File scan report
Verdict Safe
Is npp.
A Notepad++ 8.9.8.1 64-bit installer with a valid Notepad++ signature, no detections from any of 75 engines, and clean behaviour across five sandbox runs.
Strong evidence · A verified publisher signature, and no engine flags it.
Install it normally if it came from the official Notepad++ release channel or a trusted software repository, and keep your antivirus protection switched on during setup. If you cannot account for where the file came from, fetch a fresh copy from the project's own site rather than running this one.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 70 flagged
- Flagged 0
- No detection 70
- No result 5
- Code signing NOTEPAD++
- Test run Completed
- First seen 1mo ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This is the Notepad++ 8.9.8.1 64-bit installer, carrying a valid signature from Notepad++ and matching our trusted-publisher list. None of the 70 antivirus engines that checked it flagged it, the combined sandbox verdict was clean, and no malicious host or file it created was found. It behaves like the official installer it claims to be.
The file is a 6.9 MB Windows installer that identifies as Notepad++ 8.9.8.1, and its embedded signature verifies against the Notepad++ publisher we already track as trusted. That signer identity is the strongest anchor here: an unsigned or failed signature on a security-adjacent download would change the picture, and neither applies. All 70 antivirus engines that checked it were given the file and none flagged it, including 18 of the higher-trust engines such as BitDefender, Kaspersky, ESET-NOD32 and Fortinet. The sandbox runs were uneventful: the installer wrote temporary extractor files and touched one Explorer file-association key, with no process injection, no high-risk techniques and a clean combined verdict. The only domain seen was routine background traffic from the analysis machine, and the contacted-host cross-check returned no malicious or suspicious entries. The single community rule match for clipboard-hijacking malware sits alongside three generic installer-detection rules, which is exactly the pattern a legitimate NSIS-based setup package produces. Prevalence is consistent with a widely distributed mainstream installer, submitted by nearly three thousand distinct sources since Sep 24, 2026.
What We Detected
The sample is a 64-bit Windows executable named as a Notepad++ 8.9.8.1 installer, 6.9 MB in size. Its digital signature is present and valid, issued to Notepad++, which is on our list of publishers whose products we recognise. Not one of the 70 antivirus engines that checked it flagged it, and 18 of the more reputable engines reported it clean. Our static file analysis was not run on these bytes, so nothing here rests on an inspection of the code itself — the evidence comes from the signature, the engine results and the sandbox runs.
Threat Behavior
Five sandbox runs produced one combined clean verdict. The installer extracted its own temporary NSIS helper files into the temp folder and registered an Explorer file-association entry, which is ordinary setup behaviour. No process injection was recorded, no high-risk techniques were mapped, and none of the techniques seen are unusual for an installer. The only domain contacted was background traffic belonging to the analysis machine itself, and the host-reputation lookup returned no malicious or suspicious results. Of the two files dropped during installation, neither is tied to anything harmful.
Signature and Prevalence
The signature verified against Notepad++, and the file has been submitted by roughly three thousand distinct sources since Sep 24, 2026 — the profile of a widely distributed, mainstream download rather than a targeted lure. One community-written rule for clipboard-hijacking malware matched the installer, but three further generic installer and certificate rules matched as well, a combination that legitimate NSIS setup packages regularly produce. No engine, sandbox run or host lookup supports a malicious reading of that match.
What To Do Now
If you obtained this installer from the official Notepad++ release channel or an established software repository, it can be installed normally; keeping your antivirus enabled during installation is a sensible habit. If it arrived as an unexpected attachment or from a mirror you do not recognise, download a fresh copy directly from the project's own site instead and compare the file's signature before running it.
Where this verdict could be wrong3 caveats
- One community YARA rule aimed at clipboard-hijacking malware matched this installer; NSIS-based installers commonly trip pattern rules, and no antivirus engine agreed with it.
- An independent file-scanning service published a 'suspicious' label with rule-based tags (anti-debug, anti-VM, keylogger) for these bytes; that is a single automated opinion with no engine corroboration behind it.
- The five prior reports on files sharing this import fingerprint come from unrelated Electron-style installers, so they reflect a shared build framework rather than this publisher's history.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- The digital signature verifies and names Notepad++, a publisher we already recognise as trusted for this product.
- None of the 70 antivirus engines that checked it flagged the file, including 18 of the higher-trust engines.
- The combined sandbox verdict was clean, with no process injection and no high-risk techniques recorded.
- The file's signature, version and installer format all match the official Notepad++ release it claims to be.
- Nearly three thousand distinct sources have submitted this file since Sep 24, 2026, consistent with a mainstream download.
