home

flash.exe

Stepan Rybin

The is the installer for the WebPick InstalleRex download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed without consent. The application flash.exe by Stepan Rybin has been detected as adware by 16 anti-malware scanners.
Publisher:
Stepan Rybin  (signed and verified)

MD5:
f816eca07d17e93003441feb23659671

SHA-1:
2c89e76d5128ed52f2a95cb5794e98adf3233538

SHA-256:
155589af5ccf2e249953acf6f7bd034144db92b5cf66eac2929f7ddeef5a178a

Scanner detections:
16 / 68

Status:
Adware

Analysis date:
10/28/2026 2:25:52 AM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
PUP/Win32.MultiPlug
2015.01.24

Avira AntiVirus
ADWARE/MultiPlug.Gen4
7.11.204.220

avast!
Win32:MultiPlug-OZ [PUP]
150102-1

AVG
Adware Generic6.JRH
2014.0.4257

Bkav FE
W32.RammitNNA.PE
1.3.0.6379

Comodo Security
Application.Win32.AdWare.MultiPlug.VA
20821

ESET NOD32
Win32/Adware.MultiPlug.ED application
7.0.302.0

IKARUS anti.virus
not-a-virus:AdWare.MultiPlug
t3scan.1.8.6.0

K7 AntiVirus
Virus
13.192.14746

McAfee
MultiPlug-FUV
5600.6876

Microsoft Security Essentials
Threat.Undefined
1.191.3234.0

Panda Antivirus
W32/Cosmu.gen
15.01.30.12

Reason Heuristics
PUP.WebPick
15.2.5.12

Sophos
PUA 'MultiPlug' (of type Adware)
5.09

Vba32 AntiVirus
suspected of Heur.Malware-Cryptor.Multiplug
3.12.26.3

VIPRE Antivirus
Threat.4726519
36666

File size:
1.3 MB (1,363,656 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\ProgramData\{75e42d0c-0375-32d7-75e4-42d0c037b430}\flash.exe

Digital Signature
Signed by:
Stepan Rybin

Authority:
Unizeto Technologies S.A.

Valid from:
6/27/2014 4:37:40 AM

Valid to:
6/27/2015 4:37:40 AM

Subject:
E=rybin.step@yandex.ru, CN=Stepan Rybin, O=Stepan Rybin, C=UA

Issuer:
CN=Certum Code Signing CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL

Serial number:
47154C2151E9EB8DFA42C2C9E45BFC6C

File PE Metadata
Compilation timestamp:
8/1/2013 10:30:27 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
24576:VIwWz6ieLmeJKYEHsY6eo4HyTxjwvCgYGD+Mg:+zN6LEUeo4HydIO

Entry address:
0x1EADC

Entry point:
E8, 1B, 39, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 70, D5, 45, 00, E8, 4E, 11, 00, 00, E8, E8, 3A, 00, 00, 0F, B7, F0, 6A, 02, E8, AE, 38, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, C2, 09, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
6.8088

Code size:
352 KB (360,448 bytes)

Remove flash.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.