filenameWSReset.exe
size94208 (0x17000)
md588ae4c53af6d75d5cbf41e2afa030c82
typePE32+ executable (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
147307294
259274122
2602741218
261274123
2572741215
1083
264274124
255274121
258274121

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x46eb9cff
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion14.20
SizeOfCode0x2800
SizeOfInitializedData0x14a00
SizeOfUninitializedData0
AddressOfEntryPoint0x2fe0
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion10.0
ImageVersion10.0
SubsystemVersion10.0
Reserved10
SizeOfImage0x1b000
SizeOfHeaders0x400
CheckSum0x1e281
Subsystem3
DllCharacteristics0xc160
SizeOfStackReserve0x80000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 8.0

Sections

namevavsizeraw sizeflags
.text0x10000x27f00x2800R-X CODE
.rdata0x40000x1ed20x2000R-- IDATA
.data0x60000x6b00x200RW- IDATA
.pdata0x70000x2580x400R-- IDATA
.rsrc0x80000x11a780x11c00R-- IDATA
.reloc0x1a0000x680x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x56100xb4
RESOURCE0x80000x11a78
EXCEPTION0x70000x258
SECURITY00
BASERELOC0x1a0000x68
DEBUG0x50800x54
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x41100x118
Bound_IAT00
IAT0x42280x290
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#1512400
ICON#273360
ICON#357980
ICON#442640
ICON#511280
GROUP_ICON#2760
VERSION#110680
MANIFEST#18910
module_namehintordfunction_name
ADVAPI32.dll291EventUnregister
ADVAPI32.dll289EventRegister
ADVAPI32.dll292EventWrite
ADVAPI32.dll640RegEnumValueW
ADVAPI32.dll630RegDeleteValueW
ADVAPI32.dll615RegCreateKeyExW
ADVAPI32.dll626RegDeleteKeyW
ADVAPI32.dll606RegCloseKey
KERNEL32.dll853HeapFree
KERNEL32.dll849HeapAlloc
KERNEL32.dll702GetProcessHeap
KERNEL32.dll393FindFirstFileW
KERNEL32.dll193CreateEventExW
KERNEL32.dll405FindNextFileW
KERNEL32.dll640GetModuleHandleExW
KERNEL32.dll1216RemoveDirectoryW
KERNEL32.dll382FindClose
KERNEL32.dll618GetLastError
KERNEL32.dll1319SetEvent
KERNEL32.dll281DeleteFileW
KERNEL32.dll137CloseHandle
KERNEL32.dll1129RaiseException
KERNEL32.dll971LoadLibraryW
KERNEL32.dll696GetProcAddress
KERNEL32.dll436FreeLibrary
KERNEL32.dll785GetTickCount
KERNEL32.dll1252RtlVirtualUnwind
KERNEL32.dll1245RtlLookupFunctionEntry
KERNEL32.dll1238RtlCaptureContext
KERNEL32.dll1424Sleep
KERNEL32.dll1408SetUnhandledExceptionFilter
KERNEL32.dll544GetCurrentProcess
KERNEL32.dll1439TerminateProcess
KERNEL32.dll641GetModuleHandleW
KERNEL32.dll1106QueryPerformanceCounter
KERNEL32.dll545GetCurrentProcessId
KERNEL32.dll549GetCurrentThreadId
KERNEL32.dll755GetSystemTimeAsFileTime
KERNEL32.dll1473UnhandledExceptionFilter
msvcrt.dll174_amsg_exit
msvcrt.dll1074exit
msvcrt.dll270_exit
msvcrt.dll1296wcsrchr
msvcrt.dll142__set_app_type
msvcrt.dll85_XcptFilter
msvcrt.dll47void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll656_onexit
msvcrt.dll123__dllonexit
msvcrt.dll833_unlock
msvcrt.dll486_lock
msvcrt.dll91__CxxFrameHandler3
msvcrt.dll210_commode
msvcrt.dll295_fmode
msvcrt.dll87__C_specific_handler
msvcrt.dll381_initterm
msvcrt.dll144__setusermatherr
msvcrt.dll1181printf
msvcrt.dll670_purecall
msvcrt.dll1247system
msvcrt.dll906_wcsicmp
msvcrt.dll873_vsnwprintf
msvcrt.dll157__wgetmainargs
msvcrt.dll193_cexit
msvcrt.dll1174memset
ole32.dll151CoWaitForMultipleHandles
ole32.dll140CoTaskMemFree
ole32.dll41CoCreateFreeThreadedMarshaler
api-ms-win-core-winrt-string-l1-1-0.dll11WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0.dll7RoUninitialize
api-ms-win-core-winrt-l1-1-0.dllRoActivateInstance
api-ms-win-core-winrt-l1-1-0.dll3RoInitialize
SHELL32.dll430ShellExecuteExW
SHELL32.dll346SHGetKnownFolderPath
wevtapi.dll2EvtClearLog

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionThis tool resets the Windows Store without changing account settings or deleting installed apps
FileVersion10.0.19041.3636 (WinBuild.160101.0800)
InternalNameWSReset.exe
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameWSReset.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion10.0.19041.3636

VS_FIXEDFILEINFO

FileVersion10.0.19041.3636
ProductVersion10.0.19041.3636
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
13c405798PNG(256 x 256)#
152e67450BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER