home

windows10upgrade9194.exe

Windows 10 Upgrade Assistant

Microsoft Corporation

This is a setup program which is used to install the application. The file has been seen being downloaded from download.microsoft.com.
Publisher:
Microsoft Corporation

Product:
Windows 10 Upgrade Assistant

Version:
1.4.9200.17323

MD5:
6ec616fa91ee7f395eeb2f101636f2b5

SHA-1:
b4d6d0f424ddc163668028a5a5c7ccffb395e0b7

SHA-256:
67dc615496db45fafc892b0a1304712daa0f250bc4dd7ab0581652bb285edf08

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/23/2024 5:38:30 AM UTC  (today)

File size:
2 MB (2,075,403 bytes)

Product version:
1.4.9200.17323

Copyright:
Copyright © Microsoft Corporation. All rights reserved.

Original file name:
Windows10Upgrader.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\windows10upgrade9194.exe

File PE Metadata
Compilation timestamp:
6/5/2016 10:38:15 PM

OS version:
6.2

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.10

CTPH (ssdeep):
49152:Lk5nBvP/ou9n+vnUAyADAoT1LhDxhtjEytAClxqF+:wBv4ud+4ADBZtx3nl0F+

Entry address:
0x4C3F3

Entry point:
E8, 29, 0A, 00, 00, E9, 0D, FE, FF, FF, CC, CC, CC, CC, CC, 3B, 0D, 20, 80, 46, 00, 75, 03, C2, 00, 00, E9, 05, 00, 00, 00, CC, CC, CC, CC, CC, 8B, FF, 55, 8B, EC, 81, EC, 24, 03, 00, 00, A3, 00, 8B, 46, 00, 89, 0D, FC, 8A, 46, 00, 89, 15, F8, 8A, 46, 00, 89, 1D, F4, 8A, 46, 00, 89, 35, F0, 8A, 46, 00, 89, 3D, EC, 8A, 46, 00, 66, 8C, 15, 18, 8B, 46, 00, 66, 8C, 0D, 0C, 8B, 46, 00, 66, 8C, 1D, E8, 8A, 46, 00, 66, 8C, 05, E4, 8A, 46, 00, 66, 8C, 25, E0, 8A, 46, 00, 66, 8C, 2D, DC, 8A, 46, 00, 9C, 8F, 05, 10...
 
[+]

Entropy:
7.7461  (probably packed)

Code size:
411 KB (420,864 bytes)

The file windows10upgrade9194.exe has been seen being distributed by the following URL.

http://download.microsoft.com/download/0/4/7/047889D0-578C-4A44-A38F-7F30A6CB3809/.../Windows10Upgrade9194.exe

Scan windows10upgrade9194.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.