Notepad++ Updater Spawning Suspicious Child Process

nomit vyas@xoxo

•updated Jun 23, 2026•1•0•2

Detects the legitimate Notepad++ updater process (GUP.exe) spawning suspicious child processes. This behavior was observed during the Notepad++ supply chain attack where the updater was used to launch malicious payloads.