SensorDataService.exe

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	SensorDataService.exe
size	1017344 (0xf8600)
md5	778ebd21a7bacc602296f06c98102bfa

type	PE32+ executable (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe8

Rich Header

lib id	version	times used
147	30729	62
241	40116	3
1	0	191
239	40116	5
243	40116	14
242	40116	21
247	40116	29
237	40116	1
240	40116	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	6
TimeDateStamp	0x5560367a
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	12.10
SizeOfCode	0xb4c00
SizeOfInitializedData	0x53200
SizeOfUninitializedData	0
AddressOfEntryPoint	0xab0f0
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	10.0
ImageVersion	10.0
SubsystemVersion	10.0
Reserved1	0
SizeOfImage	0x10c000
SizeOfHeaders	0x400
CheckSum	0xf9044
Subsystem	3
DllCharacteristics	0xc160
SizeOfStackReserve	0x80000
SizeOfStackCommit	0x2000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ 8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xb4b9c	0xb4c00	R-X CODE
.rdata	0xb6000	0x390cc	0x39200	R-- IDATA
.data	0xf0000	0x10440	0xa00	RW- IDATA
.pdata	0x101000	0x7f2c	0x8000	R-- IDATA
.rsrc	0x109000	0x120	0x200	R-- IDATA
.reloc	0x10a000	0x164c	0x1800	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xed510	0x294
RESOURCE	0x109000	0x120
EXCEPTION	0x101000	0x7f2c
SECURITY	0	0
BASERELOC	0x10a000	0x164c
DEBUG	0xcd290	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0xcd2f0	0xa0
Bound_IAT	0	0
IAT	0xb6000	0x678
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
MUI	#1	192	0

module_name	hint	function_name
msvcrt.dll	1169	memcmp
msvcrt.dll	1171	memcpy_s
msvcrt.dll	1208	sprintf
msvcrt.dll	1172	memmove
msvcrt.dll	25	public: int __cdecl type_info::operator==(class type_info const & __ptr64)const __ptr64 ??8type_info@@QEBAHAEBV0@@Z
msvcrt.dll	873	_vsnwprintf
msvcrt.dll	1193	realloc
msvcrt.dll	1285	wcscpy_s
msvcrt.dll	1173	memmove_s
msvcrt.dll	35	void __cdecl operator delete[](void * __ptr64) ??_V@YAXPEAX@Z
msvcrt.dll	18	public: virtual __cdecl type_info::~type_info(void) __ptr64 ??1type_info@@UEAA@XZ
msvcrt.dll	123	__dllonexit
msvcrt.dll	833	_unlock
msvcrt.dll	486	_lock
msvcrt.dll	47	void __cdecl terminate(void) ?terminate@@YAXXZ
msvcrt.dll	210	_commode
msvcrt.dll	295	_fmode
msvcrt.dll	87	__C_specific_handler
msvcrt.dll	381	_initterm
msvcrt.dll	144	__setusermatherr
msvcrt.dll	193	_cexit
msvcrt.dll	270	_exit
msvcrt.dll	1074	exit
msvcrt.dll	142	__set_app_type
msvcrt.dll	157	__wgetmainargs
msvcrt.dll	174	_amsg_exit
msvcrt.dll	85	_XcptFilter
msvcrt.dll	191	_callnewh
msvcrt.dll	1158	malloc
msvcrt.dll	49	public: virtual char const * __ptr64 __cdecl exception::what(void)const __ptr64 ?what@exception@@UEBAPEBDXZ
msvcrt.dll	17	public: virtual __cdecl exception::~exception(void) __ptr64 ??1exception@@UEAA@XZ
