Notepad++ GUP.exe Suspicious Child Process

Georg Lauenstein@gsec

•updated Feb 8, 2026•2•0•50

Detects suspicious child processes spawned by Notepad++ updater (gup.exe) including cmd.exe with reconnaissance commands or scripting engines.