home

upservice.exe

UPSecurityInputService

China UnionPay Co., Ltd

It runs as a separate (within the context of its own process) windows Service named “UPSecurityInputService”.
Publisher:
中国银联股份有限公司  (signed by China UnionPay Co., Ltd)

Product:
UPSecurityInputService

Version:
1.0.0.1

MD5:
4cc2bdb6961000701cf317a840afb567

SHA-1:
19645e5c70300eb077e8b9e6dad78b220f866845

SHA-256:
109a2d8c8717a0f5ebf4f56b7dd4908a7d401957b46bf7c186b36a57d7603f09

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/13/2025 4:04:16 AM UTC  (today)

File size:
352.8 KB (361,288 bytes)

Product version:
1.0.0.1

Copyright:
Copyright (C) 2015

Original file name:
UPSecurityInputService

File type:
Executable application (Win32 EXE)

Common path:
C:\Windows\System32\upeditnew\upservice.exe

Digital Signature
Signed by:
China UnionPay Co., Ltd

Authority:
VeriSign, Inc.

Valid from:
2/1/2013 8:00:00 AM

Valid to:
4/2/2016 7:59:59 AM

Subject:
CN="China UnionPay Co., Ltd", OU=HULIANWANG, OU=Digital ID Class 3 - Microsoft Software Validation v2, O="China UnionPay Co., Ltd", L=Shanghai, S=Shanghai, C=CN

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
2E5DCB78EBD9282BE0EB8E71EA9947F3

File PE Metadata
Compilation timestamp:
3/16/2016 4:39:32 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:Q/8Ol1+yixs+jMBSgY4mQMlq9d1gt3HlKLaI+MxZrAzxTZ6JFdWAoO5hZgks:Q/prTi9YG4mQN9dOt3lKLsMnAdZ6JiAq

Entry address:
0xA80D8

Entry point:
E8, 97, 8A, FB, FF, 29, 8F, A4, 84, EB, 2E, F4, 66, 4D, AB, 70, 28, 5B, CD, 43, 1A, 01, 57, D5, FE, B0, 97, 31, 16, 97, 0E, 7D, EE, 16, FD, CB, BB, 9D, 33, 11, 1F, 75, 4D, 68, 4F, C9, F5, DC, 0C, CA, 2E, ED, EB, 08, 70, 0B, DD, 5B, B0, 42, 06, 59, 6F, 50, 38, 57, E1, 07, 31, A2, A1, D1, EB, 0A, 30, 88, 3A, F0, 78, 02, C6, BA, BE, D0, 28, 06, 05, 00, D8, B3, 95, 8B, 5D, AC, 7C, BD, CB, D7, 91, D8, 20, C3, 96, 22, 06, E6, EA, 2E, F4, 28, DE, 8A, DD, 8B, AB, 2D, C6, 82, AC, FC, 6A, 7E, 89, 82, 70, B8, 7F, 19...
 
[+]

Entropy:
7.9070  (probably packed)

Code size:
113.5 KB (116,224 bytes)

Service
Display name:
UPSecurityInputService

Type:
Win32OwnProcess


Scan upservice.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.