0052F6EC
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E4FFEA8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 10_2_00007FF73E4FFEA8
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E50052C SetUnhandledExceptionFilter, 10_2_00007FF73E50052C
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E50034C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 10_2_00007FF73E50034C
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E5383EC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 10_2_00007FF73E5383EC
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE005274C4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 10_2_00007FFE005274C4
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE00511570 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 10_2_00007FFE00511570
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE00511FE4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 10_2_00007FFE00511FE4
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB3EFAC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 28_2_00007FFE0EB3EFAC
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB34D0C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 28_2_00007FFE0EB34D0C
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE0EB34130 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 28_2_00007FFE0EB34130
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE1150418C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 28_2_00007FFE1150418C
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE1150A54C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 28_2_00007FFE1150A54C
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE11503918 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 28_2_00007FFE11503918
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE1A514ECC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 28_2_00007FFE1A514ECC
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE1A51A778 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 28_2_00007FFE1A51A778
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 28_2_00007FFE1A514410 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 28_2_00007FFE1A514410
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Notepad++\notepad++.exe Process created: C:\Program Files\Notepad++\updater\GUP.exe "C:\Program Files\Notepad++\updater\gup.exe" -v8.67 -px64 Jump to behavior
Source: C:\Program Files\Notepad++\updater\GUP.exe Process created: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe "C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe" Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE00534DB0 cpuid 10_2_00007FFE00534DB0
Contains functionality to query locales information (e.g. system language)
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: EnumSystemLocalesW, 10_2_00007FF73E54BF98
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: EnumSystemLocalesW, 10_2_00007FF73E54BEC8
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW, 10_2_00007FF73E54BB6C
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: GetLocaleInfoW, 10_2_00007FF73E546970
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 10_2_00007FF73E54C5B4
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: EnumSystemLocalesW, 10_2_00007FF73E5463D8
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: GetLocaleInfoEx, 10_2_00007FF73E5273D0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 10_2_00007FF73E54C3D0
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\Notepad++\notepad++.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\npp.8.7.Installer.x64.exe Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\Notepad++\notepad++.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Program Files\Notepad++\notepad++.exe Code function: 9_2_00007FF6E9C3FAC0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 9_2_00007FF6E9C3FAC0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FF73E547774 _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation, 10_2_00007FF73E547774
Source: C:\Users\user\Desktop\npp.8.6.7.Installer.x64.exe Code function: 0_2_00403645 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,CoUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403645
Source: C:\Program Files\Notepad++\notepad++.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004F25E0 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,WSAGetLastError,closesocket,closesocket,closesocket,closesocket, 10_2_00007FFE004F25E0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004F8D5A bind,WSAGetLastError, 10_2_00007FFE004F8D5A
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004B6DD0 htons,htons,htons,bind,htons,bind,getsockname,WSAGetLastError,WSAGetLastError, 10_2_00007FFE004B6DD0
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004F8F90 bind,WSAGetLastError, 10_2_00007FFE004F8F90
Source: C:\Program Files\Notepad++\updater\GUP.exe Code function: 10_2_00007FFE004C9020 getsockname,WSAGetLastError,WSAGetLastError,htons,bind,WSAGetLastError,getsockname,getsockname,WSAGetLastError,listen,WSAGetLastError,htons, 10_2_00007FFE004C9020
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1531792 Sample: npp.8.6.7.Installer.x64.exe Startdate: 11/10/2024 Architecture: WINDOWS Score: 26 74 objects.githubusercontent.com 2->74 76 notepad-plus-plus.org 2->76 78 github.com 2->78 86 Malicious sample detected (through community Yara rule) 2->86 88 Found API chain indicative of debugger detection 2->88 11 npp.8.6.7.Installer.x64.exe 207 303 2->11         started        14 explorer.exe 2->14         started        16 explorer.exe 2->16         started        signatures3 process4 file5 64 C:\Program Files64otepad++\updaterbehaviorgraphUP.exe, PE32+ 11->64 dropped 66 C:\Users\user\AppData\Local\...\nsDialogs.dll, PE32 11->66 dropped 68 C:\Users\user\AppData\Local\...\UserInfo.dll, PE32 11->68 dropped 70 11 other files (none is malicious) 11->70 dropped 18 regsvr32.exe 11->18         started        20 explorer.exe 1 11->20         started        22 notepad++.exe 11->22         started        24 notepad++.exe 9 14->24         started        26 notepad++.exe 16->26         started        process6 process7 28 regsvr32.exe 7 18->28         started        30 GUP.exe 2 24->30         started        34 WerFault.exe 24->34         started        dnsIp8 80 notepad-plus-plus.org 84.32.84.219, 443, 49739 NTT-LT-ASLT Lithuania 30->80 82 github.com 140.82.121.3, 443, 49745 GITHUBUS United States 30->82 84 2 other IPs or domains 30->84 72 C:\Users\user\...\npp.8.7.Installer.x64.exe, PE32 30->72 dropped 36 npp.8.7.Installer.x64.exe 30->36         started        39 npp.8.7.Installer.x64.exe 30->39         started        file9 process10 file11 56 C:\Users\user\AppData\Local\...\nsDialogs.dll, PE32 36->56 dropped 58 C:\Users\user\AppData\Local\...\UserInfo.dll, PE32 36->58 dropped 60 C:\Users\user\AppData\Local\...\System.dll, PE32 36->60 dropped 62 2 other files (none is malicious) 36->62 dropped 41 rundll32.exe 36->41         started        43 regsvr32.exe 36->43         started        45 explorer.exe 36->45         started        47 notepad++.exe 36->47         started        process12 process13 49 rundll32.exe 41->49         started        52 regsvr32.exe 43->52         started        file14 54 C:\Users\user\AppData\...\temDE2B.tmp (copy), PE32+ 49->54 dropped
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
84.32.84.219
 notepad-plus-plus.org Lithuania
33922 NTT-LT-ASLT false
140.82.121.3
 github.com United States
36459 GITHUBUS false
185.199.110.133
 objects.githubusercontent.com Netherlands
54113 FASTLYUS false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
notepad-plus-plus.org 84.32.84.219 true
github.com 140.82.121.3 true
objects.githubusercontent.com 185.199.110.133 true