CmdID

CmdID / Files

GUP.exe

WinGup for Notepad++ file version info

Program on Windows 2 known copies with hashes 8 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real GUP.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Notepad++\updater\
Signed byNotepad++
ProductWinGup for Notepad++, Don HO don.h@free.fr
DescriptionWinGup for Notepad++

2 known copies

5.21 · C:\Program Files (x86)\Notepad++\updater\GUP.exe · signed by Notepad++

285d1f375eedb5dc30b2962ed45187f1fe07cfd09de101faca8a1b2416e6bd69

5.11 · C:\Program Files (x86)\Notepad++\updater\GUP.exe · signed by Notepad++

ce0685bedeb6904488615f45764e8304ce1dd4da4ae0200a4b2f6d14c1b91d49

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name GUP.exe
highFile Download Using Notepad++ GUP UtilityNasreddine Bencherchali (Nextron Systems)
highSuspicious Child Process of Notepad++ Updater - GUP.ExeSwachchhanda Shrawan Poudel (Nextron Systems)
highSuspicious GUP UsageFlorian Roth (Nextron Systems)
mediumArbitrary Binary Execution Using GUP UtilityNasreddine Bencherchali (Nextron Systems)

Sigma names GUP.exe in 8 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.