- One community-written rule associated with clipboard-hijacking malware matched the installer, although no antivirus engine agreed with it.
- An independent automated scanning service recorded a 'suspicious' label with rule-based tags for these bytes, without engine support.
- A community researcher annotation attached a broad set of behaviour tags to the file; these are automated observations, not confirmed findings.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 5 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 5isolated sandbox runs
- 16sandbox rule tags
- 1spawned processes
- 0network contacts
- 23filesystem & mutex artifacts
What this file did when executed
This file was detonated in 5 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
16MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1012
- T1027· Obfuscated code
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1112
- T1115
- T1125
- T1129· Loads modules
- T1134
- T1222
- T1497.001· Sandbox evasion
- T1529
- T1547.009· Auto-start
Observed activity
Processes started
1Programs the file ran, with their command lines.
npp.8.9.8.1.Installer.x64.exe"C:\Users\user\Desktop\npp.8.9.8.1.Installer.x64.exe"
Files
23Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\nscCA57.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\nscCAA6.tmp\System.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nscCAA6.tmp\LangDLL.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nszEE2.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\nsk100C.tmp\System.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nsk100C.tmp\LangDLL.dll
Show all 23 entries for files
- Written
C:\Users\<USER>\AppData\Local\Temp\nsg4747.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\nsh48CF.tmp\System.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nsh48CF.tmp\LangDLL.dll - Written
C:\Users\user\AppData\Local\Microsoft\Windows\Caches - Written
C:\Users\user\AppData\Local\Temp - Written
C:\Users\user\AppData\Local\Temp\ - Written
C:\Users\user\AppData\Local\Temp\nsbF14.tmp - Written
C:\Users\user\AppData\Local\Temp\nslDCB.tmp - Written
C:\Users\user\AppData\Local\Temp\nsw102E.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\nshCA27.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\nscCAA6.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\nstE25.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\nsk100C.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\nsl4717.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\nsh48CF.tmp - Deleted
C:\Users\user\AppData\Local\Temp\nslDCB.tmp - Deleted
C:\Users\user\AppData\Local\Temp\nsw102E.tmp
Registry and auto-start
1Settings the file changed, including ways to start again after a restart.
- Set
HKEY_USERS\S-1-5-21-4270068108-2931534202-3907561125-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids\exefile
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM host
assets.msn.com
Files this sample writes at runtime
This file drops 2 children at runtime. None are currently flagged malicious in our cache. 2 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 996645d7f16a6294babb…dc51a5Not checkedno saved verdict
- 760df89c2341f9c39c02…dc1d8eNot checkedno saved verdict
Chapter 04
Technical details
None of the 70 antivirus engines that checked it flag it; signed by NOTEPAD++.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Nov 5, 2026, 2:58 PM UTC
- SHA-256
26f3bcced788fadbac4e7e577b430ea2ce6060cf3bcad993ef4612ecd7d743da- SHA-1
c398767b0a3cd3b7c535b8f037c83ac445651022- MD5
8f80626b3a6fa6ae568f248ce3f801c9
About this file
npp.8.9.8.1.Installer.x64.exe says it is Notepad++ : a free (GNU) source code editor (Notepad++), 7.0 MB.
- Claims to be
- Notepad++ : a free (GNU) source code editor (Notepad++)From the file's own version information, written by whoever built it.
- Type and size
- Win32 EXE · 7.0 MB
- Signer
- NOTEPAD++Valid code signature.
- First seen
- Sep 24, 2026On VirusTotal.
- Submitted by
- 2,976 distinct sources
- Packer
- None detected
- Entropy
- 5.80 of 8
First scanned
Antivirus consensus
0 of 70 engines flagged this file
5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleNo result
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Behavioral heuristics matched patterns associated with malware. Corroborating evidence determines how much weight they carry.
- Win_Clipboard_Clipper_Thengavar
- Detect_NSIS_Nullsoft_Installergeneric
- NSISgeneric
- PE_Digital_Certificategeneric
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely uploaded, but first seen within the last six months. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is npp.8.9.8.1.Installer.x64.exe safe?
What is npp.8.9.8.1.Installer.x64.exe?
How many antivirus engines detected npp.8.9.8.1.Installer.x64.exe?
Is npp.8.9.8.1.Installer.x64.exe digitally signed?
What is the SHA-256 hash of npp.8.9.8.1.Installer.x64.exe?
Is it safe to install npp.8.9.8.1.Installer.x64.exe?
How up to date is this analysis of npp.8.9.8.1.Installer.x64.exe?
Community
Member reviews and reports for this exact file hash.