Should I block it?

60%

60% of PCs block this file from running.

Possible reason:

Performance resource utilization

Additional versions

faccc	3.23%
de70e	3.23%
9b165	3.23%
8b7f5	3.23%
58f9d	16.13%
ebffe	3.23%
b1ec8	3.23%
5e01b	3.23%
ce2c4	3.23%
49792	3.23%
6d7c4	3.23%
ed068	12.90%
1ba41	6.45%
4f887	19.35%
d7539	3.23%
2e615	3.23%
d0c38	6.45%

(Note, Bit Cocktail Ltd. publishes each variation of this file with the same version, but the hashes are unique.)

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

PE file structure

Show functions

Import table

advapi32.dll

GetSidSubAuthority, GetSidSubAuthorityCount, GetSidIdentifierAuthority, IsValidSid, GetTokenInformation, OpenProcessToken, ControlService, StartServiceW, DeleteService, OpenServiceW, CloseServiceHandle, CreateServiceW, OpenSCManagerW, SetServiceStatus, RegisterServiceCtrlHandlerW, StartServiceCtrlDispatcherW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegOpenKeyExW, RegEnumKeyExW, RegQueryInfoKeyW, RegCloseKey, RegDeleteKeyW, RegQueryValueExW

kernel32.dll

LocalFree, LocalAlloc, GetVersionExW, GetCurrentProcess, HeapAlloc, GetProcessHeap, CloseHandle, GetTempPathW, HeapFree, GetSystemTime, SystemTimeToFileTime, FindResourceExW, GetFileAttributesW, FindFirstFileW, FindNextFileW, DeleteFileW, FindClose, CreateFileW, RemoveDirectoryW, LCMapStringA, GetStringTypeW, LockResource, GetCurrentDirectoryW, CreateThread, Sleep, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, InitializeCriticalSection, GetModuleFileNameW, LoadLibraryExW, FindResourceW, LoadResource, SizeofResource, MultiByteToWideChar, GetLastError, EnterCriticalSection, RaiseException, LeaveCriticalSection, lstrcmpiW, GetModuleHandleW, GetProcAddress, lstrlenW, FreeLibrary, LCMapStringW, FileTimeToSystemTime, GetModuleHandleA, WriteConsoleA, lstrlenA, CreateFileA, GetStringTypeA, WriteConsoleW, GetConsoleOutputCP, HeapDestroy, HeapReAlloc, HeapSize, GetSystemTimeAsFileTime, CreateDirectoryW, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetStartupInfoW, RtlUnwind, VirtualFree, VirtualAlloc, HeapCreate, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, SetFilePointer, SetHandleCount, GetFileType, GetStartupInfoA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, InitializeCriticalSectionAndSpinCount, LoadLibraryA, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, SetStdHandle, FlushFileBuffers, GetLocaleInfoA

ole32.dll

CoTaskMemFree, CoCreateInstance, CoInitialize, CoTaskMemRealloc, CoTaskMemAlloc, CoUninitialize

shell32.dll

ShellExecuteExW

urlmon.dll

URLDownloadToFileW

user32.dll

CharNextW

extensionupdaterservice.exe

By Bit Cocktail Ltd. (Signed)

Remove extensionupdaterservice.exe

MD5:	de70e5b2aa61cc3392b2a789de2ef472
SHA1:	bf965db25ce1d2b3ec677d1933d6934ec5d4af86

What is extensionupdaterservice.exe?

Plazy Updater is the software updater program which runs in the background of Windows and automatically starts up when your PC boots. It checks for software udpates and automatically downloads and installs them if found.

Overview

extensionupdaterservice.exe runs as a service under the name Web Assistant (Updater By SweetPacks) with extensive SYSTEM privileges (full administrator access). The file is digitally signed by Bit Cocktail Ltd. which was issued by the Thawte certificate authority (CA).

Details

File name:	extensionupdaterservice.exe
Typical file path:	C:\Program Files\plazy\extensionupdaterservice.exe
Size:	181.5 KB (185,856 bytes)
Certificate
Issued to:	Bit Cocktail Ltd.
Authority (CA):	Thawte
Expiration date:	Thursday, January 16, 2014
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
.NET CLR:	No

More details

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

Web Assistant
'Updater By SweetPacks'
'Web Assistant Updater'

Network connections

[UDP] listens on port 60147

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.03814351%	0.028634%
Kernel CPU:	0.02542901%	0.013761%
User CPU:	0.01271450%	0.014873%
Kernel CPU time:	80 ms/min	100,923,805ms/min
Context switches:	9/sec	284/sec
Memory
Private memory:	10.47 MB	21.59 MB
Private (maximum):	6.23 MB
Private (minimum):	6.22 MB
Non-paged memory:	10.47 MB	21.59 MB
Virtual memory:	64.02 MB	140.96 MB
Virtual memory (peak):	67.02 MB	169.69 MB
Working set:	6.22 MB	18.61 MB
Working set (peak):	6.3 MB	37.95 MB
Resource allocations
Threads:	8	12
Handles:	217	600

Process properties

Integrety level:	System
Platform:	32-bit
Command line:	"C:\Program Files\coolpic\extensionupdaterservice.exe"
Owner:	SYSTEM
Windows Service
Service name:	Updater By SweetPacks
Display name:	Web Assistant
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads