unpacked.exe - sfdrvrem.exe - FrontLine Drivers Removal Tool

info
MZ
PE
resources
imports
foremost
7zip
version info
hexdump
disasm
log
discuss
donate

filename	unpacked.exe
size	443792 (0x6c590)
md5	b7751ea43aae0d98a6ca901deef7f8e3

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf8

Rich Header

lib id	version	times used
126	50327	1
125	50727	24
109	50727	122
93	4035	13
1	0	226
110	50727	113
124	50727	1
0	0	1
120	50727	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x48030b44
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x103
Magic	0x10b
LinkerVersion	8.0
SizeOfCode	0x46000
SizeOfInitializedData	0x26000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1c61a
BaseOfCode	0x1000
BaseOfData	0x47000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x6d000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x45b84	0x46000	R-X CODE
.rdata	0x47000	0x1cb10	0x1d000	R-- IDATA
.data	0x64000	0x7394	0x6000	RW- IDATA
.rsrc	0x6c000	0x5e0	0x1000	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x62c48	0x64
RESOURCE	0x6c000	0x5e0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x526c8	0x40
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
VERSION	#1	920	0
MANIFEST	#1	417	0

module_name	hint	ord	function_name
KERNEL32.DLL			InterlockedIncrement
KERNEL32.DLL			InterlockedDecrement
KERNEL32.DLL			GetCPInfo
KERNEL32.DLL			WideCharToMultiByte
KERNEL32.DLL			FormatMessageA
KERNEL32.DLL			MultiByteToWideChar
KERNEL32.DLL			LCMapStringW
KERNEL32.DLL			GetFullPathNameW
KERNEL32.DLL			QueryDosDeviceW
KERNEL32.DLL			GetVersionExW
KERNEL32.DLL			CreateFileA
KERNEL32.DLL			CreateFileW
KERNEL32.DLL			GetModuleFileNameA
KERNEL32.DLL			CreateFileMappingA
KERNEL32.DLL			CreateFileMappingW
KERNEL32.DLL			CreateMutexA
KERNEL32.DLL			CreateMutexW
KERNEL32.DLL			GetSystemDirectoryW
KERNEL32.DLL			GetWindowsDirectoryW
KERNEL32.DLL			GetDriveTypeW
KERNEL32.DLL			FindFirstFileA
KERNEL32.DLL			FindFirstFileW
KERNEL32.DLL			FindNextFileA
KERNEL32.DLL			FindNextFileW
KERNEL32.DLL			GetEnvironmentVariableW
KERNEL32.DLL			GetModuleHandleW
KERNEL32.DLL			WriteConsoleA
KERNEL32.DLL			CreateProcessA
KERNEL32.DLL			CreateProcessW
KERNEL32.DLL			GetFileAttributesA
KERNEL32.DLL			GetFileAttributesW
KERNEL32.DLL			SetFileAttributesW
KERNEL32.DLL			DeleteFileW
KERNEL32.DLL			LocalAlloc
KERNEL32.DLL			FormatMessageW
KERNEL32.DLL			FindClose
KERNEL32.DLL			GetFileSize
KERNEL32.DLL			ReadFile
KERNEL32.DLL			WriteFile
KERNEL32.DLL			SetFileTime
KERNEL32.DLL			MapViewOfFile
KERNEL32.DLL			UnmapViewOfFile
KERNEL32.DLL			DeviceIoControl
KERNEL32.DLL			AreFileApisANSI
KERNEL32.DLL			GetOEMCP
KERNEL32.DLL			GetACP
KERNEL32.DLL			SleepEx
KERNEL32.DLL			WaitForMultipleObjectsEx
KERNEL32.DLL			ReleaseMutex
KERNEL32.DLL			GetExitCodeProcess
KERNEL32.DLL			LocalFree
KERNEL32.DLL			SetEndOfFile
KERNEL32.DLL			SetStdHandle
KERNEL32.DLL			GetConsoleOutputCP
KERNEL32.DLL			GetStringTypeW
KERNEL32.DLL			GetStringTypeA
KERNEL32.DLL			SetFilePointer
KERNEL32.DLL			GetLocaleInfoA
KERNEL32.DLL			LoadLibraryW
KERNEL32.DLL			GetSystemTime
KERNEL32.DLL			SystemTimeToFileTime
KERNEL32.DLL			GetTickCount
KERNEL32.DLL			LeaveCriticalSection
KERNEL32.DLL			EnterCriticalSection
KERNEL32.DLL			DeleteCriticalSection
KERNEL32.DLL			InitializeCriticalSection
KERNEL32.DLL			GetEnvironmentVariableA
KERNEL32.DLL			GetStdHandle
KERNEL32.DLL			WriteConsoleW
KERNEL32.DLL			VirtualFree
KERNEL32.DLL			VirtualAlloc
KERNEL32.DLL			GetModuleHandleA
KERNEL32.DLL			GetSystemInfo
