Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe] 'Debugger' = '%ProgramFiles%\Notepad++\replacer\Replacer.exe'
- %TEMP%\RarSFX0\Notepad++_7.5.7_Replacer_1.2.exe
- %APPDATA%\Notepad++\themes\is-J2OLA.tmp
- %APPDATA%\Notepad++\themes\is-A399V.tmp
- %APPDATA%\Notepad++\plugins\config\is-BRRHI.tmp
- %APPDATA%\Notepad++\plugins\config\is-6VIFU.tmp
- %ProgramFiles%\Notepad++\plugins\is-0G8ML.tmp
- %ProgramFiles%\Notepad++\plugins\Config\Hunspell\is-EUCGE.tmp
- %ProgramFiles%\Notepad++\plugins\Config\Hunspell\is-EM19R.tmp
- %APPDATA%\Notepad++\themes\is-8T246.tmp
- %ProgramFiles%\Notepad++\plugins\is-BH066.tmp
- %ProgramFiles%\Notepad++\plugins\is-I98M2.tmp
- %ProgramFiles%\Notepad++\plugins\is-LM3HV.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-3DO97.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-U949N.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-65TN2.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-27Q96.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-VETV8.tmp
- %ProgramFiles%\Notepad++\plugins\is-GOA3M.tmp
- %APPDATA%\Notepad++\themes\is-BQMUV.tmp
- %ALLUSERSPROFILE%\Desktop\Notepad++.lnk
- %APPDATA%\Notepad++\themes\is-SG06D.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Notepad++.lnk
- %APPDATA%\Notepad++\themes\is-IT2NV.tmp
- %APPDATA%\Notepad++\themes\is-KMINO.tmp
- %APPDATA%\Notepad++\themes\is-NOMTC.tmp
- %APPDATA%\Notepad++\themes\is-S8SNU.tmp
- %APPDATA%\Notepad++\themes\is-8DDUG.tmp
- %APPDATA%\Notepad++\themes\is-V3VPL.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-RIM9T.tmp
- %APPDATA%\Notepad++\themes\is-BCG5H.tmp
- %APPDATA%\Notepad++\themes\is-H0JIT.tmp
- %APPDATA%\Notepad++\themes\is-3J4R5.tmp
- %APPDATA%\Notepad++\themes\is-H07N8.tmp
- %APPDATA%\Notepad++\themes\is-5094N.tmp
- %APPDATA%\Notepad++\themes\is-MGPTF.tmp
- %APPDATA%\Notepad++\themes\is-T8KNF.tmp
- %APPDATA%\Notepad++\themes\is-E964N.tmp
- %APPDATA%\Notepad++\themes\is-PF8TR.tmp
- %APPDATA%\Notepad++\themes\is-OB8AD.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-O2MJM.tmp
- %ProgramFiles%\Notepad++\is-U6L28.tmp
- %ProgramFiles%\Notepad++\replacer\is-F5PFE.tmp
- %APPDATA%\Notepad++\is-4QNA0.tmp
- %APPDATA%\Notepad++\is-91VQO.tmp
- %ProgramFiles%\Notepad++\is-AOH2V.tmp
- %ProgramFiles%\Notepad++\is-PRBQ2.tmp
- %ProgramFiles%\Notepad++\is-109V4.tmp
- %ProgramFiles%\Notepad++\is-UUOFJ.tmp
- %ProgramFiles%\Notepad++\localization\is-QBC8Q.tmp
- %ProgramFiles%\Notepad++\is-S99I4.tmp
- %ProgramFiles%\Notepad++\is-RUP1S.tmp
- %ProgramFiles%\Notepad++\is-NDHGO.tmp
- %TEMP%\is-F7A0I.tmp\Logo.bmp
- %TEMP%\is-F7A0I.tmp\Windows10Dark.vsf
- %TEMP%\is-F7A0I.tmp\VclStylesInno.dll
- %TEMP%\is-QM92M.tmp\Notepad++_7.5.7_Replacer_1.2.tmp
- %TEMP%\RarSFX0\Notepad++Install_DE-IT.cmd
- %ProgramFiles%\Notepad++\is-2NGOS.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-EV608.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-VRSII.tmp
- %ProgramFiles%\Notepad++\is-49LNO.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-6N0PI.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-KABG7.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-I4A5Q.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-TSPHC.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-97G1U.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-OT3KT.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-R76DO.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-F262M.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-7U6DV.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-02NDV.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-TKH9O.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-CLIUI.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-6A45P.tmp
- %ProgramFiles%\Notepad++\plugins\APIs\is-J5IBL.tmp
- %APPDATA%\Notepad++\is-RIHT3.tmp
- %ProgramFiles%\Notepad++\updater\is-PMUTE.tmp
- %ProgramFiles%\Notepad++\is-HKPV0.tmp
- %ProgramFiles%\Notepad++\unins000.dat
- %ProgramFiles%\Notepad++\Desktop.ini
- %ProgramFiles%\Notepad++\Notepad++.ico
- %TEMP%\is-F7A0I.tmp\Logo.bmp
- %TEMP%\is-F7A0I.tmp\VclStylesInno.dll
- %TEMP%\is-F7A0I.tmp\Windows10Dark.vsf
- %TEMP%\is-QM92M.tmp\Notepad++_7.5.7_Replacer_1.2.tmp
- from %ProgramFiles%\Notepad++\is-NDHGO.tmp to %ProgramFiles%\Notepad++\unins000.exe
- from %APPDATA%\Notepad++\themes\is-A399V.tmp to %APPDATA%\Notepad++\themes\Bespin.xml
- from %APPDATA%\Notepad++\plugins\config\is-BRRHI.tmp to %APPDATA%\Notepad++\plugins\config\Converter.ini
- from %APPDATA%\Notepad++\plugins\config\is-6VIFU.tmp to %APPDATA%\Notepad++\plugins\config\DSpellCheck.ini
- from %ProgramFiles%\Notepad++\plugins\is-0G8ML.tmp to %ProgramFiles%\Notepad++\plugins\DSpellCheck.dll
- from %ProgramFiles%\Notepad++\plugins\Config\Hunspell\is-EUCGE.tmp to %ProgramFiles%\Notepad++\plugins\Config\Hunspell\en_US.dic
- from %APPDATA%\Notepad++\themes\is-8T246.tmp to %APPDATA%\Notepad++\themes\Black board.xml
- from %ProgramFiles%\Notepad++\plugins\Config\Hunspell\is-EM19R.tmp to %ProgramFiles%\Notepad++\plugins\Config\Hunspell\en_US.aff
- from %ProgramFiles%\Notepad++\plugins\is-GOA3M.tmp to %ProgramFiles%\Notepad++\plugins\NppExport.dll
- from %ProgramFiles%\Notepad++\plugins\is-I98M2.tmp to %ProgramFiles%\Notepad++\plugins\NppConverter.dll
- from %ProgramFiles%\Notepad++\plugins\is-LM3HV.tmp to %ProgramFiles%\Notepad++\plugins\mimeTools.dll
- from %ProgramFiles%\Notepad++\plugins\APIs\is-3DO97.tmp to %ProgramFiles%\Notepad++\plugins\APIs\batch.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-U949N.tmp to %ProgramFiles%\Notepad++\plugins\APIs\BaanC.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-65TN2.tmp to %ProgramFiles%\Notepad++\plugins\APIs\actionscript.xml
- from %ProgramFiles%\Notepad++\plugins\is-BH066.tmp to %ProgramFiles%\Notepad++\plugins\PluginManager.dll
- from %ProgramFiles%\Notepad++\plugins\APIs\is-OT3KT.tmp to %ProgramFiles%\Notepad++\plugins\APIs\javascript.xml
- from %APPDATA%\Notepad++\themes\is-PF8TR.tmp to %APPDATA%\Notepad++\themes\Choco.xml
- from %APPDATA%\Notepad++\themes\is-NOMTC.tmp to %APPDATA%\Notepad++\themes\Vibrant Ink.xml
- from %APPDATA%\Notepad++\themes\is-S8SNU.tmp to %APPDATA%\Notepad++\themes\Twilight.xml
- from %APPDATA%\Notepad++\themes\is-8DDUG.tmp to %APPDATA%\Notepad++\themes\Solarized.xml
- from %APPDATA%\Notepad++\themes\is-V3VPL.tmp to %APPDATA%\Notepad++\themes\Solarized-light.xml
- from %APPDATA%\Notepad++\themes\is-BCG5H.tmp to %APPDATA%\Notepad++\themes\Ruby Blue.xml
- from %APPDATA%\Notepad++\themes\is-BQMUV.tmp to %APPDATA%\Notepad++\themes\Plastic Code Wrap.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-27Q96.tmp to %ProgramFiles%\Notepad++\plugins\APIs\xml.xml
- from %APPDATA%\Notepad++\themes\is-J2OLA.tmp to %APPDATA%\Notepad++\themes\VS2012 Dark.xml
- from %APPDATA%\Notepad++\themes\is-H07N8.tmp to %APPDATA%\Notepad++\themes\MossyLawn.xml
- from %APPDATA%\Notepad++\themes\is-5094N.tmp to %APPDATA%\Notepad++\themes\Monokai.xml
- from %APPDATA%\Notepad++\themes\is-MGPTF.tmp to %APPDATA%\Notepad++\themes\Mono Industrial.xml
- from %APPDATA%\Notepad++\themes\is-T8KNF.tmp to %APPDATA%\Notepad++\themes\khaki.xml
- from %APPDATA%\Notepad++\themes\is-E964N.tmp to %APPDATA%\Notepad++\themes\HotFudgeSundae.xml
- from %APPDATA%\Notepad++\themes\is-SG06D.tmp to %APPDATA%\Notepad++\themes\Hello Kitty.xml
- from %APPDATA%\Notepad++\themes\is-3J4R5.tmp to %APPDATA%\Notepad++\themes\Navajo.xml
- from %APPDATA%\Notepad++\themes\is-OB8AD.tmp to %APPDATA%\Notepad++\themes\Deep Black.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-VETV8.tmp to %ProgramFiles%\Notepad++\plugins\APIs\vhdl.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-RIM9T.tmp to %ProgramFiles%\Notepad++\plugins\APIs\vb.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-O2MJM.tmp to %ProgramFiles%\Notepad++\plugins\APIs\tex.xml
- from %ProgramFiles%\Notepad++\is-AOH2V.tmp to %ProgramFiles%\Notepad++\stylers.model.xml
- from %ProgramFiles%\Notepad++\is-RUP1S.tmp to %ProgramFiles%\Notepad++\Desktop.ini
- from %ProgramFiles%\Notepad++\is-2NGOS.tmp to %ProgramFiles%\Notepad++\Notepad++.ico
- from %ProgramFiles%\Notepad++\is-S99I4.tmp to %ProgramFiles%\Notepad++\shortcuts.xml
- from %ProgramFiles%\Notepad++\is-UUOFJ.tmp to %ProgramFiles%\Notepad++\contextMenu.xml
- from %ProgramFiles%\Notepad++\is-109V4.tmp to %ProgramFiles%\Notepad++\langs.model.xml
- from %APPDATA%\Notepad++\themes\is-KMINO.tmp to %APPDATA%\Notepad++\themes\vim Dark Blue.xml
- from %ProgramFiles%\Notepad++\is-PRBQ2.tmp to %ProgramFiles%\Notepad++\functionList.xml
- from %ProgramFiles%\Notepad++\updater\is-PMUTE.tmp to %ProgramFiles%\Notepad++\updater\gpup.exe
- from %APPDATA%\Notepad++\is-4QNA0.tmp to %APPDATA%\Notepad++\functionList.xml
- from %ProgramFiles%\Notepad++\replacer\is-F5PFE.tmp to %ProgramFiles%\Notepad++\replacer\Replacer.exe
- from %ProgramFiles%\Notepad++\localization\is-QBC8Q.tmp to %ProgramFiles%\Notepad++\localization\german.xml
- from %ProgramFiles%\Notepad++\is-HKPV0.tmp to %ProgramFiles%\Notepad++\SciLexer.dll
- from %ProgramFiles%\Notepad++\is-U6L28.tmp to %ProgramFiles%\Notepad++\Notepad++.exe
- from %APPDATA%\Notepad++\is-91VQO.tmp to %APPDATA%\Notepad++\contextMenu.xml
- from %APPDATA%\Notepad++\themes\is-H0JIT.tmp to %APPDATA%\Notepad++\themes\Obsidian.xml
- from %APPDATA%\Notepad++\is-RIHT3.tmp to %APPDATA%\Notepad++\nativeLang.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-CLIUI.tmp to %ProgramFiles%\Notepad++\plugins\APIs\coffee.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-J5IBL.tmp to %ProgramFiles%\Notepad++\plugins\APIs\c.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-F262M.tmp to %ProgramFiles%\Notepad++\plugins\APIs\sql.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-VRSII.tmp to %ProgramFiles%\Notepad++\plugins\APIs\rc.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-6N0PI.tmp to %ProgramFiles%\Notepad++\plugins\APIs\python.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-KABG7.tmp to %ProgramFiles%\Notepad++\plugins\APIs\php.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-I4A5Q.tmp to %ProgramFiles%\Notepad++\plugins\APIs\perl.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-6A45P.tmp to %ProgramFiles%\Notepad++\plugins\APIs\cmake.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-TSPHC.tmp to %ProgramFiles%\Notepad++\plugins\APIs\nsis.xml
- from %ProgramFiles%\Notepad++\is-49LNO.tmp to %ProgramFiles%\Notepad++\NppShell_06.dll
- from %ProgramFiles%\Notepad++\plugins\APIs\is-R76DO.tmp to %ProgramFiles%\Notepad++\plugins\APIs\java.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-7U6DV.tmp to %ProgramFiles%\Notepad++\plugins\APIs\html.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-EV608.tmp to %ProgramFiles%\Notepad++\plugins\APIs\css.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-02NDV.tmp to %ProgramFiles%\Notepad++\plugins\APIs\cs.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-TKH9O.tmp to %ProgramFiles%\Notepad++\plugins\APIs\cpp.xml
- from %ProgramFiles%\Notepad++\plugins\APIs\is-97G1U.tmp to %ProgramFiles%\Notepad++\plugins\APIs\lisp.xml
- from %APPDATA%\Notepad++\themes\is-IT2NV.tmp to %APPDATA%\Notepad++\themes\Zenburn.xml
- ClassName: 'EDIT' WindowName: ''
- '%TEMP%\RarSFX0\Notepad++_7.5.7_Replacer_1.2.exe' /VERYSILENT /LANG=de /TASKS="shellcontextmenu,replacer,desktopicon"
- '%TEMP%\is-QM92M.tmp\Notepad++_7.5.7_Replacer_1.2.tmp' /SL5="$1010A,6019345,303616,%TEMP%\RarSFX0\Notepad++_7.5.7_Replacer_1.2.exe" /VERYSILENT /LANG=de /TASKS="shellcontextmenu,replacer,desktopicon"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\Notepad++Install_DE-IT.cmd" "
- '<SYSTEM32>\ping.exe' localhost -n 10