» UpdateRestart.exe
Overview
Analysis
File Details
Programs (1)

UpdateRestart.exe

LinkScanner

Exploit Prevention Labs, Inc.

This is installed with LinkScanner.

File name:

UpdateRestart.exe

Publisher:

Exploit Prevention Labs, Inc. (signed and verified)

Product:

LinkScanner

Description:

LinkScanner update restart tool

Version:

2.7.0.105

MD5:

2f68fb1c687071234ff6ff908a6aa08e

SHA-1:

37625bc7894e5e7677d3f976d229df5256e8089b

SHA-256:

9218dadd3a0d809ed2d8b0944205e12aaf06038c74209a9e542b5fcf073c885c

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

4/24/2024 10:55:09 PM UTC (today)

File size:

77.3 KB (79,128 bytes)

Product version:

2.7.0.105

Trademarks:

LinkScanner, SocketShield, Exploit Prevention Labs

Original file name:

UpdateRestart.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\ProgramData\application data\{c02aa202-5da6-404b-946d-b75886e8252d}\offline\dab3bb89\9d7d7b6a\updaterestart.exe

Digital Signature

Signed by:

Exploit Prevention Labs, Inc.

Authority:

VeriSign, Inc.

Valid from:

3/11/2006 12:00:00 AM

Valid to:

3/10/2008 11:59:59 PM

Subject:

CN="Exploit Prevention Labs, Inc.", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Exploit Prevention Labs, Inc.", L=Carlisle, S=Pennsylvania, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2004 CA, OU=Terms of use at https://www.verisign.com/rpa (c)04, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

3B8B0513F10888BFF0CA59975B802A7A

File PE Metadata

Compilation timestamp:

11/25/2007 4:25:55 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows Console

Linker version:

8.0

CTPH (ssdeep):

768:noHWM24oabUHB88AGtYIrpL2+U4fgCrq34+FktuAoRy5wW85R5iUiK/eLIXa7b+:ERReB882HB4fgC23zktuK25iUiEeb+

Entry address:

0x1B15

Entry point:

E8, D7, 26, 00, 00, E9, 40, FE, FF, FF, 53, 8B, 5C, 24, 08, 56, 57, 8B, F9, C7, 07, B4, C1, 40, 00, 8B, 03, 85, C0, 74, 26, 50, E8, C6, 28, 00, 00, 8B, F0, 46, 56, E8, F6, 27, 00, 00, 85, C0, 59, 59, 89, 47, 04, 74, 12, FF, 33, 56, 50, E8, 30, 27, 00, 00, 83, C4, 0C, EB, 04, 83, 67, 04, 00, C7, 47, 08, 01, 00, 00, 00, 8B, C7, 5F, 5E, 5B, C2, 04, 00, 8B, C1, 8B, 4C, 24, 04, C7, 00, B4, C1, 40, 00, 8B, 09, 83, 60, 08, 00, 89, 48, 04, C2, 08, 00, 53, 8B, 5C, 24, 08, 56, 8B, F1, C7, 06, B4, C1, 40, 00, 8B, 43... 
[+]

Entropy:

5.9595

Code size:

44 KB (45,056 bytes)

The file UpdateRestart.exe has been discovered within the following program.

LinkScanner by Exploit Prevention Labs, Inc.

About 5% of users remove it

Scan UpdateRestart.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.