KERNEL32.DLL			FreeConsole
KERNEL32.DLL			GetCurrentProcess
KERNEL32.DLL			CreateEventA
KERNEL32.DLL			WaitForSingleObject
KERNEL32.DLL			SetEvent
KERNEL32.DLL			CloseHandle
KERNEL32.DLL			LoadLibraryA
KERNEL32.DLL			GetProcAddress
KERNEL32.DLL			FreeLibrary
KERNEL32.DLL			GetVersionExA
KERNEL32.DLL			GetSystemDirectoryA
KERNEL32.DLL			GetWindowsDirectoryA
KERNEL32.DLL			SetFileAttributesA
KERNEL32.DLL			DeleteFileA
KERNEL32.DLL			MoveFileExA
KERNEL32.DLL			GetLastError
KERNEL32.DLL			LCMapStringA
KERNEL32.DLL			Sleep
KERNEL32.DLL			FlushFileBuffers
KERNEL32.DLL			GetConsoleMode
KERNEL32.DLL			GetConsoleCP
KERNEL32.DLL			GetSystemTimeAsFileTime
KERNEL32.DLL			GetCurrentProcessId
KERNEL32.DLL			QueryPerformanceCounter
KERNEL32.DLL			HeapAlloc
KERNEL32.DLL			HeapFree
KERNEL32.DLL			RtlUnwind
KERNEL32.DLL			HeapReAlloc
KERNEL32.DLL			GetCommandLineA
KERNEL32.DLL			GetProcessHeap
KERNEL32.DLL			GetStartupInfoA
KERNEL32.DLL			RaiseException
KERNEL32.DLL			HeapDestroy
KERNEL32.DLL			HeapCreate
KERNEL32.DLL			ExitProcess
KERNEL32.DLL			TlsGetValue
KERNEL32.DLL			TlsAlloc
KERNEL32.DLL			TlsSetValue
KERNEL32.DLL			TlsFree
KERNEL32.DLL			GetCurrentThreadId
KERNEL32.DLL			TerminateProcess
KERNEL32.DLL			UnhandledExceptionFilter
KERNEL32.DLL			SetUnhandledExceptionFilter
KERNEL32.DLL			IsDebuggerPresent
KERNEL32.DLL			IsValidCodePage
KERNEL32.DLL			HeapSize
KERNEL32.DLL			FreeEnvironmentStringsA
KERNEL32.DLL			GetEnvironmentStrings
KERNEL32.DLL			FreeEnvironmentStringsW
KERNEL32.DLL			GetEnvironmentStringsW
KERNEL32.DLL			SetHandleCount
KERNEL32.DLL			GetFileType
KERNEL32.DLL			SetLastError
ADVAPI32.dll			ControlService
ADVAPI32.dll			SetSecurityDescriptorDacl
ADVAPI32.dll			InitializeSecurityDescriptor
ADVAPI32.dll			RegQueryValueExW
ADVAPI32.dll			RegQueryValueExA
ADVAPI32.dll			RegDeleteValueW
ADVAPI32.dll			RegSetValueExW
ADVAPI32.dll			RegSetValueExA
ADVAPI32.dll			RegEnumKeyExW
ADVAPI32.dll			RegDeleteKeyW
ADVAPI32.dll			RegOpenKeyExW
ADVAPI32.dll			RegCreateKeyExW
ADVAPI32.dll			StartServiceW
ADVAPI32.dll			EnumServicesStatusW
ADVAPI32.dll			ChangeServiceConfigW
ADVAPI32.dll			QueryServiceConfigW
ADVAPI32.dll			CreateServiceW
ADVAPI32.dll			OpenServiceW
ADVAPI32.dll			OpenSCManagerW
ADVAPI32.dll			OpenProcessToken
ADVAPI32.dll			LookupPrivilegeValueA
ADVAPI32.dll			AdjustTokenPrivileges
ADVAPI32.dll			RegOpenKeyExA
ADVAPI32.dll			RegCloseKey
ADVAPI32.dll			RegDeleteKeyA
ADVAPI32.dll			OpenSCManagerA
ADVAPI32.dll			OpenServiceA
ADVAPI32.dll			CloseServiceHandle
ADVAPI32.dll			DeleteService
USER32.dll			ExitWindowsEx
USER32.dll			MessageBoxA
VERSION.dll			GetFileVersionInfoA
VERSION.dll			GetFileVersionInfoSizeW
VERSION.dll			GetFileVersionInfoW
VERSION.dll			VerQueryValueA
VERSION.dll			GetFileVersionInfoSizeA

StringTable 040904B0

Comments	Visit us at www.star-force.com
CompanyName	Protection Technology (StarForce)
FileDescription	FrontLine Drivers Removal Tool
FileVersion	0.0
InternalName	sfdrvrem.exe
LegalCopyright	(c) Protection Technology (StarForce), 2000-2006
OriginalFilename	sfdrvrem.exe
ProductName	SF FrontLine
ProductVersion	0.0

VS_FIXEDFILEINFO

FileVersion	0.0.0.0
ProductVersion	0.0.0.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	438272	EXE	04/14/2008 07:44:04	#
15c1	15	HTM		#
6b000	5520	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 443792 bytes (434 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

unpacked.exe-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904B0

VS_FIXEDFILEINFO

unpacked.exe
-