CmdID / Files

wups.dll

Windows Update client proxy stub file version info

Library on Windows 2 known copies with hashes

Is it the real wups.dll?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionWindows Update client proxy stub

2 known copies

10.0.19041.488 (WinBuild.160101.0800) · C:\Windows\system32\wups.dll · signed by Microsoft Windows

208941e8b2e3a27b6bf1f2ee882af8a0feee3c6c484968363ab2c500fb6b4565

10.0.19041.488 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wups.dll · signed by Microsoft Windows

259175ead6ec5779567e6ae92a0ee94d39cf26379219c885b027ecfce0d9239f

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.