File name:

windows10 yeah.exe

Full analysis: https://app.any.run/tasks/03e1eaec-1dab-406e-927e-7f65376a0fc4
Verdict: Malicious activity
Analysis date: January 14, 2024, 20:37:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

59658313B7C7543372B8A40CA8967F58

SHA1:

2ED1EA40DCBB758FD10D7086642C4FB44EFA6259

SHA256:

D8850528001E6DD8E19E141BB2322C2D144C524759612AEABE2F116A9C49519F

SSDEEP:

98304:o+QF3unYLN996U4Eu0YjO7l03JMjLxUFDz8B3rXoxsFIFQH9OZFj1EAWC5hKCL1F:l1jvn70ggOnTdt/Ag

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • windows10 yeah.exe (PID: 2208)
      • Windows10UpgraderApp.exe (PID: 2016)
      • Windows10Upgrade.exe (PID: 2724)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • windows10 yeah.exe (PID: 2208)
      • Windows10UpgraderApp.exe (PID: 2016)
      • Windows10Upgrade.exe (PID: 2724)

    • Process drops legitimate windows executable

      • windows10 yeah.exe (PID: 2208)
      • Windows10Upgrade.exe (PID: 2724)
      • Windows10UpgraderApp.exe (PID: 2016)

    • Drops a system driver (possible attempt to evade defenses)

      • windows10 yeah.exe (PID: 2208)
      • Windows10Upgrade.exe (PID: 2724)

    • Reads the Internet Settings

      • windows10 yeah.exe (PID: 2208)
      • Windows10UpgraderApp.exe (PID: 2016)
      • control.exe (PID: 2712)
      • Windows10Upgrade.exe (PID: 2724)
      • Windows10UpgraderApp.exe (PID: 2596)

    • The process creates files with name similar to system file names

      • windows10 yeah.exe (PID: 2208)
      • Windows10Upgrade.exe (PID: 2724)

    • Reads Microsoft Outlook installation path

      • Windows10UpgraderApp.exe (PID: 2016)
      • Windows10UpgraderApp.exe (PID: 2596)

    • Reads security settings of Internet Explorer

      • Windows10UpgraderApp.exe (PID: 2016)

    • Reads Internet Explorer settings

      • Windows10UpgraderApp.exe (PID: 2016)
      • Windows10UpgraderApp.exe (PID: 2596)

    • Reads settings of System Certificates

      • Windows10UpgraderApp.exe (PID: 2016)

    • Checks Windows Trust Settings

      • Windows10UpgraderApp.exe (PID: 2016)

    • Uses RUNDLL32.EXE to load library

      • control.exe (PID: 2712)

  • INFO

    • Checks supported languages

      • windows10 yeah.exe (PID: 2208)
      • Windows10UpgraderApp.exe (PID: 2016)
      • Windows10Upgrade.exe (PID: 2724)
      • HttpHelper.exe (PID: 2836)
      • HttpHelper.exe (PID: 3024)
      • Windows10UpgraderApp.exe (PID: 2596)
      • HttpHelper.exe (PID: 2752)
      • HttpHelper.exe (PID: 3220)
      • HttpHelper.exe (PID: 2988)

    • Create files in a temporary directory

      • windows10 yeah.exe (PID: 2208)
      • Windows10UpgraderApp.exe (PID: 2016)
      • Windows10Upgrade.exe (PID: 2724)
      • Windows10UpgraderApp.exe (PID: 2596)

    • Reads the computer name

      • windows10 yeah.exe (PID: 2208)
      • Windows10UpgraderApp.exe (PID: 2016)
      • Windows10UpgraderApp.exe (PID: 2596)
      • Windows10Upgrade.exe (PID: 2724)
      • HttpHelper.exe (PID: 3220)
      • HttpHelper.exe (PID: 2988)
      • HttpHelper.exe (PID: 2752)
      • HttpHelper.exe (PID: 2836)
      • HttpHelper.exe (PID: 3024)

    • Creates files in the program directory

      • windows10 yeah.exe (PID: 2208)

    • Reads the machine GUID from the registry

      • Windows10UpgraderApp.exe (PID: 2016)
      • Windows10UpgraderApp.exe (PID: 2596)

    • Checks proxy server information

      • Windows10UpgraderApp.exe (PID: 2016)
      • Windows10UpgraderApp.exe (PID: 2596)

    • Creates files or folders in the user directory

      • Windows10UpgraderApp.exe (PID: 2016)
      • Windows10UpgraderApp.exe (PID: 2596)

    • Manual execution by a user

      • control.exe (PID: 2712)

    • Reads the time zone

      • rundll32.exe (PID: 2572)

    • Checks transactions between databases Windows and Oracle

      • rundll32.exe (PID: 2572)

    • Reads Environment values

      • Windows10UpgraderApp.exe (PID: 2596)

    • Reads CPU info

      • Windows10UpgraderApp.exe (PID: 2596)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (36.8)
.exe | Win32 Executable MS Visual C++ (generic) (26.6)
.exe | Win64 Executable (generic) (23.6)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:04:14 20:27:56+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10.1
CodeSize: 423424
InitializedDataSize: 159744
UninitializedDataSize: -
EntryPoint: 0x4cd92
OSVersion: 6.2
ImageVersion: 6.2
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.4.9200.17387
ProductVersionNumber: 1.4.9200.17387
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Arabic
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: ‏‏‎‎‫مساعد ترقية Windows 10
InternalName: Windows10Upgrader.exe
LegalCopyright: Copyright © Microsoft Corporation. All rights reserved.
OriginalFileName: Windows10Upgrader.exe
ProductName: Windows 10 Upgrade Assistant
FileVersion: 1.4.9200.17387
ProductVersion: 1.4.9200.17387
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
64
Monitored processes
13
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start windows10 yeah.exe windows10upgraderapp.exe control.exe no specs rundll32.exe no specs timedate.cpl no specs windows10upgrade.exe windows10upgraderapp.exe httphelper.exe httphelper.exe httphelper.exe httphelper.exe httphelper.exe windows10 yeah.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2016"C:\Windows10Upgrade\Windows10UpgraderApp.exe" C:\Windows10Upgrade\Windows10UpgraderApp.exe
windows10 yeah.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows 10 Upgrade Assistant
Exit code:
0
Version:
1.4.9200.17387
Modules
Images
c:\windows10upgrade\windows10upgraderapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mfc42u.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2184"C:\Users\admin\AppData\Local\Temp\windows10 yeah.exe" C:\Users\admin\AppData\Local\Temp\windows10 yeah.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows 10 Upgrade Assistant
Exit code:
3221226540
Version:
1.4.9200.17387
Modules
Images
c:\users\admin\appdata\local\temp\windows10 yeah.exe
c:\windows\system32\ntdll.dll
2208"C:\Users\admin\AppData\Local\Temp\windows10 yeah.exe" C:\Users\admin\AppData\Local\Temp\windows10 yeah.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows 10 Upgrade Assistant
Exit code:
0
Version:
1.4.9200.17387
Modules
Images
c:\users\admin\appdata\local\temp\windows10 yeah.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2396C:\Windows\system32\DllHost.exe /Processid:{9DF523B0-A6C0-4EA9-B5F1-F4565C3AC8B8}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2572"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\System32\timedate.cpl",C:\Windows\System32\rundll32.exe—control.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2596"C:\Windows10Upgrade\Windows10UpgraderApp.exe" /ClientID Win10China:VNL:URL::<1.4.9200.17387>:<1>:{9EBC4F44-4A64-4C9B-B476-D2AF52ECAD92}:[6.1.7601]:[1] /SkipSelfUpdateC:\Windows10Upgrade\Windows10UpgraderApp.exe
Windows10Upgrade.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows 10 Update Assistant
Exit code:
0
Version:
1.4.9200.22391
Modules
Images
c:\windows10upgrade\windows10upgraderapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mfc42u.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2712"C:\Windows\System32\control.exe" "C:\Windows\System32\timedate.cpl",C:\Windows\System32\control.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Control Panel
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\control.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2724C:\Users\admin\AppData\Local\Temp\Windows10Upgrade.exe /Upgrade /InstallationPath C:\Windows10Upgrade /ClientID Win10China:VNL:URL::<1.4.9200.17387>:<1>:{9EBC4F44-4A64-4C9B-B476-D2AF52ECAD92}:[6.1.7601]:[1] /SkipSelfUpdateC:\Users\admin\AppData\Local\Temp\Windows10Upgrade.exe
Windows10UpgraderApp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows 10 Update Assistant
Exit code:
0
Version:
1.4.9200.22391
Modules
Images
c:\users\admin\appdata\local\temp\windows10upgrade.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2752HttpHelper.exe "g.bing.com" "/gwx/vanilla?ts=1705264788221&SQM=725447e043824fe48f53fe4eddd9a698&GWX=(null)&WU=f43817de583741b48c80b3a0e3cc1efa&WER=3ade2c424ab949b7b142be9aeea69063&CS=12&OSVersion=6.1.7601&STG=win10Vanilla&ER=Completed&LANG=1033&IT=ButtonClicked&IM=Next&CCR=0&RM=(null)&PTN=e52abfc276bb4908883fca581fdd83f9&EC=(null)&SEC=(null)&SUEC=(null)&SI=4f0e87cac0b54a95b102ad1d8ba296d5&CV=(null)&VER=1.4.9200.22391&MD=1&FLT=URL%3A&UPS=CompatSuccessResult&WUAUI=DefaultUi&WDS=Restored&DJR=false&CT=false"C:\Windows10Upgrade\HttpHelper.exe
Windows10UpgraderApp.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows10upgrade\httphelper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2836HttpHelper.exe "g.bing.com" "/gwx/vanilla?ts=1705264784815&SQM=725447e043824fe48f53fe4eddd9a698&GWX=(null)&WU=f43817de583741b48c80b3a0e3cc1efa&WER=3ade2c424ab949b7b142be9aeea69063&CS=12&OSVersion=6.1.7601&STG=win10Vanilla&ER=Completed&LANG=1033&IT=(null)&IM=(null)&CCR=0&RM=(null)&PTN=e52abfc276bb4908883fca581fdd83f9&EC=(null)&SEC=(null)&SUEC=(null)&SI=4f0e87cac0b54a95b102ad1d8ba296d5&CV=(null)&VER=1.4.9200.22391&MD=1&FLT=URL%3A&UPS=CheckingCompat&WUAUI=DefaultUi&WDS=Restored&DJR=false&CT=false"C:\Windows10Upgrade\HttpHelper.exe
Windows10UpgraderApp.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows10upgrade\httphelper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
7 955
Read events
7 889
Write events
65
Delete events
1

Modification events

(PID) Process:(2208) windows10 yeah.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2208) windows10 yeah.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2208) windows10 yeah.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2208) windows10 yeah.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2016) Windows10UpgraderApp.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2016) Windows10UpgraderApp.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2016) Windows10UpgraderApp.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2016) Windows10UpgraderApp.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2016) Windows10UpgraderApp.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2016) Windows10UpgraderApp.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
110
Suspicious files
27
Text files
302
Unknown types
0

Dropped files

PID
Process
Filename
Type
2208windows10 yeah.exeC:\Users\admin\AppData\Local\Temp\WXUD6.tmp\appraiserxp.dllexecutable
MD5:74667719A6143F301B35FE1EA835476E
SHA256:D7CCC62B700E96F4AA19EE4DF1B0D2FCBD189932883D0421DEB8875D2D46A1F3
2208windows10 yeah.exeC:\Users\admin\AppData\Local\Temp\WXUD6.tmp\WinREBootApp64.exeexecutable
MD5:2ED1087561341F3BCEBCEA87015CE12F
SHA256:DB5739EB6D543ECC230C52687E0488B18C5F8B2C96CF9A7B2F3DF612D9A763A2
2208windows10 yeah.exeC:\Users\admin\AppData\Local\Temp\WXUD6.tmp\DWDCW20.DLLexecutable
MD5:A1AB4BE6CF197B17A3AEE88232D145B0
SHA256:2AEF07A30CBEE796561F0E3FFDA1FF5D2B5667C36AC8351221431467227016F3
2208windows10 yeah.exeC:\Users\admin\AppData\Local\Temp\WXUD6.tmp\wimgapi.dllexecutable
MD5:9F813FCCC316729E6522E5CFC1F2A203
SHA256:210CFD228534F1A8E4A790A7A66362D2CB5237432BD541CB231762EBC7C31953
2208windows10 yeah.exeC:\Users\admin\AppData\Local\Temp\WXUD6.tmp\DW20.EXEexecutable
MD5:D155E4362FA5991D822FE1C2A14A14F9
SHA256:713A105C7AFB9BE33249E7C82A23BBDAB89B7F3FCFBD780C123A683B601DBB5B
2208windows10 yeah.exeC:\Users\admin\AppData\Local\Temp\WXUD6.tmp\GetCurrentRollback.EXEexecutable
MD5:ECD6A5FAA655D40C5FFADB1C50366838
SHA256:F4B336B4810FDFC3B71A2717D1ABFBC4BF7FDA51792DD2D106DBC7D5C91EBF7E
2208windows10 yeah.exeC:\Users\admin\AppData\Local\Temp\WXUD6.tmp\downloader.dllexecutable
MD5:891D4F90FC41FDCA72C056E19C4A6E1C
SHA256:2088803A4B7B24852583742BAE3F277F5B41949922C112DB8C04C5D3D23E2214
2208windows10 yeah.exeC:\Users\admin\AppData\Local\Temp\WXUD6.tmp\WinREBootApp32.exeexecutable
MD5:FAAC8E79C036B969E3A5CE9F43C16B63
SHA256:94B6E72D3A72B37470A18657D9A169CD96098FCB961022F23BF8E2503230680F
2208windows10 yeah.exeC:\Users\admin\AppData\Local\Temp\WXUD6.tmp\GetCurrentOOBE.dllexecutable
MD5:460EE170A9686F51A8AE420D20CDAEC0
SHA256:C3213BE0C1526559B5E6937A8D470BF9CD9A86149C35F43D5B3FE99BD9421967
2208windows10 yeah.exeC:\Users\admin\AppData\Local\Temp\WXUD6.tmp\ESDHelper.dllexecutable
MD5:AFA87EC797A1FEB825E5DC57A382E1AE
SHA256:C8A4C9DDB324DCFEACC8751A5BABEAA7E40CBD938B4D5A161A2F0A8B65723F47
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
24
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2016
Windows10UpgraderApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
binary
471 b
unknown
2016
Windows10UpgraderApp.exe
GET
200
192.229.221.95:80
http://crl3.digicert.com/DigiCertGlobalRootG2.crl
unknown
binary
1.14 Kb
unknown
2016
Windows10UpgraderApp.exe
GET
200
2.16.2.89:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6351a6659d3fd473
unknown
compressed
4.66 Kb
unknown
2836
HttpHelper.exe
GET
204
13.107.21.200:80
http://g.bing.com/gwx/vanilla?ts=1705264784815&SQM=725447e043824fe48f53fe4eddd9a698&GWX=(null)&WU=f43817de583741b48c80b3a0e3cc1efa&WER=3ade2c424ab949b7b142be9aeea69063&CS=12&OSVersion=6.1.7601&STG=win10Vanilla&ER=Completed&LANG=1033&IT=(null)&IM=(null)&CCR=0&RM=(null)&PTN=e52abfc276bb4908883fca581fdd83f9&EC=(null)&SEC=(null)&SUEC=(null)&SI=4f0e87cac0b54a95b102ad1d8ba296d5&CV=(null)&VER=1.4.9200.22391&MD=1&FLT=URL%3A&UPS=CheckingCompat&WUAUI=DefaultUi&WDS=Restored&DJR=false&CT=false
unknown
—
—
unknown
—
—
GET
204
13.107.21.200:80
http://g.bing.com/gwx/vanilla?ts=1705264821799&SQM=725447e043824fe48f53fe4eddd9a698&GWX=(null)&WU=f43817de583741b48c80b3a0e3cc1efa&WER=3ade2c424ab949b7b142be9aeea69063&CS=12&OSVersion=6.1.7601&STG=win10Vanilla&ER=Completed&LANG=1033&IT=(null)&IM=(null)&CCR=0&RM=Failed%20in%20state%20Downloading&PTN=e52abfc276bb4908883fca581fdd83f9&EC=-2147012721&SEC=(null)&SUEC=(null)&SI=4f0e87cac0b54a95b102ad1d8ba296d5&CV=(null)&VER=1.4.9200.22391&MD=1&FLT=URL%3A&UPS=Downloading&WUAUI=DefaultUi&WDS=Restored&DJR=false&CT=false
unknown
—
—
unknown
3220
HttpHelper.exe
GET
204
13.107.21.200:80
http://g.bing.com/gwx/vanilla?ts=1705264788237&SQM=725447e043824fe48f53fe4eddd9a698&GWX=(null)&WU=f43817de583741b48c80b3a0e3cc1efa&WER=3ade2c424ab949b7b142be9aeea69063&CS=12&OSVersion=6.1.7601&STG=win10Vanilla&ER=Completed&LANG=1033&IT=(null)&IM=(null)&CCR=0&RM=(null)&PTN=e52abfc276bb4908883fca581fdd83f9&EC=(null)&SEC=(null)&SUEC=(null)&SI=4f0e87cac0b54a95b102ad1d8ba296d5&CV=(null)&VER=1.4.9200.22391&MD=1&FLT=URL%3A&UPS=Downloading&WUAUI=DefaultUi&WDS=Restored&DJR=false&CT=false
unknown
—
—
unknown
3024
HttpHelper.exe
GET
204
13.107.21.200:80
http://g.bing.com/gwx/vanilla?ts=1705264785502&SQM=725447e043824fe48f53fe4eddd9a698&GWX=(null)&WU=f43817de583741b48c80b3a0e3cc1efa&WER=3ade2c424ab949b7b142be9aeea69063&CS=12&OSVersion=6.1.7601&STG=win10Vanilla&ER=Completed&LANG=1033&IT=(null)&IM=(null)&CCR=0&RM=(null)&PTN=e52abfc276bb4908883fca581fdd83f9&EC=(null)&SEC=(null)&SUEC=(null)&SI=4f0e87cac0b54a95b102ad1d8ba296d5&CV=(null)&VER=1.4.9200.22391&MD=1&FLT=URL%3A&UPS=CompatSuccessResult&WUAUI=DefaultUi&WDS=Restored&DJR=false&CT=false
unknown
—
—
unknown
2752
HttpHelper.exe
GET
204
13.107.21.200:80
http://g.bing.com/gwx/vanilla?ts=1705264788221&SQM=725447e043824fe48f53fe4eddd9a698&GWX=(null)&WU=f43817de583741b48c80b3a0e3cc1efa&WER=3ade2c424ab949b7b142be9aeea69063&CS=12&OSVersion=6.1.7601&STG=win10Vanilla&ER=Completed&LANG=1033&IT=ButtonClicked&IM=Next&CCR=0&RM=(null)&PTN=e52abfc276bb4908883fca581fdd83f9&EC=(null)&SEC=(null)&SUEC=(null)&SI=4f0e87cac0b54a95b102ad1d8ba296d5&CV=(null)&VER=1.4.9200.22391&MD=1&FLT=URL%3A&UPS=CompatSuccessResult&WUAUI=DefaultUi&WDS=Restored&DJR=false&CT=false
unknown
—
—
unknown
2016
Windows10UpgraderApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2016
Windows10UpgraderApp.exe
23.200.162.90:443
go.microsoft.com
AKAMAI-AS
PL
unknown
2016
Windows10UpgraderApp.exe
2.16.2.89:80
ctldl.windowsupdate.com
Akamai International B.V.
CZ
whitelisted
2016
Windows10UpgraderApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2016
Windows10UpgraderApp.exe
104.91.48.252:443
download.microsoft.com
AKAMAI-AS
PL
unknown
2836
HttpHelper.exe
13.107.21.200:80
g.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3024
HttpHelper.exe
13.107.21.200:80
g.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2596
Windows10UpgraderApp.exe
23.200.162.90:443
go.microsoft.com
AKAMAI-AS
PL
unknown

DNS requests

Domain
IP
Reputation
go.microsoft.com
  • 23.200.162.90
whitelisted
ctldl.windowsupdate.com
  • 2.16.2.89
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
download.microsoft.com
  • 104.91.48.252
whitelisted
crl3.digicert.com
  • 192.229.221.95
whitelisted
g.bing.com
  • 13.107.21.200
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
windows10 yeah.exe