msvcrt.dll	12	public: __cdecl exception::exception(class exception const & __ptr64) __ptr64 ??0exception@@QEAA@AEBV0@@Z
msvcrt.dll	11	public: __cdecl exception::exception(char const * __ptr64 const & __ptr64, int) __ptr64 ??0exception@@QEAA@AEBQEBDH@Z
msvcrt.dll	10	public: __cdecl exception::exception(char const * __ptr64 const & __ptr64) __ptr64 ??0exception@@QEAA@AEBQEBD@Z
msvcrt.dll	13	public: __cdecl exception::exception(void) __ptr64 ??0exception@@QEAA@XZ
msvcrt.dll	1170	memcpy
msvcrt.dll	91	__CxxFrameHandler3
msvcrt.dll	75	_CxxThrowException
msvcrt.dll	1313	wprintf_s
msvcrt.dll	20	void __cdecl operator delete(void * __ptr64) ??3@YAXPEAX@Z
msvcrt.dll	670	_purecall
msvcrt.dll	1100	free
msvcrt.dll	656	_onexit
msvcrt.dll	1174	memset
api-ms-win-core-libraryloader-l1-2-0.dll		AddDllDirectory
api-ms-win-core-libraryloader-l1-2-0.dll	29	RemoveDllDirectory
api-ms-win-core-libraryloader-l1-2-0.dll	11	FreeLibrary
api-ms-win-core-libraryloader-l1-2-0.dll	14	GetModuleFileNameA
api-ms-win-core-libraryloader-l1-2-0.dll	27	LoadStringW
api-ms-win-core-libraryloader-l1-2-0.dll	20	GetProcAddress
api-ms-win-core-libraryloader-l1-2-0.dll	15	GetModuleFileNameW
api-ms-win-core-libraryloader-l1-2-0.dll	19	GetModuleHandleW
api-ms-win-core-libraryloader-l1-2-0.dll	18	GetModuleHandleExW
api-ms-win-core-libraryloader-l1-2-0.dll	23	LoadLibraryExW
api-ms-win-core-string-l1-1-0.dll	2	CompareStringW
api-ms-win-core-errorhandling-l1-1-1.dll	5	GetLastError
api-ms-win-core-errorhandling-l1-1-1.dll	7	RaiseException
api-ms-win-core-errorhandling-l1-1-1.dll	17	UnhandledExceptionFilter
api-ms-win-core-errorhandling-l1-1-1.dll	15	SetUnhandledExceptionFilter
api-ms-win-service-core-l1-1-1.dll	5	RegisterServiceCtrlHandlerExW
api-ms-win-service-core-l1-1-1.dll	7	StartServiceCtrlDispatcherW
api-ms-win-service-core-l1-1-1.dll	6	SetServiceStatus
api-ms-win-eventing-provider-l1-1-0.dll	3	EventRegister
api-ms-win-eventing-provider-l1-1-0.dll	9	EventWriteTransfer
api-ms-win-eventing-provider-l1-1-0.dll	4	EventSetInformation
api-ms-win-eventing-provider-l1-1-0.dll	5	EventUnregister
api-ms-win-core-synch-l1-2-0.dll	1	AcquireSRWLockShared
api-ms-win-core-synch-l1-2-0.dll	41	SetEvent
api-ms-win-core-synch-l1-2-0.dll	50	TryAcquireSRWLockShared
api-ms-win-core-synch-l1-2-0.dll	39	ResetEvent
api-ms-win-core-synch-l1-2-0.dll	36	ReleaseSRWLockExclusive
api-ms-win-core-synch-l1-2-0.dll	27	InitializeSRWLock
api-ms-win-core-synch-l1-2-0.dll		AcquireSRWLockExclusive
api-ms-win-core-synch-l1-2-0.dll	17	EnterCriticalSection
api-ms-win-core-synch-l1-2-0.dll	29	LeaveCriticalSection
api-ms-win-core-synch-l1-2-0.dll	54	WaitForSingleObject
api-ms-win-core-synch-l1-2-0.dll	5	CreateEventExW
api-ms-win-core-synch-l1-2-0.dll	15	DeleteCriticalSection
api-ms-win-core-synch-l1-2-0.dll	26	InitializeCriticalSectionEx
api-ms-win-core-synch-l1-2-0.dll	37	ReleaseSRWLockShared
api-ms-win-core-synch-l1-2-0.dll	19	InitOnceBeginInitialize
api-ms-win-core-synch-l1-2-0.dll	55	WaitForSingleObjectEx
api-ms-win-core-synch-l1-2-0.dll	45	Sleep
api-ms-win-core-synch-l1-2-0.dll	20	InitOnceComplete
api-ms-win-core-profile-l1-1-0.dll		QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-2.dll	48	OpenProcessToken
api-ms-win-core-processthreads-l1-1-2.dll	75	TerminateProcess
api-ms-win-core-processthreads-l1-1-2.dll	47	OpenProcess
api-ms-win-core-processthreads-l1-1-2.dll	13	GetCurrentProcessId
api-ms-win-core-processthreads-l1-1-2.dll	17	GetCurrentThreadId
api-ms-win-core-processthreads-l1-1-2.dll	12	GetCurrentProcess
api-ms-win-core-sysinfo-l1-2-1.dll	21	GetSystemTimePreciseAsFileTime
api-ms-win-core-sysinfo-l1-2-1.dll	20	GetSystemTimeAsFileTime
api-ms-win-core-sysinfo-l1-2-1.dll	25	GetTickCount64
api-ms-win-core-sysinfo-l1-2-1.dll	24	GetTickCount
api-ms-win-core-sysinfo-l1-2-1.dll	17	GetSystemInfo
api-ms-win-core-rtlsupport-l1-2-0.dll	15	RtlVirtualUnwind
api-ms-win-core-rtlsupport-l1-2-0.dll	9	RtlLookupFunctionEntry
api-ms-win-core-rtlsupport-l1-2-0.dll	2	RtlCaptureContext
api-ms-win-service-management-l1-1-0.dll	4	OpenSCManagerW
api-ms-win-service-management-l1-1-0.dll	6	StartServiceW
api-ms-win-service-management-l1-1-0.dll		CloseServiceHandle
api-ms-win-service-management-l1-1-0.dll	3	DeleteService
api-ms-win-service-management-l1-1-0.dll	2	CreateServiceW
api-ms-win-service-management-l1-1-0.dll	5	OpenServiceW
api-ms-win-core-handle-l1-1-0.dll	2	DuplicateHandle
api-ms-win-core-handle-l1-1-0.dll		CloseHandle
api-ms-win-core-winrt-l1-1-0.dll	3	RoInitialize
api-ms-win-core-winrt-l1-1-0.dll	1	RoGetActivationFactory
api-ms-win-core-winrt-l1-1-0.dll	7	RoUninitialize
api-ms-win-core-winrt-l1-1-0.dll		RoActivateInstance
api-ms-win-core-registry-l1-1-0.dll	20	RegGetValueW
api-ms-win-core-registry-l1-1-0.dll		RegCloseKey
api-ms-win-core-registry-l1-1-0.dll	14	RegEnumKeyExW
api-ms-win-core-registry-l1-1-0.dll	3	RegCreateKeyExW
api-ms-win-core-registry-l1-1-0.dll	27	RegNotifyChangeKeyValue
api-ms-win-service-management-l2-1-0.dll		ChangeServiceConfig2W
api-ms-win-service-management-l2-1-0.dll	6	QueryServiceStatusEx
api-ms-win-service-winsvc-l1-2-0.dll	2	ControlService
api-ms-win-core-winrt-error-l1-1-1.dll	16	RoTransformError
api-ms-win-core-winrt-error-l1-1-1.dll	9	RoOriginateError
api-ms-win-core-com-l1-1-1.dll	19	CoGetApartmentType
api-ms-win-core-com-l1-1-1.dll	6	CoCreateFreeThreadedMarshaler
api-ms-win-core-com-l1-1-1.dll	63	CoTaskMemFree
api-ms-win-core-com-l1-1-1.dll	8	CoCreateInstance
api-ms-win-core-com-l1-1-1.dll	62	CoTaskMemAlloc
api-ms-win-core-winrt-string-l1-1-0.dll	16	WindowsGetStringRawBuffer
api-ms-win-core-winrt-string-l1-1-0.dll	10	WindowsCreateString
api-ms-win-core-winrt-string-l1-1-0.dll	12	WindowsDeleteString
api-ms-win-core-winrt-string-l1-1-0.dll	11	WindowsCreateStringReference
api-ms-win-core-winrt-string-l1-1-0.dll	14	WindowsDuplicateString
api-ms-win-core-heap-l2-1-0.dll	3	LocalFree
api-ms-win-security-base-l1-2-0.dll	26	CheckTokenCapability
api-ms-win-security-base-l1-2-0.dll	64	GetTokenInformation
api-ms-win-security-base-l1-2-0.dll	27	CheckTokenMembership
api-ms-win-security-base-l1-2-0.dll	22	AllocateAndInitializeSid
api-ms-win-security-base-l1-2-0.dll	38	DuplicateToken
api-ms-win-security-base-l1-2-0.dll	44	FreeSid
api-ms-win-security-sddl-l1-1-0.dll	2	ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-security-sddl-l1-1-0.dll	3	ConvertStringSidToSidW
api-ms-win-core-debug-l1-1-1.dll	7	OutputDebugStringW
api-ms-win-core-localization-l1-2-1.dll	8	FormatMessageW
api-ms-win-core-shlwapi-legacy-l1-1-0.dll	24	PathFindFileNameW
ntdll.dll	1396	RtlUnsubscribeWnfNotificationWaitForCompletion
ntdll.dll	1347	RtlSubscribeWnfStateChangeNotification
api-ms-win-core-threadpool-l1-2-0.dll	16	FreeLibraryWhenCallbackReturns
api-ms-win-core-threadpool-l1-2-0.dll	2	CloseThreadpool
api-ms-win-core-threadpool-l1-2-0.dll	6	CloseThreadpoolTimer
api-ms-win-core-threadpool-l1-2-0.dll	14	CreateThreadpoolWork
api-ms-win-core-threadpool-l1-2-0.dll	9	CreateThreadpool
api-ms-win-core-threadpool-l1-2-0.dll	3	CloseThreadpoolCleanupGroup
api-ms-win-core-threadpool-l1-2-0.dll	10	CreateThreadpoolCleanupGroup
api-ms-win-core-threadpool-l1-2-0.dll	8	CloseThreadpoolWork
api-ms-win-core-threadpool-l1-2-0.dll	34	WaitForThreadpoolTimerCallbacks
api-ms-win-core-threadpool-l1-2-0.dll	13	CreateThreadpoolWait
api-ms-win-core-threadpool-l1-2-0.dll	26	SetThreadpoolTimer
api-ms-win-core-threadpool-l1-2-0.dll	24	SetThreadpoolThreadMaximum
api-ms-win-core-threadpool-l1-2-0.dll	31	SubmitThreadpoolWork
api-ms-win-core-threadpool-l1-2-0.dll	28	SetThreadpoolWait
api-ms-win-core-threadpool-l1-2-0.dll	35	WaitForThreadpoolWaitCallbacks
api-ms-win-core-threadpool-l1-2-0.dll	7	CloseThreadpoolWait
api-ms-win-core-threadpool-l1-2-0.dll	4	CloseThreadpoolCleanupGroupMembers
api-ms-win-core-threadpool-l1-2-0.dll	12	CreateThreadpoolTimer
api-ms-win-core-threadpool-l1-2-0.dll	30	StartThreadpoolIo
api-ms-win-core-threadpool-l1-2-0.dll	1	CancelThreadpoolIo
api-ms-win-core-threadpool-l1-2-0.dll	33	WaitForThreadpoolIoCallbacks
api-ms-win-core-threadpool-l1-2-0.dll	36	WaitForThreadpoolWorkCallbacks
api-ms-win-core-threadpool-l1-2-0.dll	5	CloseThreadpoolIo
api-ms-win-core-threadpool-l1-2-0.dll	11	CreateThreadpoolIo
api-ms-win-core-namedpipe-l1-2-0.dll	1	CreateNamedPipeW
api-ms-win-core-namedpipe-l1-2-0.dll		ConnectNamedPipe
api-ms-win-core-io-l1-1-1.dll	5	GetOverlappedResult
api-ms-win-core-file-l1-2-1.dll	71	ReadFile
api-ms-win-core-file-l1-2-1.dll	89	WriteFile
api-ms-win-core-kernel32-legacy-l1-1-1.dll	33	GetNamedPipeClientProcessId

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	1011760	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK