PESCAN.IO - Analysis Report Basic

File Structure
Analysis Image
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
Information
Icon: Icon
Size: 209,92 KB
SHA-256 Hash: 9C4F20271F94E324857DF02590C8D715BAF55B5B51C83827EB1320FA4B9AC114
SHA-1 Hash: BE3A7BED2CC785640A6C22C35FE8B4A39E298C3C
MD5 Hash: D89C78C6E57F99124EAFDF9B6EF77741
Imphash: E00D60405A249A05D3B09AA7FE924B17
MajorOSVersion: 5
MinorOSVersion: 1
CheckSum: 000441DD
EntryPoint (rva): B612
SizeOfHeaders: 400
SizeOfImage: 37000
ImageBase: 400000
Architecture: x86
ImportTable: 1C150
IAT: 1C000
Characteristics: 102
TimeDateStamp: 601238CB
Date: 28/01/2021 4:08:43
File Type: EXE
Number Of Sections: 5
ASLR: Enabled
Section Names: .text, .data, .idata, .rsrc, .reloc
Number Of Executable Sections: 1
Subsystem: Windows GUI
UAC Execution Level Manifest: asInvoker
Sections Info
Section Name Flags ROffset RSize VOffset VSizeEntropyChi2
.text
0x60000020
Code
Executable
Readable
 400 18200 1000 18100
6.3548
1205674.17
.data
0xC0000040
Initialized Data
Readable
Writeable
 18600 C00 1A000 1698
2.5515
397026.83
.idata
0x40000040
Initialized Data
Readable
 19200 A00 1C000 8C2
5.0342
55610.2
.rsrc
0x40000040
Initialized Data
Readable
 19C00 17200 1D000 17110
3.9223
6567745.92
.reloc
0x42000040
Initialized Data
GP-Relative
Readable
 30E00 1600 35000 143C
6.3676
35823.18
Description
OriginalFilename: msedgeupdate.dll
CompanyName: Microsoft Corporation
LegalCopyright: Copyright Microsoft Corporation
ProductName: Microsoft Edge Update
FileVersion: 1.3.141.59
FileDescription: Microsoft Edge Update
ProductVersion: 1.3.141.59
Language: English (United States) (ID=0x409)
CodePage: Unicode (UTF-16 LE) (0x4B0)
Entry Point
The section number (1) - (.text) have the Entry Point
Information -> EntryPoint (calculated) - AA12
Code -> E8C0030000E97AFEFFFFC3558BEC56FF75088BF1E858000000C706B41140008BC65E5DC20400836104008BC183610800C741
Assembler
|CALL 0X40B9D7
|JMP 0X40B496
|RET
|PUSH EBP
|MOV EBP, ESP
|PUSH ESI
|PUSH DWORD PTR [EBP + 8]
|MOV ESI, ECX
|CALL 0X40B683
|MOV DWORD PTR [ESI], 0X4011B4
|MOV EAX, ESI
|POP ESI
|POP EBP
|RET 4
|AND DWORD PTR [ECX + 4], 0
|MOV EAX, ECX
|AND DWORD PTR [ECX + 8], 0
Signatures
Rich Signature Analyzer:
Code -> 8A77BAEBCE16D4B8CE16D4B8CE16D4B8DA7DD7B9C416D4B8DA7DD1B94316D4B8DA7DD0B9DC16D4B80579D0B9DF16D4B80579D7B9DF16D4B80579D1B9FF16D4B8DA7DD2B9CF16D4B8DA7DD5B9CB16D4B8CE16D5B8BD16D4B84866DDB9CC16D4B848662BB8CF16D4B8CE1643B89916D4B84866D6B9CF16D4B852696368CE16D4B8
Footprint md5 Hash -> 82AD5478A1108D357ACE0AA67AFC3E7A
• The Rich header apparently has not been modified
Certificate - Digital Signature:
• The file is signed and the signature is correct
Packer/Compiler
Compiler: Microsoft Visual Studio
Detect It Easy (die)
• PE: compiler: EP:Microsoft Visual C/C++(2017 v.15.5-6)[EXE32]
• PE: compiler: Microsoft Visual C/C++(-)[-]
• PE: linker: Microsoft Linker(14.26**)[-]
• PE: Sign tool: Windows Authenticode(2.0)[PKCS 7]
• Entropy: 5.62803
Suspicious Functions
Library Function Description
KERNEL32.DLL CopyFileW Copies an existing file to a new file.
KERNEL32.DLL WriteFile Writes data to a specified file or input/output (I/O) device.
KERNEL32.DLL GetModuleHandleW Retrieves a handle to the specified module.
KERNEL32.DLL GetProcAddress Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL).
KERNEL32.DLL IsDebuggerPresent Determines if the calling process is being debugged by a user-mode debugger.
KERNEL32.DLL CreateFileW Creates or opens a file object.
KERNEL32.DLL FindNextFileW Continues file and directory enumeration.
KERNEL32.DLL FindClose Closes a file search handle.
KERNEL32.DLL CloseHandle Closes an open object handle.
KERNEL32.DLL VirtualProtect Changes memory protection attributes.
KERNEL32.DLL CreateProcessW Creates and starts a new process.
KERNEL32.DLL CreateSemaphoreW Creates or opens a semaphore object.
KERNEL32.DLL GetSystemInfo Retrieves system hardware information.
ADVAPI32.DLL RegOpenKeyExW Opens an existing registry key.
Windows REG (UNICODE)
Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
File Access
ole32.dll
KERNEL32.dll
SHELL32.dll
ADVAPI32.dll
.dat
Temp
File Access (UNICODE)
msedgeupdate.dll
MicrosoftEdgeUpdateSetup.exe
MicrosoftEdgeUpdate.exe
kernel32.dll
mscoree.dll
SHELL32.dllKERNEL32.DLL
Interest's Words
exec
attrib
start
systeminfo
URLs
http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt
http://www.microsoft.com/pkiops/docs/primarycps.htm
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://www.microsoft.com/PKI/docs/CPS/default.htm
https://www.microsoft.com
IP Addresses
1.3.141.59
1.3.99.0
Strings/Hex Code Found With The File Rules
Rule Type Encoding Matched (Word)
Entry Point Hex Pattern Microsoft Visual C++ 8
Entry Point Hex Pattern Microsoft Visual C++ 8
Entry Point Hex Pattern Microsoft Visual C++ v7.0
Entry Point Hex Pattern PE-Exe Executable Image
Entry Point Hex Pattern VC8 - Microsoft Corporation
Resources
Path DataRVA Size FileOffset CodeText
\ICON\1\1033 1E040 128 1AC40 2800000010000000200000000100040000000000C00000000000000000000000100000001000000000000000000080000080(....... .........................................
\ICON\2\1033 1E168 568 1AD68 2800000010000000200000000100080000000000400100000000000000000000000100000001000000000000800080008000(....... ...........@.............................
\ICON\3\1033 1E6D0 2E8 1B2D0 2800000020000000400000000100040000000000800200000000000000000000100000001000000000000000000080000080(... ...@.........................................
\ICON\4\1033 1E9B8 8A8 1B5B8 2800000020000000400000000100080000000000000400000000000000000000000100000001000000000000800080008000(... ...@.........................................
\ICON\5\1033 1F260 668 1BE60 2800000030000000600000000100040000000000000600000000000000000000000000000000000000000000000080000080(...0............................................
\ICON\6\1033 1F8C8 EA8 1C4C8 2800000030000000600000000100080000000000800A00000000000000000000000100000000000000000000800080008000(...0............................................
\GROUP_ICON\101\1033 20770 5A 1D370 000001000600101010000100040028010000010010100000010008006805000002002020100001000400E802000003002020000001000800A8080000040030301000010004006806000005003030000001000800A80E00000600..............(.............h..... ............ ............00......h.....00............
\VERSION\1\1024 33D68 3A8 30968 A80334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1025 20B68 398 1D768 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1026 20F00 398 1DB00 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1027 21630 398 1E230 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1028 2C670 39C 29270 9C0334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1029 219C8 398 1E5C8 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1030 21D60 398 1E960 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1031 220F8 398 1ECF8 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1032 22490 398 1F090 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1033 22828 398 1F428 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1035 23DC8 398 209C8 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1036 244F8 398 210F8 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1037 261B8 398 22DB8 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1038 25358 398 21F58 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1039 25A88 398 22688 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1040 25E20 398 22A20 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1041 26550 398 23150 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1042 26C80 398 23880 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1043 285A8 398 251A8 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1044 28210 398 24E10 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1045 28940 398 25540 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1046 28CD8 39C 258D8 9C0334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1048 29418 398 26018 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1049 297B0 398 263B0 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1050 24FC0 398 21BC0 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1051 29B48 398 26748 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1052 327A8 398 2F3A8 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1053 2A610 398 27210 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1054 2B0D8 398 27CD8 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1055 2B470 398 28070 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1056 2BBA0 398 287A0 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1057 256F0 398 222F0 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1058 2B808 398 28408 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1060 29EE0 398 26AE0 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1061 23698 398 20298 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1062 273B0 398 23FB0 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1063 27018 398 23C18 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1065 23A30 398 20630 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1066 2BF38 398 28B38 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1068 2D140 398 29D40 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1069 2E358 398 2AF58 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1071 30E80 398 2DA80 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1078 2CA10 398 29610 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1079 2F558 398 2C158 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1081 24C28 398 21828 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1082 31218 398 2DE18 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1086 27E78 398 24A78 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1087 2F8F0 398 2C4F0 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1092 33638 398 30238 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1093 2D4D8 39C 2A0D8 9C0334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1094 32078 398 2EC78 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1095 24890 398 21490 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1096 31CE0 398 2E8E0 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1097 2A9A8 398 275A8 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1098 2AD40 398 27940 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1099 268E8 398 234E8 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1100 27748 398 24348 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1101 2CDA8 398 299A8 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1102 27AE0 398 246E0 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1106 2DFC0 398 2ABC0 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1107 2FC88 398 2C888 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1108 30750 398 2D350 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1110 2F1C0 398 2BDC0 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1111 30020 398 2CC20 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1118 207D0 398 1D3D0 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1121 315B0 398 2E1B0 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1124 24160 398 20D60 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1134 303B8 398 2CFB8 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1152 339D0 398 305D0 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1153 30AE8 398 2D6E8 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\1169 2EE28 398 2BA28 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\2051 2DC10 3B0 2A810 B00334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\2052 2C2D0 39C 28ED0 9C0334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\2057 22BC0 39C 1F7C0 9C0334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\2058 232F8 3A0 1FEF8 A00334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\2068 31948 398 2E548 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\2070 29078 39C 25C78 9C0334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\2074 2A278 398 26E78 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\2108 2EA90 398 2B690 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\2117 21298 398 1DE98 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\3082 22F60 398 1FB60 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\3084 2E6F0 39C 2B2F0 9C0334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\3179 32410 398 2F010 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\5146 2D878 398 2A478 980334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\7194 32B40 3A8 2F740 A80334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\9242 33290 3A8 2FE90 A80334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\VERSION\1\10266 32EE8 3A8 2FAE8 A80334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\24\1\1033 1DA30 60C 1A630 3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D227574662D38223F3E0D0A3C617373656D626C7920<?xml version="1.0" encoding="utf-8"?>..<assembly
Intelligent String
• 1.3.141.59
• 1.3.99.0
• msedgeupdate.dll
• kernel32.dll
• ADVAPI32.dll
• shell32.dll
• mscoree.dll
• MicrosoftEdgeUpdate.exe
• MicrosoftEdgeUpdateSetup.exe
• MicrosoftEdgeUpdate_unsigned.pdb
• .bss
• KERNEL32.dll
• <asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">
Flow Anomalies
Offset FlowVA Section Description
818D 41C000 .text CALL [static] | Indirect call to absolute memory address
8291 41AA64 .text CALL [static] | Indirect call to absolute memory address
8316 41C144 .text CALL [static] | Indirect call to absolute memory address
839C 41C018 .text CALL [static] | Indirect call to absolute memory address
85E6 41C010 .text CALL [static] | Indirect call to absolute memory address
866C 41C000 .text CALL [static] | Indirect call to absolute memory address
86C1 41C014 .text CALL [static] | Indirect call to absolute memory address
8A38 41C01C .text CALL [static] | Indirect call to absolute memory address
8A42 41C004 .text CALL [static] | Indirect call to absolute memory address
8C0F 41AA58 .text CALL [static] | Indirect call to absolute memory address
8C31 41AA54 .text CALL [static] | Indirect call to absolute memory address
8CDF 41AA54 .text CALL [static] | Indirect call to absolute memory address
9E7D 41C024 .text CALL [static] | Indirect call to absolute memory address
9E84 41C00C .text CALL [static] | Indirect call to absolute memory address
9E95 41C020 .text CALL [static] | Indirect call to absolute memory address
9F01 41C00C .text CALL [static] | Indirect call to absolute memory address
9F0B 41C004 .text CALL [static] | Indirect call to absolute memory address
A0C3 41C024 .text CALL [static] | Indirect call to absolute memory address
A0D9 41C00C .text CALL [static] | Indirect call to absolute memory address
A0EE 41C00C .text CALL [static] | Indirect call to absolute memory address
A136 41C14C .text CALL [static] | Indirect call to absolute memory address
A16F 41C038 .text CALL [static] | Indirect call to absolute memory address
A18A 41C030 .text CALL [static] | Indirect call to absolute memory address
A2A2 41C034 .text CALL [static] | Indirect call to absolute memory address
A303 41C14C .text CALL [static] | Indirect call to absolute memory address
A39C 41C02C .text CALL [static] | Indirect call to absolute memory address
A3E7 41C14C .text CALL [static] | Indirect call to absolute memory address
A413 41C14C .text CALL [static] | Indirect call to absolute memory address
A428 41C03C .text CALL [static] | Indirect call to absolute memory address
A434 41C004 .text CALL [static] | Indirect call to absolute memory address
A44F 41C14C .text CALL [static] | Indirect call to absolute memory address
A474 41C02C .text CALL [static] | Indirect call to absolute memory address
A48E 41C014 .text CALL [static] | Indirect call to absolute memory address
A4A9 41C14C .text CALL [static] | Indirect call to absolute memory address
A4F6 41C00C .text CALL [static] | Indirect call to absolute memory address
A502 41C004 .text CALL [static] | Indirect call to absolute memory address
A51D 41C14C .text CALL [static] | Indirect call to absolute memory address
A542 41C02C .text CALL [static] | Indirect call to absolute memory address
A571 41C14C .text CALL [static] | Indirect call to absolute memory address
A59D 41C044 .text CALL [static] | Indirect call to absolute memory address
A5A6 41C040 .text CALL [static] | Indirect call to absolute memory address
A5B1 41C048 .text CALL [static] | Indirect call to absolute memory address
A5B8 41C04C .text CALL [static] | Indirect call to absolute memory address
A94E 41C14C .text CALL [static] | Indirect call to absolute memory address
AD9C 41C060 .text CALL [static] | Indirect call to absolute memory address
ADAB 41C05C .text CALL [static] | Indirect call to absolute memory address
ADB4 41C058 .text CALL [static] | Indirect call to absolute memory address
ADC1 41C054 .text CALL [static] | Indirect call to absolute memory address
AE34 41C064 .text CALL [static] | Indirect call to absolute memory address
AF77 41C068 .text CALL [static] | Indirect call to absolute memory address
AF97 41C044 .text CALL [static] | Indirect call to absolute memory address
AFA1 41C040 .text CALL [static] | Indirect call to absolute memory address
AFD4 41C06C .text CALL [static] | Indirect call to absolute memory address
AFF2 41C024 .text CALL [static] | Indirect call to absolute memory address
B038 41C044 .text CALL [static] | Indirect call to absolute memory address
B0B6 41C14C .text CALL [static] | Indirect call to absolute memory address
B0E2 41C14C .text CALL [static] | Indirect call to absolute memory address
B394 41C074 .text CALL [static] | Indirect call to absolute memory address
B3A7 41C070 .text JMP [static] | Indirect jump to absolute memory address
B3BD 41C024 .text CALL [static] | Indirect call to absolute memory address
B3CB 41C00C .text CALL [static] | Indirect call to absolute memory address
B425 41C14C .text CALL [static] | Indirect call to absolute memory address
B440 41C004 .text CALL [static] | Indirect call to absolute memory address
B450 41C094 .text CALL [static] | Indirect call to absolute memory address
B464 41C004 .text CALL [static] | Indirect call to absolute memory address
B47D 41C0A4 .text CALL [static] | Indirect call to absolute memory address
B498 41C0A8 .text CALL [static] | Indirect call to absolute memory address
B4AE 41C004 .text CALL [static] | Indirect call to absolute memory address
B4C9 41C008 .text CALL [static] | Indirect call to absolute memory address
B4EE 41C0A0 .text CALL [static] | Indirect call to absolute memory address
B530 41C0B0 .text CALL [static] | Indirect call to absolute memory address
B55C 41C0B0 .text CALL [static] | Indirect call to absolute memory address
B568 41C004 .text CALL [static] | Indirect call to absolute memory address
B58C 41C0B0 .text CALL [static] | Indirect call to absolute memory address
B598 41C004 .text CALL [static] | Indirect call to absolute memory address
B614 41C07C .text CALL [static] | Indirect call to absolute memory address
B621 41C004 .text CALL [static] | Indirect call to absolute memory address
B652 41C07C .text CALL [static] | Indirect call to absolute memory address
B65F 41C004 .text CALL [static] | Indirect call to absolute memory address
B70D 41C078 .text CALL [static] | Indirect call to absolute memory address
B720 41C004 .text CALL [static] | Indirect call to absolute memory address
B768 41C08C .text CALL [static] | Indirect call to absolute memory address
B776 41C004 .text CALL [static] | Indirect call to absolute memory address
B78C 41C084 .text CALL [static] | Indirect call to absolute memory address
B7BC 41C088 .text CALL [static] | Indirect call to absolute memory address
B7C9 41C004 .text CALL [static] | Indirect call to absolute memory address
B7E3 41C088 .text CALL [static] | Indirect call to absolute memory address
B7F0 41C004 .text CALL [static] | Indirect call to absolute memory address
B8C2 41C090 .text CALL [static] | Indirect call to absolute memory address
B8CC 41C004 .text CALL [static] | Indirect call to absolute memory address
B98E 41C14C .text CALL [static] | Indirect call to absolute memory address
B99E 41C004 .text CALL [static] | Indirect call to absolute memory address
B9EA 41C14C .text CALL [static] | Indirect call to absolute memory address
BA31 41C14C .text CALL [static] | Indirect call to absolute memory address
BA72 41C094 .text CALL [static] | Indirect call to absolute memory address
BADE 41C088 .text CALL [static] | Indirect call to absolute memory address
BAEE 41C084 .text CALL [static] | Indirect call to absolute memory address
BB58 41C07C .text CALL [static] | Indirect call to absolute memory address
BB68 41C004 .text CALL [static] | Indirect call to absolute memory address
BBC1 41C098 .text CALL [static] | Indirect call to absolute memory address
32400 N/A *Overlay* B0230000000202003082239D06092A864886F70D | .......0....*.H...
Extra Analysis
Metric Value Percentage
Ascii Code 108560 50,5024%
Null Byte Code 74041 34,4441%
© 2026 All rights reserved.