filenamedriveprocessor.dll
size147456 (0x24000)
md5f5e5883148bfff795523e80884592fd3
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x110

Rich Header

lib idversiontimes used
10520671
1530773
9330774
2592102
9521793
9320672
93217911
10152
96307723
9530779
9230771
9430521
9030771

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x48ad5980
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x210e
Magic0x10b
LinkerVersion7.10
SizeOfCode0x14000
SizeOfInitializedData0xf000
SizeOfUninitializedData0
AddressOfEntryPoint0x136f2
BaseOfCode0x1000
BaseOfData0x15000
ImageBase0x56220000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x24000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.1 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x13f860x14000R-X CODE
.rdata0x150000x658b0x7000R-- IDATA
.data0x1c0000x4e80x1000RW- IDATA
.rsrc0x1d0000x35f80x4000R-- IDATA
.reloc0x210000x27320x3000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x1b4e00xab
IMPORT0x1a8340xc8
RESOURCE0x1d0000x35f8
EXCEPTION00
SECURITY00
BASERELOC0x210000x1db0
DEBUG0x152700x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x17eb00x48
Bound_IAT00
IAT0x150000x270
Delay_IAT00
CLR_Header00
typenamesizecp
REGISTRY#1011330
REGISTRY#1027360
REGISTRY#1038000
REGISTRY#1048050
REGISTRY#1057920
REGISTRY#1068000
REGISTRY#1078000
REGISTRY#1087440
TYPELIB#166280
STRING#7600
VERSION#18120
idlangstring
1001033DriveProcessor
module_namehintordfunction_name
KERNEL32.dll131DeviceIoControl
KERNEL32.dll954lstrcpynW
KERNEL32.dll239FreeLibrary
KERNEL32.dll619MultiByteToWideChar
KERNEL32.dll838SizeofResource
KERNEL32.dll589LoadResource
KERNEL32.dll221FindResourceW
KERNEL32.dll586LoadLibraryExW
KERNEL32.dll378GetModuleHandleW
KERNEL32.dll374GetModuleFileNameW
KERNEL32.dll484GetVolumeNameForVolumeMountPointW
KERNEL32.dll80CreateFileW
KERNEL32.dll368GetLogicalDrives
KERNEL32.dll590LocalAlloc
KERNEL32.dll235FormatMessageW
KERNEL32.dll942lstrcatW
KERNEL32.dll448GetSystemTimeAsFileTime
KERNEL32.dll315GetCurrentProcessId
KERNEL32.dll318GetCurrentThreadId
KERNEL32.dll469GetTickCount
KERNEL32.dll663QueryPerformanceCounter
KERNEL32.dll317GetCurrentThread
KERNEL32.dll314GetCurrentProcess
KERNEL32.dll948lstrcmpiW
KERNEL32.dll46CloseHandle
KERNEL32.dll542InterlockedDecrement
KERNEL32.dll546InterlockedIncrement
KERNEL32.dll122DeleteCriticalSection
KERNEL32.dll537InitializeCriticalSection
KERNEL32.dll583LeaveCriticalSection
KERNEL32.dll143EnterCriticalSection
KERNEL32.dll361GetLastError
KERNEL32.dll543InterlockedExchange
KERNEL32.dll667RaiseException
KERNEL32.dll951lstrcpyW
KERNEL32.dll957lstrlenW
KERNEL32.dll480GetVersionExW
KERNEL32.dll464GetThreadLocale
KERNEL32.dll364GetLocaleInfoA
KERNEL32.dll245GetACP
KERNEL32.dll332GetDriveTypeW
KERNEL32.dll175ExitProcess
KERNEL32.dll594LocalFree
KERNEL32.dll411GetProcessHeap
KERNEL32.dll530HeapSize
KERNEL32.dll528HeapReAlloc
KERNEL32.dll524HeapFree
KERNEL32.dll518HeapAlloc
KERNEL32.dll522HeapDestroy
KERNEL32.dll479GetVersionExA
USER32.dll44CharNextW
USER32.dll727wsprintfW
USER32.dll459LoadStringW
ADVAPI32.dll431OpenThreadToken
ADVAPI32.dll281GetTokenInformation
ADVAPI32.dll216EqualSid
ADVAPI32.dll278GetSidLengthRequired
ADVAPI32.dll307InitializeSid
ADVAPI32.dll279GetSidSubAuthority
ADVAPI32.dll471RegEnumKeyExW
ADVAPI32.dll56CheckTokenMembership
ADVAPI32.dll426OpenProcessToken
ADVAPI32.dll488RegQueryInfoKeyW
ADVAPI32.dll506RegSetValueExW
ADVAPI32.dll483RegOpenKeyExW
ADVAPI32.dll462RegCreateKeyExW
ADVAPI32.dll457RegCloseKey
ADVAPI32.dll467RegDeleteValueW
ADVAPI32.dll465RegDeleteKeyW
ADVAPI32.dll318IsValidSid
ADVAPI32.dll246GetLengthSid
ADVAPI32.dll90CopySid
ole32.dll100CoTaskMemFree
ole32.dll101CoTaskMemRealloc
ole32.dll31CoGetCallContext
ole32.dll90CoRevertToSelf
ole32.dll57CoImpersonateClient
ole32.dll308StringFromGUID2
ole32.dll16CoCreateInstance
ole32.dll262ProgIDFromCLSID
ole32.dll99CoTaskMemAlloc
OLEAUT32.dll7
OLEAUT32.dll2
OLEAUT32.dll8
OLEAUT32.dll202
OLEAUT32.dll201
OLEAUT32.dll163
OLEAUT32.dll186
OLEAUT32.dll314
OLEAUT32.dll40
OLEAUT32.dll11
OLEAUT32.dll19
OLEAUT32.dll20
OLEAUT32.dll22
OLEAUT32.dll16
OLEAUT32.dll15
OLEAUT32.dll21
OLEAUT32.dll10
OLEAUT32.dll161
OLEAUT32.dll162
OLEAUT32.dll277
OLEAUT32.dll27
OLEAUT32.dll9
OLEAUT32.dll77
OLEAUT32.dll4
OLEAUT32.dll149
OLEAUT32.dll150
OLEAUT32.dll6
SHLWAPI.dll42PathFindExtensionW
MSVCP71.dll344public: __thiscall std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >(char const *)

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

MSVCP71.dll1384public: char const * __thiscall std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::c_str(void)const

?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ

MSVCP71.dll543public: __thiscall std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::~basic_string<char, struct std::char_traits<char>, class std::allocator<char> >(void)

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

MSVCP71.dll337public: __thiscall std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >(class std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> > const &)

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

MSVCP71.dll1242void __cdecl std::_Nomemory(void)

?_Nomemory@std@@YAXXZ

USERENV.dll44UnloadUserProfile
MSVCR71.dll46void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR71.dll16public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

MSVCR71.dll563_wcsnicmp
MSVCR71.dll155__security_error_handler
MSVCR71.dll204_callnewh
MSVCR71.dll743memset
MSVCR71.dll703isalpha
MSVCR71.dll802toupper
MSVCR71.dll705isdigit
MSVCR71.dll718iswdigit
MSVCR71.dll815wcscmp
MSVCR71.dll742memmove
MSVCR71.dll107__dllonexit
MSVCR71.dll823wcsncpy
MSVCR71.dll757realloc
MSVCR71.dll10public: __thiscall exception::exception(class exception const &)

??0exception@@QAE@ABV0@@Z

MSVCR71.dll453_purecall
MSVCR71.dll32void __cdecl operator delete[](void *)

??_V@YAXPAX@Z

MSVCR71.dll81__CxxFrameHandler
MSVCR71.dll11public: __thiscall exception::exception(void)

??0exception@@QAE@XZ

MSVCR71.dll15public: virtual __thiscall exception::~exception(void)

??1exception@@UAE@XZ

MSVCR71.dll18void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCR71.dll68_CxxThrowException
MSVCR71.dll241_except_handler3
MSVCR71.dll461_resetstkoflw
MSVCR71.dll440_onexit
MSVCR71.dll319_initterm
MSVCR71.dll187_adjust_fdiv
MSVCR71.dll76__CppXcptFilter
MSVCR71.dll793swprintf
MSVCR71.dll684free
MSVCR71.dll735malloc
ordentry_vafunction_name
10x9170DllCanUnloadNow
20x9c30DllGetClassObject
30x9d30DllRegisterServer
40x9d40DllUnregisterServer
module_nameDriveProcessor.DLL
flags0
timestamp2008-08-21 12:03:12
version0.0
ordinal_base1
nFunctions4
nNames4
Names(4)0x1b518
Functions(4)0x1b508
NameOrdinals(4)0x1b528

StringTable 040904b0

CompanyNameSophos Plc
FileDescriptionDrive processing components
FileVersion1.0.0.3921
InternalNameDriveProcessor.dll
LegalCopyright© 1989-2008 Sophos Plc, www.sophos.com
OriginalFilenameDriveProcessor.dll
ProductNameSophos Anti-Virus
ProductVersion7.6.0

VS_FIXEDFILEINFO

FileVersion1.0.0.3921
ProductVersion7.6.0.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
0147456DLL08/21/2008 12:03:12#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK