home

extensionupdaterservice.exe

Fedorov Paul

The is the installer for the WebPick InstalleRex download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed without consent. The application extensionupdaterservice.exe by Fedorov Paul has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. It runs as a separate (within the context of its own process) windows Service named “Update Service for Cashsyst”.
Publisher:
Fedorov Paul  (signed and verified)

MD5:
bf84b960f484c83b74b0d039319a2116

SHA-1:
2634d7963e8079067a873e3f94bbf67928c59673

SHA-256:
65906bbd079a70204b5fb4308f8e98394fd59ebb5a85ad84cf3dc3cc8bdc4eb8

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
4/23/2024 9:07:17 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Webpick.FedorovPaul (M)
15.8.11.13

File size:
670.1 KB (686,224 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\cashsyst\basement\extensionupdaterservice.exe

Digital Signature
Signed by:
Fedorov Paul

Authority:
Thawte, Inc.

Valid from:
9/30/2013 8:00:00 AM

Valid to:
10/17/2014 7:59:59 AM

Subject:
CN=Fedorov Paul, OU=Individual Developer, O=No Organization Affiliation, L=Saint-Petersburg, S=Saint-Petersburg, C=RU

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
4775A986F383176992FD70C1405B2DEA

File PE Metadata
Compilation timestamp:
10/24/2013 4:24:15 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
12288:P1tvOfdqOpfY9tZApKWktxgSo4hJolsahnZ6C+OQVPOecRZZqdw7JQxL:9t2fdhwaDqxdo4hJolsOZf+OQcecRZZc

Entry address:
0x76841

Entry point:
E8, 78, 99, 00, 00, E9, 79, FE, FF, FF, 8B, FF, 55, 8B, EC, 51, 53, 56, 57, FF, 35, B0, 2A, 4A, 00, E8, AA, 59, 00, 00, FF, 35, AC, 2A, 4A, 00, 8B, F8, 89, 7D, FC, E8, 9A, 59, 00, 00, 8B, F0, 59, 59, 3B, F7, 0F, 82, 83, 00, 00, 00, 8B, DE, 2B, DF, 8D, 43, 04, 83, F8, 04, 72, 77, 57, E8, 3B, 9A, 00, 00, 8B, F8, 8D, 43, 04, 59, 3B, F8, 73, 48, B8, 00, 08, 00, 00, 3B, F8, 73, 02, 8B, C7, 03, C7, 3B, C7, 72, 0F, 50, FF, 75, FC, E8, 15, 44, 00, 00, 59, 59, 85, C0, 75, 16, 8D, 47, 10, 3B, C7, 72, 40, 50, FF, 75...
 
[+]

Code size:
567 KB (580,608 bytes)

Service
Display name:
Update Service for Cashsyst

Type:
Win32OwnProcess


Remove extensionupdaterservice.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.