home

npupeditor2.dll

UPEditor

China UnionPay Co., Ltd

It is installed within the Mozilla Firefox web browser as an extension/plugin as ‘PassGuard’.
Publisher:
中国银联股份有限公司  (signed by China UnionPay Co., Ltd)

Product:
UPEditor

Description:
UPEditor Version:3.0.0.3

Version:
3.0.0.3

MD5:
21f4d5dbb1c9814077b788b07cb0fa9f

SHA-1:
32420071da5a4d308077851573b3da9d81c1dd69

SHA-256:
ce9e82e499b5a961d092847d51cee325b771fa2af2f2f68ffdec6dda7145c113

Scanner detections:
2 / 68

Status:
Clean  (2 probable false positive detections)

Explanation:
These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:
5/13/2025 3:45:17 AM UTC  (today)

Scan engine
Detection
Engine version

Bkav FE
HW32.Packed
1.3.0.8085

F-Prot
W32/QHost.C.gen
4.6.5.141

File size:
2 MB (2,109,768 bytes)

Product version:
3.0.0.0

Copyright:
(C) 2016 所有权利保留

Original file name:
npUPEditor.dll

File type:
Dynamic link library (Win32 DLL)

Language:
English (United States)

Common path:
C:\Windows\System32\upedit\npupeditor2.dll

Digital Signature
Signed by:
China UnionPay Co., Ltd

Authority:
VeriSign, Inc.

Valid from:
2/1/2013 8:00:00 AM

Valid to:
4/2/2016 7:59:59 AM

Subject:
CN="China UnionPay Co., Ltd", OU=HULIANWANG, OU=Digital ID Class 3 - Microsoft Software Validation v2, O="China UnionPay Co., Ltd", L=Shanghai, S=Shanghai, C=CN

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
2E5DCB78EBD9282BE0EB8E71EA9947F3

File PE Metadata
Compilation timestamp:
2/24/2016 3:00:35 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
49152:4tH2epc8vMftyJnqwMo8QlibQIGYj8vM9dkS6yI3UV0IlURqO:41NpUfEJ5/8+ibQIZjj9dL65glUF

Entry address:
0x40FBD6

Entry point:
E8, 6E, 1B, 01, 00, C1, 6D, 66, 39, 81, 9C, E2, 23, 8F, 26, C6, D5, A5, CE, C6, 77, 07, 30, C8, D7, FA, 86, 0E, 01, E9, E6, DE, ED, 15, 94, F1, 61, 89, F0, A9, F0, CB, 84, 88, D9, 25, 7D, 82, A5, 4D, 46, AA, 0E, F2, 45, CA, F2, 15, D4, 95, CF, 5C, 71, CA, 72, F8, FC, E7, 4F, C2, AA, BD, 5D, 6C, DF, 16, 55, 61, 7D, CE, 3A, 47, 0B, 9A, 9D, CF, A4, 05, 4C, B0, 62, 61, 6D, 8D, BC, 84, 45, B2, 77, E7, 13, 44, CA, 93, A8, A4, 2F, 7F, BE, 4D, 1E, 37, 66, 09, 46, 92, DC, 7D, 78, 8D, 08, 10, CE, 9F, 92, 6C, F4, A5...
 
[+]

Entropy:
7.8980  (probably packed)

Code size:
534 KB (546,816 bytes)

Mozilla Plugin
Name:
PassGuard


Scan npupeditor2.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.