d22a2dec01300eceb41d22ab60b1e4b3.bin - OnDemandConnRouteHelper.dll

info
MZ
PE
resources
imports
exports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	d22a2dec01300eceb41d22ab60b1e4b3.bin
size	66048 (0x10200)
md5	d22a2dec01300eceb41d22ab60b1e4b3

type	PE32+ executable (DLL) (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

Rich Header

lib id	version	times used
147	30729	38
241	40116	2
242	40116	14
1	0	110
239	40116	5
243	40116	7
238	40116	1
252	40116	16
237	40116	1
240	40116	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	7
TimeDateStamp	0x56fa33c1
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x2022
Magic	0x20b
LinkerVersion	12.10
SizeOfCode	0x8e00
SizeOfInitializedData	0x7a00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x2dc0
BaseOfCode	0x1000
ImageBase	0x180000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	10.0
ImageVersion	10.0
SubsystemVersion	10.0
Reserved1	0
SizeOfImage	0x15000
SizeOfHeaders	0x400
CheckSum	0x1dc35
Subsystem	3
DllCharacteristics	0x4160
SizeOfStackReserve	0x40000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x8de5	0x8e00	R-X CODE
.rdata	0xa000	0x56fe	0x5800	R-- IDATA
.data	0x10000	0xaf0	0x200	RW- IDATA
.pdata	0x11000	0xb10	0xc00	R-- IDATA
.didat	0x12000	0x20	0x200	RW- IDATA
.rsrc	0x13000	0x460	0x600	R-- IDATA
.reloc	0x14000	0x124	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0xe4a0	0x174
IMPORT	0xe614	0x1b8
RESOURCE	0x13000	0x460
EXCEPTION	0x11000	0xb10
SECURITY	0	0
BASERELOC	0x14000	0x124
DEBUG	0xacf0	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0xad50	0xa0
Bound_IAT	0	0
IAT	0xa000	0x400
Delay_IAT	0xe3c0	0x60
CLR_Header	0	0

show previews

type	name	size	cp
VERSION	#1	1024	0

module_name	hint	function_name
msvcrt.dll	123	__dllonexit
msvcrt.dll	656	_onexit
msvcrt.dll	18	public: virtual __cdecl type_info::~type_info(void) __ptr64 ??1type_info@@UEAA@XZ
msvcrt.dll	833	_unlock
msvcrt.dll	1170	memcpy
msvcrt.dll	486	_lock
msvcrt.dll	87	__C_specific_handler
msvcrt.dll	381	_initterm
msvcrt.dll	174	_amsg_exit
msvcrt.dll	85	_XcptFilter
msvcrt.dll	75	_CxxThrowException
msvcrt.dll	191	_callnewh
msvcrt.dll	11	public: __cdecl exception::exception(char const * __ptr64 const & __ptr64, int) __ptr64 ??0exception@@QEAA@AEBQEBDH@Z
msvcrt.dll	91	__CxxFrameHandler3
msvcrt.dll	873	_vsnwprintf
msvcrt.dll	1158	malloc
msvcrt.dll	20	void __cdecl operator delete(void * __ptr64) ??3@YAXPEAX@Z
msvcrt.dll	931	_wcstoui64
msvcrt.dll	12	public: __cdecl exception::exception(class exception const & __ptr64) __ptr64 ??0exception@@QEAA@AEBV0@@Z
msvcrt.dll	10	public: __cdecl exception::exception(char const * __ptr64 const & __ptr64) __ptr64 ??0exception@@QEAA@AEBQEBD@Z
msvcrt.dll	17	public: virtual __cdecl exception::~exception(void) __ptr64 ??1exception@@UEAA@XZ
msvcrt.dll	49	public: virtual char const * __ptr64 __cdecl exception::what(void)const __ptr64 ?what@exception@@UEBAPEBDXZ
msvcrt.dll	35	void __cdecl operator delete[](void * __ptr64) ??_V@YAXPEAX@Z
msvcrt.dll	1100	free
msvcrt.dll	1172	memmove
msvcrt.dll	1174	memset
api-ms-win-core-libraryloader-l1-2-0.dll	20	GetProcAddress
api-ms-win-core-libraryloader-l1-2-0.dll	14	GetModuleFileNameA
api-ms-win-core-libraryloader-l1-2-0.dll	23	LoadLibraryExW
api-ms-win-core-libraryloader-l1-2-0.dll	19	GetModuleHandleW
api-ms-win-core-libraryloader-l1-2-0.dll	11	FreeLibrary
api-ms-win-core-libraryloader-l1-2-0.dll	10	FindStringOrdinal
api-ms-win-core-libraryloader-l1-2-0.dll	18	GetModuleHandleExW
RPCRT4.dll	359	RpcAsyncInitializeHandle
RPCRT4.dll	357	RpcAsyncCompleteCall
RPCRT4.dll	356	RpcAsyncCancelCall
RPCRT4.dll	367	RpcBindingFromStringBindingW
RPCRT4.dll	141	Ndr64AsyncClientCall
RPCRT4.dll	509	RpcSsDestroyClientContext
RPCRT4.dll	410	RpcExceptionFilter
RPCRT4.dll	520	RpcStringBindingComposeW
RPCRT4.dll	157	NdrClientCall3
RPCRT4.dll	524	RpcStringFreeW
RPCRT4.dll	365	RpcBindingFree
RPCRT4.dll	385	RpcBindingSetOption
api-ms-win-eventing-provider-l1-1-0.dll	9	EventWriteTransfer
api-ms-win-eventing-provider-l1-1-0.dll	4	EventSetInformation
api-ms-win-eventing-provider-l1-1-0.dll	3	EventRegister
api-ms-win-eventing-provider-l1-1-0.dll	5	EventUnregister
api-ms-win-core-com-l1-1-1.dll	62	CoTaskMemAlloc
api-ms-win-core-com-l1-1-1.dll	63	CoTaskMemFree
api-ms-win-core-synch-l1-2-0.dll	45	Sleep
api-ms-win-core-synch-l1-2-0.dll	26	InitializeCriticalSectionEx
api-ms-win-core-synch-l1-2-0.dll	24	InitializeCriticalSection
api-ms-win-core-synch-l1-2-0.dll	17	EnterCriticalSection
api-ms-win-core-synch-l1-2-0.dll	29	LeaveCriticalSection
api-ms-win-core-synch-l1-2-0.dll	55	WaitForSingleObjectEx
api-ms-win-core-synch-l1-2-0.dll	21	InitOnceExecuteOnce
api-ms-win-core-synch-l1-2-0.dll	15	DeleteCriticalSection
api-ms-win-core-synch-l1-2-0.dll	41	SetEvent
api-ms-win-core-synch-l1-2-0.dll	39	ResetEvent
api-ms-win-core-synch-l1-2-0.dll	54	WaitForSingleObject
api-ms-win-core-synch-l1-2-0.dll	6	CreateEventW
api-ms-win-core-handle-l1-1-0.dll		CloseHandle
api-ms-win-core-registry-l1-1-0.dll	35	RegQueryValueExW
api-ms-win-core-registry-l1-1-0.dll	3	RegCreateKeyExW
api-ms-win-core-registry-l1-1-0.dll	9	RegDeleteTreeW
api-ms-win-core-registry-l1-1-0.dll	14	RegEnumKeyExW
api-ms-win-core-registry-l1-1-0.dll	30	RegOpenKeyExW
api-ms-win-core-registry-l1-1-0.dll		RegCloseKey
api-ms-win-core-registry-l1-1-0.dll	27	RegNotifyChangeKeyValue
api-ms-win-core-registry-l1-1-0.dll	44	RegSetValueExW
api-ms-win-core-registry-l1-1-0.dll	5	RegDeleteKeyExW
api-ms-win-core-threadpool-l1-2-0.dll	7	CloseThreadpoolWait
api-ms-win-core-threadpool-l1-2-0.dll	28	SetThreadpoolWait
api-ms-win-core-threadpool-l1-2-0.dll	35	WaitForThreadpoolWaitCallbacks
api-ms-win-core-threadpool-l1-2-0.dll	13	CreateThreadpoolWait
api-ms-win-core-errorhandling-l1-1-1.dll	13	SetLastError
api-ms-win-core-errorhandling-l1-1-1.dll	5	GetLastError
api-ms-win-core-errorhandling-l1-1-1.dll	17	UnhandledExceptionFilter
api-ms-win-core-errorhandling-l1-1-1.dll	15	SetUnhandledExceptionFilter
api-ms-win-core-profile-l1-1-0.dll		QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-2.dll	12	GetCurrentProcess
api-ms-win-core-processthreads-l1-1-2.dll	13	GetCurrentProcessId
api-ms-win-core-processthreads-l1-1-2.dll	17	GetCurrentThreadId
api-ms-win-core-processthreads-l1-1-2.dll	75	TerminateProcess
api-ms-win-core-sysinfo-l1-2-1.dll	20	GetSystemTimeAsFileTime
api-ms-win-core-sysinfo-l1-2-1.dll	24	GetTickCount
api-ms-win-core-rtlsupport-l1-2-0.dll	9	RtlLookupFunctionEntry
api-ms-win-core-rtlsupport-l1-2-0.dll	2	RtlCaptureContext
api-ms-win-core-rtlsupport-l1-2-0.dll	15	RtlVirtualUnwind
api-ms-win-core-threadpool-legacy-l1-1-0.dll	5	QueueUserWorkItem
ntdll.dll	77	EtwRegisterTraceGuidsW
ntdll.dll	68	EtwGetTraceEnableFlags
ntdll.dll	69	EtwGetTraceEnableLevel
ntdll.dll	70	EtwGetTraceLoggerHandle
ntdll.dll	82	EtwTraceMessage
ntdll.dll	84	EtwUnregisterTraceGuids
api-ms-win-core-heap-l1-2-0.dll	2	HeapAlloc
api-ms-win-core-heap-l1-2-0.dll		GetProcessHeap
api-ms-win-core-heap-l1-2-0.dll	6	HeapFree
api-ms-win-security-base-l1-2-0.dll	64	GetTokenInformation
IPHLPAPI.DLL	16	ConvertInterfaceLuidToIndex
IPHLPAPI.DLL	12	ConvertInterfaceGuidToLuid
api-ms-win-core-delayload-l1-1-1.dll	1	ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-1.dll		DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0.dll		ApiSetQueryApiSetPresence

