PESCAN.IO - Analysis Report Basic

File Structure
Analysis Image
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
Information
Icon: Icon
Size: 1,92 MB
SHA-256 Hash: A498CDD37380D37071FFB4BFE304666AEED3948ED735A2E71DE1DCA2E7E16375
SHA-1 Hash: 815CA3478462B28823A66C95FC22FB67BF6BCEF8
MD5 Hash: E5B219A45076F795BA0032C1C9597AA6
Imphash: 7899CB8BA886A0690BDC28D8B481BBD1
MajorOSVersion: 5
MinorOSVersion: 1
CheckSum: 001E8874
EntryPoint (rva): 8400
SizeOfHeaders: 400
SizeOfImage: 1EC000
ImageBase: 400000
Architecture: x86
ImportTable: 24624
IAT: 1C000
Characteristics: 102
TimeDateStamp: 69444728
Date: 18/12/2025 18:25:44
File Type: EXE
Number Of Sections: 6
ASLR: Enabled
Section Names: .text, .rdata, .data, .didat, .rsrc, .reloc
Number Of Executable Sections: 1
Subsystem: Windows GUI
UAC Execution Level Manifest: asInvoker
Sections Info
Section Name Flags ROffset RSize VOffset VSizeEntropyChi2
.text
0x60000020
Code
Executable
Readable
 400 1B000 1000 1AEEA
6.7216
524775.92
.rdata
0x40000040
Initialized Data
Readable
 1B400 9400 1C000 93C4
5.0103
1850516.47
.data
0xC0000040
Initialized Data
Readable
Writeable
 24800 A00 26000 142C
2.2253
372747.2
.didat
0xC0000040
Initialized Data
Readable
Writeable
 25200 200 28000 2C
0.4372
117186
.rsrc
0x40000040
Initialized Data
Readable
 25400 174E00 29000 174CF8
7.9856
51832.25
.reloc
0x42000040
Initialized Data
GP-Relative
Readable
 19A200 4DA00 19E000 4DA00
7.6888
269619.24
Description
OriginalFilename: MicrosoftEdgeUpdateSetup.exe
CompanyName: Microsoft Corporation
LegalCopyright: Copyright Microsoft Corporation
ProductName: Microsoft Edge Update
FileVersion: 1.3.215.9
FileDescription: Microsoft Edge Update Setup
ProductVersion: async
Language: English (United States) (ID=0x409)
CodePage: Unicode (UTF-16 LE) (0x4B0)
Entry Point
The section number (1) - (.text) have the Entry Point
Information -> EntryPoint (calculated) - 7800
Code -> E8A3020000E978FEFFFF558BEC8B4508568B483C03C80FB741148D511803D00FB741066BF02803F23BD674198B4D0C3B4A0C
Assembler
|CALL 0X4086A8
|JMP 0X408282
|PUSH EBP
|MOV EBP, ESP
|MOV EAX, DWORD PTR [EBP + 8]
|PUSH ESI
|MOV ECX, DWORD PTR [EAX + 0X3C]
|ADD ECX, EAX
|MOVZX EAX, WORD PTR [ECX + 0X14]
|LEA EDX, [ECX + 0X18]
|ADD EDX, EAX
|MOVZX EAX, WORD PTR [ECX + 6]
|IMUL ESI, EAX, 0X28
|ADD ESI, EDX
|CMP EDX, ESI
|JE 0X408445
|MOV ECX, DWORD PTR [EBP + 0XC]
|CMP ECX, DWORD PTR [EDX + 0XC]
Signatures
CheckSum Integrity Problem:
• Header: 2001012
• Calculated: 2070887
Rich Signature Analyzer:
Code -> 7208E1E536698FB636698FB636698FB622028CB73D698FB622028AB7A5698FB654118BB727698FB654118CB722698FB6B61086B73B698FB654118AB702698FB622028BB725698FB6220289B737698FB622028EB73B698FB636698EB69F698FB6B61070B637698FB6366918B660698FB6B6108DB737698FB65269636836698FB6
Footprint md5 Hash -> 36573D0B359CD99B781FFAF8603D636C
• The Rich header apparently has not been modified
Certificate - Digital Signature:
• The file is signed but has been modified
Packer/Compiler
Compiler: Microsoft Visual Studio
Detect It Easy (die)
• PE: compiler: EP:Microsoft Visual C/C++(2017 v.15.5-6)[EXE32]
• PE: compiler: Microsoft Visual C/C++(-)[-]
• PE: linker: Microsoft Linker(14.31**)[-]
• PE: Sign tool: Windows Authenticode(2.0)[PKCS 7]
• Entropy: 7.93658
Suspicious Functions
Library Function Description
KERNEL32.DLL CreateMutexW Create a named or unnamed mutex object for controlling access to a shared resource.
KERNEL32.DLL CopyFileW Copies an existing file to a new file.
KERNEL32.DLL WriteFile Writes data to a specified file or input/output (I/O) device.
KERNEL32.DLL GetModuleHandleW Retrieves a handle to the specified module.
KERNEL32.DLL GetProcAddress Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL).
KERNEL32.DLL IsDebuggerPresent Determines if the calling process is being debugged by a user-mode debugger.
KERNEL32.DLL GetTempPathW Retrieves the temporary directory path.
KERNEL32.DLL CreateFileW Creates or opens a file object.
KERNEL32.DLL FindFirstFileW Starts file and directory enumeration.
KERNEL32.DLL FindNextFileW Continues file and directory enumeration.
KERNEL32.DLL FindClose Closes a file search handle.
KERNEL32.DLL CloseHandle Closes an open object handle.
KERNEL32.DLL UnmapViewOfFile Unmaps a mapped file view.
KERNEL32.DLL MapViewOfFile Maps a file into memory.
KERNEL32.DLL CreateFileMappingW Creates a file mapping object.
KERNEL32.DLL VirtualProtect Changes memory protection attributes.
KERNEL32.DLL CreateProcessW Creates and starts a new process.
KERNEL32.DLL CreateEventW Creates or opens an event object.
KERNEL32.DLL GetSystemInfo Retrieves system hardware information.
ADVAPI32.DLL RegCreateKeyExA Creates a new registry key or opens an existing one.
ADVAPI32.DLL RegSetValueExA Sets the data and type of a specified value under a registry key.
ADVAPI32.DLL RegDeleteValueA Removes a named value from the specified registry key. Note that value names are not case sensitive.
ADVAPI32.DLL RegCreateKeyExA Creates or opens a registry key.
ADVAPI32.DLL RegOpenKeyExA Opens an existing registry key.
ADVAPI32.DLL RegOpenKeyExW Opens an existing registry key.
ADVAPI32.DLL RegSetValueExW Writes data to a registry value.
Windows REG
SOFTWARE\Microsoft\EdgeUpdate
Windows REG (UNICODE)
Software\OEM\MicrosoftEdge
SOFTWARE\Microsoft\EdgeUpdate
File Access
USER32.dll
SHELL32.dll
ole32.dll
ADVAPI32.dll
KERNEL32.dll
VERSION.dll
SHLWAPI.dll
.dat
@.dat
Temp
File Access (UNICODE)
MicrosoftEdgeUpdateSetup.exe
CopilotUpdateSetup.exe
kernelbase.dll
kernel32.dll
KERNEL32.DLL
api-ms-win-core-synch-l1-2-0.dll
mscoree.dll
Temp
Interest's Words
PADDINGX
exec
attrib
start
systeminfo
ping
URLs
http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt
http://www.microsoft.com/pkiops/docs/primarycps.htm
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt
http://www.microsoft.com/pkiops/Docs/Repository.htm
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
https://www.microsoft.com
IP Addresses
1.3.215.9
1.3.99.0
Strings/Hex Code Found With The File Rules
Rule Type Encoding Matched (Word)
Text Ascii Malicious rerouting of traffic to an attacker-controlled site (Redirect)
Entry Point Hex Pattern Microsoft Visual C++ 8
Entry Point Hex Pattern Microsoft Visual C++ 8
Entry Point Hex Pattern Microsoft Visual C++ v7.0
Entry Point Hex Pattern PE-Exe Executable Image
Entry Point Hex Pattern VC8 - Microsoft Corporation
Resources
Path DataRVA Size FileOffset CodeText
\B\102\0 29B10 169F42 25F10 5D00008000025A800000000000000013132DA6CB4AF1FBE17D3109ECB0DEC1B71F0A96C45CC027639D3DC111E065D6321F5D].....Z..........-..J...}1..........\.’c.=...e.2.]
\GOOGLEUPDATE\1\0 193A54 4 18FE54 01000000....
\ICON\1\1033 193A58 128 18FE58 2800000010000000200000000100040000000000C00000000000000000000000100000001000000000000000000080000080(....... .........................................
\ICON\2\1033 193B80 568 18FF80 2800000010000000200000000100080000000000400100000000000000000000000100000001000000000000800080008000(....... ...........@.............................
\ICON\3\1033 1940E8 2E8 1904E8 2800000020000000400000000100040000000000800200000000000000000000100000001000000000000000000080000080(... ...@.........................................
\ICON\4\1033 1943D0 8A8 1907D0 2800000020000000400000000100080000000000000400000000000000000000000100000001000000000000800080008000(... ...@.........................................
\ICON\5\1033 194C78 668 191078 2800000030000000600000000100040000000000000600000000000000000000000000000000000000000000000080000080(...0............................................
\ICON\6\1033 1952E0 EA8 1916E0 2800000030000000600000000100080000000000800A00000000000000000000000100000000000000000000800080008000(...0............................................
\STRING\1223\1025 196188 130 192588 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000D0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1026 1962B8 1B2 1926B8 00000000000000000000000000000000000009004D006900630072006F0073006F006600740020001F0440043E0433044004....................M.i.c.r.o.s.o.f.t. ...@.>.3.@.
\STRING\1223\1027 19646C 16E 19286C 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400150049006E00730074006100....................M.i.c.r.o.s.o.f.t...I.n.s.t.a.
\STRING\1223\1028 1965DC BA 1929DC 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400090025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1029 196698 1BE 192A98 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400270049006E00730074006100....................M.i.c.r.o.s.o.f.t.’.I.n.s.t.a.
\STRING\1223\1030 196858 136 192C58 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000F0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1031 196990 192 192D90 00000000000000000000000000000000000009004D006900630072006F0073006F00660074001B0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1032 196B24 192 192F24 00000000000000000000000000000000000009004D006900630072006F0073006F00660074001C00A003C103CC03B303C103....................M.i.c.r.o.s.o.f.t.............
\STRING\1223\1033 196CB8 126 1930B8 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000F0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1035 196DE0 18C 1931E0 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400140025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1036 196F6C 1C4 19336C 00000000000000000000000000000000000009004D006900630072006F0073006F00660074002100500072006F0067007200....................M.i.c.r.o.s.o.f.t.!.P.r.o.g.r.
\STRING\1223\1037 197130 108 193530 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000B00DE05EA05E705D905DF05....................M.i.c.r.o.s.o.f.t.............
\STRING\1223\1038 197238 16C 193638 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400100025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1039 1973A4 170 1937A4 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400180055007000700073006500....................M.i.c.r.o.s.o.f.t...U.p.p.s.e.
\STRING\1223\1040 197514 1C8 193914 00000000000000000000000000000000000009004D006900630072006F0073006F00660074002300500072006F0067007200....................M.i.c.r.o.s.o.f.t..P.r.o.g.r.
\STRING\1223\1041 1976DC F6 193ADC 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000D0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1042 1977D4 E0 193BD4 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000C0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1043 1978B4 12E 193CB4 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000F0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1044 1979E4 18C 193DE4 00000000000000000000000000000000000009004D006900630072006F0073006F00660074001E0049006E00730074006100....................M.i.c.r.o.s.o.f.t...I.n.s.t.a.
\STRING\1223\1045 197B70 168 193F70 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400100049006E00730074006100....................M.i.c.r.o.s.o.f.t...I.n.s.t.a.
\STRING\1223\1046 197CD8 142 1940D8 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400100049006E00730074006100....................M.i.c.r.o.s.o.f.t...I.n.s.t.a.
\STRING\1223\1048 197E1C 1A8 19421C 00000000000000000000000000000000000009004D006900630072006F0073006F00660074001A00500072006F0067007200....................M.i.c.r.o.s.o.f.t...P.r.o.g.r.
\STRING\1223\1049 197FC4 184 1943C4 0000000000000000000000000000000000000A001C04300439043A0440043E0441043E044404420410002304410442043004......................0.9.:.@.>.A.>.D.B....A.B.0.
\STRING\1223\1050 198148 194 194548 00000000000000000000000000000000000009004D006900630072006F0073006F00660074001B0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1051 1982DC 180 1946DC 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400180049006E00610174006100....................M.i.c.r.o.s.o.f.t...I.n.a.t.a.
\STRING\1223\1052 19845C 156 19485C 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400120049006E00730074006100....................M.i.c.r.o.s.o.f.t...I.n.s.t.a.
\STRING\1223\1053 1985B4 17E 1949B4 00000000000000000000000000000000000009004D006900630072006F0073006F00660074001E0049006E00730074006100....................M.i.c.r.o.s.o.f.t...I.n.s.t.a.
\STRING\1223\1054 198734 14C 194B34 00000000000000000000000000000000000009004D006900630072006F0073006F00660074001000150E310E270E150E340E....................M.i.c.r.o.s.o.f.t.....1.’...4.
\STRING\1223\1055 198880 148 194C80 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400110025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1056 1989C8 134 194DC8 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000F0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1057 198AFC 160 194EFC 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000F0049006E00730074006100....................M.i.c.r.o.s.o.f.t...I.n.s.t.a.
\STRING\1223\1058 198C5C 196 19505C 0000000000000000000000000000000000000A001C04300439043A0440043E0441043E0444044204100006043D0441044204......................0.9.:.@.>.A.>.D.B.....=.A.B.
\STRING\1223\1060 198DF4 188 1951F4 00000000000000000000000000000000000009004D006900630072006F0073006F00660074001A004E0061006D0065007300....................M.i.c.r.o.s.o.f.t...N.a.m.e.s.
\STRING\1223\1061 198F7C 12C 19537C 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000F0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1062 1990A8 152 1954A8 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400110025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1063 1991FC 164 1955FC 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400160025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1065 199360 13A 195760 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000F004606350628060C20A906....................M.i.c.r.o.s.o.f.t...F.5.(.. ..
\STRING\1223\1066 19949C 156 19589C 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400130025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1068 1995F4 16A 1959F4 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400130025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1069 199760 15E 195B60 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400140025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1071 1998C0 194 195CC0 00000000000000000000000000000000000009004D006900630072006F0073006F00660074001D0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1078 199A54 136 195E54 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400130025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1079 199B8C 148 195F8C 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400140025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1081 199CD4 126 1960D4 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000E0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1082 199DFC 156 1961FC 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400110025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1086 199F54 138 196354 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000E00500065006D0061007300....................M.i.c.r.o.s.o.f.t...P.e.m.a.s.
\STRING\1223\1087 19A08C 17E 19648C 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400130025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1092 19A20C 178 19660C 0000000000000000000000000000000000000A001C04300439043A0440043E0441043E044404420411002500310021007300......................0.9.:.@.>.A.>.D.B...%.1.!.s.
\STRING\1223\1093 19A384 13E 196784 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000E0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1094 19A4C4 122 1968C4 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000B0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1095 19A5E8 134 1969E8 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000F0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1096 19A71C 12E 196B1C 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000E0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1097 19A84C 15A 196C4C 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000C0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1098 19A9A8 14C 196DA8 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400110025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1099 19AAF4 12E 196EF4 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000C0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1100 19AC24 16E 197024 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400100025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1101 19AD94 124 197194 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000E0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1102 19AEB8 132 1972B8 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000E0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1106 19AFEC 12A 1973EC 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000D0047006F0073006F006400....................M.i.c.r.o.s.o.f.t...G.o.s.o.d.
\STRING\1223\1107 19B118 126 197518 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000F00A2178417D21782178A17....................M.i.c.r.o.s.o.f.t.............
\STRING\1223\1108 19B240 130 197640 00000000000000000000000000000000000009004D006900630072006F0073006F00660074001000950EBB0EA70E950EB40E....................M.i.c.r.o.s.o.f.t.............
\STRING\1223\1110 19B370 14A 197770 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400130049006E00730074006100....................M.i.c.r.o.s.o.f.t...I.n.s.t.a.
\STRING\1223\1111 19B4BC 118 1978BC 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000E0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1118 19B5D4 E8 1979D4 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400090025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1121 19B6BC 120 197ABC 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000C0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1124 19B7DC 150 197BDC 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000F0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1134 19B92C 160 197D2C 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000F0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1152 19BA8C 154 197E8C 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000F0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\1153 19BBE0 13C 197FE0 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000D0050006B01740001017500....................M.i.c.r.o.s.o.f.t...P.k.t...u.
\STRING\1223\1169 19BD1C 170 19811C 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400110053007400E0006C006100....................M.i.c.r.o.s.o.f.t...S.t...l.a.
\STRING\1223\2051 19BE8C 1A6 19828C 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400150049006E00730074006100....................M.i.c.r.o.s.o.f.t...I.n.s.t.a.
\STRING\1223\2052 19C034 BE 198434 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000A0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\2057 19C0F4 126 1984F4 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000F0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\2058 19C21C 150 19861C 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400130049006E00730074006100....................M.i.c.r.o.s.o.f.t...I.n.s.t.a.
\STRING\1223\2068 19C36C 18E 19876C 00000000000000000000000000000000000009004D006900630072006F0073006F00660074001E0049006E00730074006100....................M.i.c.r.o.s.o.f.t...I.n.s.t.a.
\STRING\1223\2070 19C4FC 156 1988FC 00000000000000000000000000000000000009004D006900630072006F0073006F0066007400130049006E00730074006100....................M.i.c.r.o.s.o.f.t...I.n.s.t.a.
\STRING\1223\2074 19C654 150 198A54 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000F0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\2108 19C7A4 13E 198BA4 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000F0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\2117 19C8E4 13E 198CE4 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000E0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\3082 19CA24 13E 198E24 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000F0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\3084 19CB64 1C4 198F64 00000000000000000000000000000000000009004D006900630072006F0073006F00660074002100500072006F0067007200....................M.i.c.r.o.s.o.f.t.!.P.r.o.g.r.
\STRING\1223\3179 19CD28 132 199128 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000C0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\5146 19CE5C 18A 19925C 00000000000000000000000000000000000009004D006900630072006F0073006F00660074001B0049006E00730074006100....................M.i.c.r.o.s.o.f.t...I.n.s.t.a.
\STRING\1223\7194 19CFE8 150 1993E8 00000000000000000000000000000000000009004D006900630072006F0073006F00660074000F0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\9242 19D138 17C 199538 00000000000000000000000000000000000009004D006900630072006F0073006F00660074001A0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\STRING\1223\10266 19D2B4 17A 1996B4 00000000000000000000000000000000000009004D006900630072006F0073006F00660074001A0025003100210073002100....................M.i.c.r.o.s.o.f.t...%.1.!.s.!.
\GROUP_ICON\101\1033 19D430 5A 199830 000001000600101010000100040028010000010010100000010008006805000002002020100001000400E802000003002020000001000800A8080000040030301000010004006806000005003030000001000800A80E00000600..............(.............h..... ............ ............00......h.....00............
\VERSION\1\1033 19D48C 3C0 19988C C00334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\24\1\0 19D84C 4AC 199C4C 3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D227574662D38223F3E0D0A3C617373656D626C7920<?xml version="1.0" encoding="utf-8"?>..<assembly
Intelligent String
• 1.3.215.9
• MicrosoftEdgeUpdateSetup.exe
• mscoree.dll
• api-ms-win-core-synch-l1-2-0.dll
• SHLWAPI.dll
• KERNEL32.DLL
• kernel32.dll
• CopilotUpdateSetup.exe
• kernelbase.dll
• .exe
• FGlobal\EdgeUpdate
• mi_exe_stub.pdb
• .tls
• .bss
• 1.3.99.0
• <asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">
Flow Anomalies
Offset FlowVA Section Description
4B7 41C0D8 .text CALL [static] | Indirect call to absolute memory address
572 41C134 .text CALL [static] | Indirect call to absolute memory address
57C 41C148 .text CALL [static] | Indirect call to absolute memory address
5A1 41C1B8 .text CALL [static] | Indirect call to absolute memory address
5AC 41C1AC .text CALL [static] | Indirect call to absolute memory address
5BA 41C188 .text CALL [static] | Indirect call to absolute memory address
60A 41C1C0 .text CALL [static] | Indirect call to absolute memory address
62B 41C094 .text CALL [static] | Indirect call to absolute memory address
651 41C098 .text CALL [static] | Indirect call to absolute memory address
677 41C250 .text CALL [static] | Indirect call to absolute memory address
691 41C250 .text CALL [static] | Indirect call to absolute memory address
6A8 41C0E8 .text CALL [static] | Indirect call to absolute memory address
6CB 41C0E4 .text CALL [static] | Indirect call to absolute memory address
71E 41C250 .text CALL [static] | Indirect call to absolute memory address
777 41C0E0 .text CALL [static] | Indirect call to absolute memory address
86A 41C250 .text CALL [static] | Indirect call to absolute memory address
8B2 41C250 .text CALL [static] | Indirect call to absolute memory address
921 41C250 .text CALL [static] | Indirect call to absolute memory address
A34 41C1C8 .text CALL [static] | Indirect call to absolute memory address
A3C 41C1C8 .text CALL [static] | Indirect call to absolute memory address
A44 41C1C8 .text CALL [static] | Indirect call to absolute memory address
A6C 41C1D0 .text CALL [static] | Indirect call to absolute memory address
C97 41C0BC .text CALL [static] | Indirect call to absolute memory address
C9E 41C228 .text CALL [static] | Indirect call to absolute memory address
CE0 428008 .text CALL [static] | Indirect call to absolute memory address
D00 428008 .text CALL [static] | Indirect call to absolute memory address
D19 41C1C4 .text CALL [static] | Indirect call to absolute memory address
D7A 41C0BC .text CALL [static] | Indirect call to absolute memory address
D81 41C228 .text CALL [static] | Indirect call to absolute memory address
D99 428014 .text CALL [static] | Indirect call to absolute memory address
DB1 41C1C4 .text CALL [static] | Indirect call to absolute memory address
EED 41C1BC .text CALL [static] | Indirect call to absolute memory address
F0E 42800C .text CALL [static] | Indirect call to absolute memory address
F2C 41C250 .text CALL [static] | Indirect call to absolute memory address
F65 41C250 .text CALL [static] | Indirect call to absolute memory address
FAB 41C250 .text CALL [static] | Indirect call to absolute memory address
1013 428010 .text CALL [static] | Indirect call to absolute memory address
1041 41C084 .text CALL [static] | Indirect call to absolute memory address
1161 41C1B0 .text CALL [static] | Indirect call to absolute memory address
1178 41C194 .text CALL [static] | Indirect call to absolute memory address
123C 41C084 .text CALL [static] | Indirect call to absolute memory address
1306 41C1D8 .text CALL [static] | Indirect call to absolute memory address
1376 41C220 .text CALL [static] | Indirect call to absolute memory address
138D 41C1A8 .text CALL [static] | Indirect call to absolute memory address
13A0 41C240 .text CALL [static] | Indirect call to absolute memory address
1426 41C1A4 .text CALL [static] | Indirect call to absolute memory address
1430 41C148 .text CALL [static] | Indirect call to absolute memory address
14DC 41C18C .text CALL [static] | Indirect call to absolute memory address
15BF 41C174 .text CALL [static] | Indirect call to absolute memory address
16B8 41C1B0 .text CALL [static] | Indirect call to absolute memory address
16C6 41C0A4 .text CALL [static] | Indirect call to absolute memory address
16D5 41C09C .text CALL [static] | Indirect call to absolute memory address
1708 41C194 .text CALL [static] | Indirect call to absolute memory address
1785 41C0A0 .text CALL [static] | Indirect call to absolute memory address
17B1 410 .text JMP [static] | Indirect jump to absolute memory address
1824 41C174 .text CALL [static] | Indirect call to absolute memory address
18B4 41C0A4 .text CALL [static] | Indirect call to absolute memory address
18C3 41C09C .text CALL [static] | Indirect call to absolute memory address
1919 41C184 .text CALL [static] | Indirect call to absolute memory address
1923 41C148 .text CALL [static] | Indirect call to absolute memory address
197B 41C1D4 .text CALL [static] | Indirect call to absolute memory address
1999 41C1B0 .text CALL [static] | Indirect call to absolute memory address
19A3 41C184 .text CALL [static] | Indirect call to absolute memory address
19EE 41C224 .text CALL [static] | Indirect call to absolute memory address
1A28 41C22C .text CALL [static] | Indirect call to absolute memory address
1A5D 41C184 .text CALL [static] | Indirect call to absolute memory address
1A67 41C148 .text CALL [static] | Indirect call to absolute memory address
1AFC 41C114 .text CALL [static] | Indirect call to absolute memory address
1B0C 41C11C .text CALL [static] | Indirect call to absolute memory address
1B2C 41C250 .text CALL [static] | Indirect call to absolute memory address
1B47 41C198 .text CALL [static] | Indirect call to absolute memory address
1BC4 41C1BC .text CALL [static] | Indirect call to absolute memory address
1BE4 41C188 .text CALL [static] | Indirect call to absolute memory address
1C07 41C250 .text CALL [static] | Indirect call to absolute memory address
1C67 41C1D4 .text CALL [static] | Indirect call to absolute memory address
1C92 428000 .text CALL [static] | Indirect call to absolute memory address
1CBE 41C250 .text CALL [static] | Indirect call to absolute memory address
1D13 41C084 .text CALL [static] | Indirect call to absolute memory address
1D5E 41C190 .text CALL [static] | Indirect call to absolute memory address
1D6C 41C148 .text CALL [static] | Indirect call to absolute memory address
1D7A 41C1CC .text CALL [static] | Indirect call to absolute memory address
1D8D 41C1A0 .text CALL [static] | Indirect call to absolute memory address
1D9E 41C1A0 .text CALL [static] | Indirect call to absolute memory address
1E8A 41C234 .text CALL [static] | Indirect call to absolute memory address
1EF8 41C1D8 .text CALL [static] | Indirect call to absolute memory address
1F08 41C1D8 .text CALL [static] | Indirect call to absolute memory address
2085 41C250 .text CALL [static] | Indirect call to absolute memory address
20AD 41C250 .text CALL [static] | Indirect call to absolute memory address
2186 41C250 .text CALL [static] | Indirect call to absolute memory address
228E 41C238 .text CALL [static] | Indirect call to absolute memory address
22DD 41C068 .text CALL [static] | Indirect call to absolute memory address
2305 41C064 .text CALL [static] | Indirect call to absolute memory address
2335 41C000 .text CALL [static] | Indirect call to absolute memory address
233E 41C060 .text CALL [static] | Indirect call to absolute memory address
238D 41C084 .text CALL [static] | Indirect call to absolute memory address
240B 41C068 .text CALL [static] | Indirect call to absolute memory address
242F 41C06C .text CALL [static] | Indirect call to absolute memory address
243B 41C060 .text CALL [static] | Indirect call to absolute memory address
248A 41C084 .text CALL [static] | Indirect call to absolute memory address
2501 41C148 .text CALL [static] | Indirect call to absolute memory address
1E7C00 N/A *Overlay* 10300000000202003082300006092A864886F70D | .0......0.0...*.H...
Extra Analysis
Metric Value Percentage
Ascii Code 1359944 67,6546%
Null Byte Code 55217 2,7469%
© 2026 All rights reserved.