Should I block it?

60%

60% of PCs block this file from running.

Possible reason:

Performance resource utilization

Additional versions

faccc	3.23%
de70e	3.23%
9b165	3.23%
8b7f5	3.23%
58f9d	16.13%
ebffe	3.23%
b1ec8	3.23%
5e01b	3.23%
ce2c4	3.23%
49792	3.23%
6d7c4	3.23%
ed068	12.90%
1ba41	6.45%
4f887	19.35%
d7539	3.23%
2e615	3.23%
d0c38	6.45%

(Note, Bit Cocktail Ltd. publishes each variation of this file with the same version, but the hashes are unique.)

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

PE file structure

Show functions

Import table

advapi32.dll

GetSidSubAuthority, GetSidSubAuthorityCount, GetSidIdentifierAuthority, IsValidSid, GetTokenInformation, OpenProcessToken, ControlService, StartServiceW, DeleteService, OpenServiceW, CloseServiceHandle, CreateServiceW, OpenSCManagerW, SetServiceStatus, RegisterServiceCtrlHandlerW, StartServiceCtrlDispatcherW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegOpenKeyExW, RegEnumKeyExW, RegQueryInfoKeyW, RegCloseKey, RegDeleteKeyW, RegQueryValueExW

kernel32.dll

LocalFree, LocalAlloc, GetVersionExW, GetCurrentProcess, HeapAlloc, GetProcessHeap, CloseHandle, GetTempPathW, HeapFree, GetSystemTime, SystemTimeToFileTime, FindResourceExW, GetFileAttributesW, FindFirstFileW, FindNextFileW, DeleteFileW, FindClose, CreateFileW, RemoveDirectoryW, LCMapStringA, GetStringTypeW, LockResource, GetCurrentDirectoryW, CreateThread, Sleep, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, InitializeCriticalSection, GetModuleFileNameW, LoadLibraryExW, FindResourceW, LoadResource, SizeofResource, MultiByteToWideChar, GetLastError, EnterCriticalSection, RaiseException, LeaveCriticalSection, lstrcmpiW, GetModuleHandleW, GetProcAddress, lstrlenW, FreeLibrary, LCMapStringW, FileTimeToSystemTime, GetModuleHandleA, WriteConsoleA, lstrlenA, CreateFileA, GetStringTypeA, WriteConsoleW, GetConsoleOutputCP, HeapDestroy, HeapReAlloc, HeapSize, GetSystemTimeAsFileTime, CreateDirectoryW, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetStartupInfoW, RtlUnwind, VirtualFree, VirtualAlloc, HeapCreate, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, SetFilePointer, SetHandleCount, GetFileType, GetStartupInfoA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, InitializeCriticalSectionAndSpinCount, LoadLibraryA, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, SetStdHandle, FlushFileBuffers, GetLocaleInfoA

ole32.dll

CoTaskMemFree, CoCreateInstance, CoInitialize, CoTaskMemRealloc, CoTaskMemAlloc, CoUninitialize

shell32.dll

ShellExecuteExW

urlmon.dll

URLDownloadToFileW

user32.dll

CharNextW

extensionupdaterservice.exe

By Bit Cocktail Ltd. (Signed)

Remove extensionupdaterservice.exe

MD5:	6d7c46ef873388df62dc2c21892de317
SHA1:	6fdb7f1fc5ae3a18c2b57c9e167e28404d64145b
SHA256:	9b7f34ac8b7121cd86c36e8f173672276290d817e04c165594acaf29c6085dca

What is extensionupdaterservice.exe?

Plazy Updater is the software updater program which runs in the background of Windows and automatically starts up when your PC boots. It checks for software udpates and automatically downloads and installs them if found.

Overview

extensionupdaterservice.exe runs as a service under the name Web Assistant (Updater By SweetPacks) with extensive SYSTEM privileges (full administrator access). The file is digitally signed by Bit Cocktail Ltd. which was issued by the Thawte certificate authority (CA). Note, some antivirus scanners have flagged this file, however it is not necessarily considered malware (see below for details).

Details

File name:	extensionupdaterservice.exe
Typical file path:	C:\Program Files\plazy\extensionupdaterservice.exe
Size:	181.5 KB (185,856 bytes)
Certificate
Issued to:	Bit Cocktail Ltd.
Authority (CA):	Thawte
Expiration date:	Thursday, January 16, 2014
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
.NET CLR:	No

More details

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

Web Assistant
'Updater By SweetPacks'
'Web Assistant Updater'

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00005592%	0.028634%
Kernel CPU:	0.00002329%	0.013761%
User CPU:	0.00003263%	0.014873%
Kernel CPU time:	512,214 ms/min	100,923,805ms/min
Memory
Private memory:	9.09 MB	21.59 MB
Private (maximum):	544 KB
Private (minimum):	436 KB
Non-paged memory:	9.09 MB	21.59 MB
Virtual memory:	47.22 MB	140.96 MB
Virtual memory (peak):	48.22 MB	169.69 MB
Working set:	540 KB	18.61 MB
Working set (peak):	3.22 MB	37.95 MB
Resource allocations
Threads:	3	12
Handles:	52	600

Process properties

Integrety level:	System
Platform:	32-bit
Command line:	"C:\Program Files\web assistant\extensionupdaterservice.exe"
Owner:	SYSTEM
Windows Service
Service name:	Updater By SweetPacks
Display name:	Web Assistant
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads