Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe] 'Debugger' = '%ProgramFiles%\Notepad++\replacer\Replacer.exe'
- %TEMP%\RarSFX0\Notepad++_7.5.6_Replacer_1.2.exe
- %APPDATA%\Notepad++\themes\is-DUL46.tmp
- %APPDATA%\Notepad++\themes\is-I9U9I.tmp
- %APPDATA%\Notepad++\plugins\config\is-1UI59.tmp
- %APPDATA%\Notepad++\plugins\config\is-1PMRL.tmp
- %ProgramFiles%\Notepad++\plugins\is-P8SO0.tmp
- %ProgramFiles%\Notepad++\plugins\Config\Hunspell\is-I23MT.tmp
- %ProgramFiles%\Notepad++\plugins\Config\Hunspell\is-MOB25.tmp
- %APPDATA%\Notepad++\themes\is-SUI3L.tmp
- %ProgramFiles%\Notepad++\plugins\is-D41SE.tmp
- %ProgramFiles%\Notepad++\plugins\is-0MORL.tmp
- %ProgramFiles%\Notepad++\plugins\is-4G9Q3.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-5M4C7.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-092FN.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-6V6O2.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-A5L0C.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-G5NL9.tmp
- %ProgramFiles%\Notepad++\plugins\is-CDFGO.tmp
- %APPDATA%\Notepad++\themes\is-0FL60.tmp
- %ALLUSERSPROFILE%\Desktop\Notepad++.lnk
- %APPDATA%\Notepad++\themes\is-Q6R83.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Notepad++.lnk
- %APPDATA%\Notepad++\themes\is-E8EKR.tmp
- %APPDATA%\Notepad++\themes\is-FBI1B.tmp
- %APPDATA%\Notepad++\themes\is-U3IA9.tmp
- %APPDATA%\Notepad++\themes\is-7RA9H.tmp
- %APPDATA%\Notepad++\themes\is-74D51.tmp
- %APPDATA%\Notepad++\themes\is-GVGRI.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-FDCA4.tmp
- %APPDATA%\Notepad++\themes\is-SFTDN.tmp
- %APPDATA%\Notepad++\themes\is-MKD7A.tmp
- %APPDATA%\Notepad++\themes\is-D2DSK.tmp
- %APPDATA%\Notepad++\themes\is-0DJ8U.tmp
- %APPDATA%\Notepad++\themes\is-VAVAE.tmp
- %APPDATA%\Notepad++\themes\is-HRK80.tmp
- %APPDATA%\Notepad++\themes\is-QG8JO.tmp
- %APPDATA%\Notepad++\themes\is-ELOI5.tmp
- %APPDATA%\Notepad++\themes\is-8Q147.tmp
- %APPDATA%\Notepad++\themes\is-TQANB.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-TM3GB.tmp
- %ProgramFiles%\Notepad++\is-Q0BOR.tmp
- %APPDATA%\Notepad++\is-9V173.tmp
- %ProgramFiles%\Notepad++\localization\is-H1DHN.tmp
- %ProgramFiles%\Notepad++\replacer\is-0P9MG.tmp
- %ProgramFiles%\Notepad++\is-419T4.tmp
- %ProgramFiles%\Notepad++\is-5G24M.tmp
- %ProgramFiles%\Notepad++\is-CIGK8.tmp
- %ProgramFiles%\Notepad++\is-GNL4D.tmp
- %APPDATA%\Notepad++\is-EHDK6.tmp
- %ProgramFiles%\Notepad++\is-8VM19.tmp
- %ProgramFiles%\Notepad++\is-L3S4L.tmp
- %ProgramFiles%\Notepad++\is-8AEHT.tmp
- %TEMP%\is-SKUF0.tmp\Logo.bmp
- %TEMP%\is-SKUF0.tmp\Windows10Dark.vsf
- %TEMP%\is-SKUF0.tmp\VclStylesInno.dll
- %TEMP%\is-RQDG3.tmp\Notepad++_7.5.6_Replacer_1.2.tmp
- %TEMP%\RarSFX0\Notepad++Install_DE-IT.cmd
- %ProgramFiles%\Notepad++\is-MKPNN.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-7DVUI.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-C8F5R.tmp
- %ProgramFiles%\Notepad++\is-A4B9N.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-JEF97.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-02KCO.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-AMI8T.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-S7AG6.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-HD3AA.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-DQFPI.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-0C6LM.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-BQLS7.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-JJ7AI.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-DCV71.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-JM05P.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-HAJF5.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-ME6B9.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-7719C.tmp
- %APPDATA%\Notepad++\is-5MMGE.tmp
- %ProgramFiles%\Notepad++\updater\is-HVUSA.tmp
- %ProgramFiles%\Notepad++\is-TF60U.tmp
- %ProgramFiles%\Notepad++\unins000.dat
- %ProgramFiles%\Notepad++\Desktop.ini
- %ProgramFiles%\Notepad++\Notepad++.ico
- %TEMP%\is-SKUF0.tmp\Logo.bmp
- %TEMP%\is-SKUF0.tmp\VclStylesInno.dll
- %TEMP%\is-SKUF0.tmp\Windows10Dark.vsf
- %TEMP%\is-RQDG3.tmp\Notepad++_7.5.6_Replacer_1.2.tmp
- from %ProgramFiles%\Notepad++\is-8AEHT.tmp to %ProgramFiles%\Notepad++\unins000.exe
- from %APPDATA%\Notepad++\themes\is-I9U9I.tmp to %APPDATA%\Notepad++\themes\Bespin.xml
- from %APPDATA%\Notepad++\plugins\config\is-1UI59.tmp to %APPDATA%\Notepad++\plugins\config\Converter.ini
- from %APPDATA%\Notepad++\plugins\config\is-1PMRL.tmp to %APPDATA%\Notepad++\plugins\config\DSpellCheck.ini
- from %ProgramFiles%\Notepad++\plugins\is-P8SO0.tmp to %ProgramFiles%\Notepad++\plugins\DSpellCheck.dll
- from %ProgramFiles%\Notepad++\plugins\Config\Hunspell\is-I23MT.tmp to %ProgramFiles%\Notepad++\plugins\Config\Hunspell\en_US.dic
- from %APPDATA%\Notepad++\themes\is-SUI3L.tmp to %APPDATA%\Notepad++\themes\Black board.xml
- from %ProgramFiles%\Notepad++\plugins\Config\Hunspell\is-MOB25.tmp to %ProgramFiles%\Notepad++\plugins\Config\Hunspell\en_US.aff
- from %ProgramFiles%\Notepad++\plugins\is-CDFGO.tmp to %ProgramFiles%\Notepad++\plugins\NppExport.dll
- from %ProgramFiles%\Notepad++\plugins\is-0MORL.tmp to %ProgramFiles%\Notepad++\plugins\NppConverter.dll
- from %ProgramFiles%\Notepad++\plugins\is-4G9Q3.tmp to %ProgramFiles%\Notepad++\plugins\mimeTools.dll
- from %ProgramFiles%\Notepad++\plugins\APIs\is-5M4C7.tmp to %ProgramFiles%\Notepad++\plugins\APIs\batch.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-092FN.tmp to %ProgramFiles%\Notepad++\plugins\APIs\BaanC.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-6V6O2.tmp to %ProgramFiles%\Notepad++\plugins\APIs\actionscript.xml
- from %ProgramFiles%\Notepad++\plugins\is-D41SE.tmp to %ProgramFiles%\Notepad++\plugins\PluginManager.dll
- from %ProgramFiles%\Notepad++\plugins\APIs\is-DQFPI.tmp to %ProgramFiles%\Notepad++\plugins\APIs\javascript.xml
- from %APPDATA%\Notepad++\themes\is-8Q147.tmp to %APPDATA%\Notepad++\themes\Choco.xml
- from %APPDATA%\Notepad++\themes\is-U3IA9.tmp to %APPDATA%\Notepad++\themes\Vibrant Ink.xml
- from %APPDATA%\Notepad++\themes\is-7RA9H.tmp to %APPDATA%\Notepad++\themes\Twilight.xml
- from %APPDATA%\Notepad++\themes\is-74D51.tmp to %APPDATA%\Notepad++\themes\Solarized.xml
- from %APPDATA%\Notepad++\themes\is-GVGRI.tmp to %APPDATA%\Notepad++\themes\Solarized-light.xml
- from %APPDATA%\Notepad++\themes\is-SFTDN.tmp to %APPDATA%\Notepad++\themes\Ruby Blue.xml
- from %APPDATA%\Notepad++\themes\is-0FL60.tmp to %APPDATA%\Notepad++\themes\Plastic Code Wrap.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-A5L0C.tmp to %ProgramFiles%\Notepad++\plugins\APIs\xml.xml
- from %APPDATA%\Notepad++\themes\is-DUL46.tmp to %APPDATA%\Notepad++\themes\VS2012 Dark.xml
- from %APPDATA%\Notepad++\themes\is-0DJ8U.tmp to %APPDATA%\Notepad++\themes\MossyLawn.xml
- from %APPDATA%\Notepad++\themes\is-VAVAE.tmp to %APPDATA%\Notepad++\themes\Monokai.xml
- from %APPDATA%\Notepad++\themes\is-HRK80.tmp to %APPDATA%\Notepad++\themes\Mono Industrial.xml
- from %APPDATA%\Notepad++\themes\is-QG8JO.tmp to %APPDATA%\Notepad++\themes\khaki.xml
- from %APPDATA%\Notepad++\themes\is-ELOI5.tmp to %APPDATA%\Notepad++\themes\HotFudgeSundae.xml
- from %APPDATA%\Notepad++\themes\is-Q6R83.tmp to %APPDATA%\Notepad++\themes\Hello Kitty.xml
- from %APPDATA%\Notepad++\themes\is-D2DSK.tmp to %APPDATA%\Notepad++\themes\Navajo.xml
- from %APPDATA%\Notepad++\themes\is-TQANB.tmp to %APPDATA%\Notepad++\themes\Deep Black.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-G5NL9.tmp to %ProgramFiles%\Notepad++\plugins\APIs\vhdl.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-FDCA4.tmp to %ProgramFiles%\Notepad++\plugins\APIs\vb.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-TM3GB.tmp to %ProgramFiles%\Notepad++\plugins\APIs\tex.xml
- from %ProgramFiles%\Notepad++\is-419T4.tmp to %ProgramFiles%\Notepad++\stylers.model.xml
- from %ProgramFiles%\Notepad++\is-L3S4L.tmp to %ProgramFiles%\Notepad++\Desktop.ini
- from %ProgramFiles%\Notepad++\is-MKPNN.tmp to %ProgramFiles%\Notepad++\Notepad++.ico
- from %ProgramFiles%\Notepad++\is-8VM19.tmp to %ProgramFiles%\Notepad++\shortcuts.xml
- from %ProgramFiles%\Notepad++\is-GNL4D.tmp to %ProgramFiles%\Notepad++\contextMenu.xml
- from %ProgramFiles%\Notepad++\is-CIGK8.tmp to %ProgramFiles%\Notepad++\langs.model.xml
- from %APPDATA%\Notepad++\themes\is-FBI1B.tmp to %APPDATA%\Notepad++\themes\vim Dark Blue.xml
- from %ProgramFiles%\Notepad++\is-5G24M.tmp to %ProgramFiles%\Notepad++\functionList.xml
- from %ProgramFiles%\Notepad++\updater\is-HVUSA.tmp to %ProgramFiles%\Notepad++\updater\gpup.exe
- from %ProgramFiles%\Notepad++\localization\is-H1DHN.tmp to %ProgramFiles%\Notepad++\localization\german.xml
- from %APPDATA%\Notepad++\is-9V173.tmp to %APPDATA%\Notepad++\contextMenu.xml
- from %APPDATA%\Notepad++\is-EHDK6.tmp to %APPDATA%\Notepad++\functionList.xml
- from %ProgramFiles%\Notepad++\is-TF60U.tmp to %ProgramFiles%\Notepad++\SciLexer.dll
- from %ProgramFiles%\Notepad++\is-Q0BOR.tmp to %ProgramFiles%\Notepad++\Notepad++.exe
- from %ProgramFiles%\Notepad++\replacer\is-0P9MG.tmp to %ProgramFiles%\Notepad++\replacer\Replacer.exe
- from %APPDATA%\Notepad++\themes\is-MKD7A.tmp to %APPDATA%\Notepad++\themes\Obsidian.xml
- from %APPDATA%\Notepad++\is-5MMGE.tmp to %APPDATA%\Notepad++\nativeLang.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-HAJF5.tmp to %ProgramFiles%\Notepad++\plugins\APIs\coffee.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-7719C.tmp to %ProgramFiles%\Notepad++\plugins\APIs\c.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-BQLS7.tmp to %ProgramFiles%\Notepad++\plugins\APIs\sql.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-C8F5R.tmp to %ProgramFiles%\Notepad++\plugins\APIs\rc.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-JEF97.tmp to %ProgramFiles%\Notepad++\plugins\APIs\python.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-02KCO.tmp to %ProgramFiles%\Notepad++\plugins\APIs\php.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-AMI8T.tmp to %ProgramFiles%\Notepad++\plugins\APIs\perl.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-ME6B9.tmp to %ProgramFiles%\Notepad++\plugins\APIs\cmake.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-S7AG6.tmp to %ProgramFiles%\Notepad++\plugins\APIs\nsis.xml
- from %ProgramFiles%\Notepad++\is-A4B9N.tmp to %ProgramFiles%\Notepad++\NppShell_06.dll
- from %ProgramFiles%\Notepad++\plugins\APIs\is-0C6LM.tmp to %ProgramFiles%\Notepad++\plugins\APIs\java.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-JJ7AI.tmp to %ProgramFiles%\Notepad++\plugins\APIs\html.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-7DVUI.tmp to %ProgramFiles%\Notepad++\plugins\APIs\css.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-DCV71.tmp to %ProgramFiles%\Notepad++\plugins\APIs\cs.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-JM05P.tmp to %ProgramFiles%\Notepad++\plugins\APIs\cpp.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-HD3AA.tmp to %ProgramFiles%\Notepad++\plugins\APIs\lisp.xml
- from %APPDATA%\Notepad++\themes\is-E8EKR.tmp to %APPDATA%\Notepad++\themes\Zenburn.xml
- ClassName: 'EDIT' WindowName: ''
- '%TEMP%\RarSFX0\Notepad++_7.5.6_Replacer_1.2.exe' /VERYSILENT /LANG=de /TASKS="shellcontextmenu,replacer,desktopicon"
- '%TEMP%\is-RQDG3.tmp\Notepad++_7.5.6_Replacer_1.2.tmp' /SL5="$2010C,6003523,303616,%TEMP%\RarSFX0\Notepad++_7.5.6_Replacer_1.2.exe" /VERYSILENT /LANG=de /TASKS="shellcontextmenu,replacer,desktopicon"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\Notepad++Install_DE-IT.cmd" "
- '<SYSTEM32>\ping.exe' localhost -n 10