ord	entry_va	function_name
1	0x2460	FreeInterfaceContextTable
2	0x1a80	GetInterfaceContextTableForHostName
3	0x5e50	OnDemandAddRouteRequest
4	0x5fb0	OnDemandGetRoutingHint
5	0x10a0	OnDemandRegisterNotification
6	0x60e0	OnDemandRemoveMatchingRoute
7	0x6210	OnDemandRemoveRouteRequest
8	0x6290	OnDemandUnRegisterNotification

module_name	OnDemandConnRouteHelper.DLL
flags	0
timestamp	2016-03-29 03:51:43
version	0.0
ordinal_base	1
nFunctions	8
nNames	8
Names(8)	0xe4e8
Functions(8)	0xe4c8
NameOrdinals(8)	0xe508

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	On Demand Connctiond Route Helper
FileVersion	10.0.10586.212 (th2_release_sec.160328-1908)
InternalName	OnDemandConnRouteHelper.dll
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	OnDemandConnRouteHelper.dll
ProductName	Microsoft® Windows® Operating System
ProductVersion	10.0.10586.212

VS_FIXEDFILEINFO

FileVersion	10.0.10586.212
ProductVersion	10.0.10586.212
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	2
FileSubtype	0

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	60464	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

d22a2dec01300eceb41d22ab60b1e4b3.bin-

MZ Header

Rich Header

DOS stub

PE Header

Sections

Data Directory

StringTable 040904B0

VS_FIXEDFILEINFO

d22a2dec01300eceb41d22ab60b1e4b3.bin
-