The auto webupdater is a cron job currently named /etc/cron.daily/cwp which executes 2 obfuscated php files using /usr/local/cwp/php54/bin/php with a timeout of 1 million seconds ( why? ):
/usr/local/cwpsrv/htdocs/resources/admin/include/cron.php
/usr/local/cwpsrv/htdocs/resources/admin/include/cron_backup.php
The effects of the first of these files have been investigated and it is found that the email address of the root user and the webpanel version are transmitted to the developers site along with all Globals (IP Address, paths, etc) at the start of the update and the final webpanel version is transmitted at the conclusion of the update. The files essentially affected are expected to be in the /usr/local/cwpsrv/htdocs folder only but could actually be to anywhere on the server.
The webpanel version is listed at the bottom of the dashboard and is probably taken from the obfuscated file:
/usr/local/cwpsrv/htdocs/resources/admin/include/version.php