home

Updater.exe

Codec Pack

Web Solution Mart

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘WsmUpdater’.
Publisher:
Web Solution Mart  (signed and verified)

Product:
Codec Pack

Description:
Updater

Version:
1.0.0.1

MD5:
80342704c6a874cb577cad4fcc2cfa87

SHA-1:
1e9523b19f31a952d2ab7598cb1242ec17cb4d9e

SHA-256:
b189c0c78d8e20a49fc846bfd3c6324cc26f7539323a2a77976c86c1c2ad8f0f

Scanner detections:
2 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
4/18/2024 10:13:51 AM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/Floxif.H virus
6.3.12010.0

F-Prot
W32/Floxif.B
4.6.5.141

File size:
437.8 KB (448,311 bytes)

Product version:
1.0.0.1

Copyright:
Copyright (c) Web Solution Mart. All rights reserved.

Original file name:
Updater.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\web solution mart\fake webcam codecs pack\updater.exe

Digital Signature
Signed by:
Web Solution Mart

Authority:
VeriSign, Inc.

Valid from:
8/10/2011 5:00:00 PM

Valid to:
8/10/2012 4:59:59 PM

Subject:
CN=Web Solution Mart, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Web Solution Mart, L=Mississauga, S=Ontario, C=CA

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
6CE4DEC8927EDE1848D584A8290CAA39

File PE Metadata
Compilation timestamp:
5/17/2012 10:14:24 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

Entry address:
0x1926E

Entry point:
E9, AA, E5, 00, 00, E9, 79, FE, FF, FF, 3B, 0D, B4, 7C, 43, 00, 75, 02, F3, C3, E9, 80, 36, 00, 00, 8B, FF, 55, 8B, EC, 56, 8B, 75, 14, 57, 33, FF, 3B, F7, 75, 04, 33, C0, EB, 65, 39, 7D, 08, 75, 1B, E8, 5D, 17, 00, 00, 6A, 16, 5E, 89, 30, 57, 57, 57, 57, 57, E8, F8, 3B, 00, 00, 83, C4, 14, 8B, C6, EB, 45, 39, 7D, 10, 74, 16, 39, 75, 0C, 72, 11, 56, FF, 75, 10, FF, 75, 08, E8, 3F, 37, 00, 00, 83, C4, 0C, EB, C1, FF, 75, 0C, 57, FF, 75, 08, E8, 9E, 17, 00, 00, 83, C4, 0C, 39, 7D, 10, 74, B6, 39, 75, 0C, 73...
 
[+]

Entropy:
6.9463

Packer / compiler:
Xtreme-Protector v1.05

Code size:
164.5 KB (168,448 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
WsmUpdater

Command:
"C:\Program Files\web solution mart\fake webcam codecs pack\updater.exe"


Scan Updater.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.