Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
948f0b6d8aa56c0f58c4a009c4690a30_dll32_JC.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
948f0b6d8aa56c0f58c4a009c4690a30_dll32_JC.dll
Resource
win10v2004-20230915-en
Target
948f0b6d8aa56c0f58c4a009c4690a30_dll32_JC.dll
Size
2.2MB
MD5
948f0b6d8aa56c0f58c4a009c4690a30
SHA1
57a1cae7108f4d77978ad69d9b8c05b3944843cd
SHA256
082367e99d2375be7a95e522aa8356de25b369a74b0e9e820fe5773482a70da4
SHA512
1d75bcaac3ed7e1a7146d527e0abebb7dfbf5d5a73cbb809160da12bbba2db0760d9abaaf5c5ac9da1b714b9a1c546ce81bab4245e4fcaee629fff67e069580f
SSDEEP
49152:id7wUlPiWsx3yd2OluON4fA9uLLwL+fZx/X3yd2OluON4fA9uk3yd2OluON4fA9O:id8UlTsdLwL+fZx/8
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageCodeSigning
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageContentCommitment
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PathFileExistsW
PathAddBackslashW
UrlGetPartW
PathFindFileNameW
StrCmpIW
PathRemoveBackslashW
PathFindExtensionW
StrFormatByteSizeW
PathCombineW
PathCreateFromUrlW
PathIsDirectoryW
PathIsUNCServerShareW
PathIsUNCServerW
PathIsUNCW
PathIsRootW
AssocQueryKeyW
PathParseIconLocationW
PathSearchAndQualifyW
FreeLibrary
GetProcAddress
WaitForSingleObject
CreateMutexW
ReleaseMutex
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
CloseHandle
FindFirstFileW
FindNextFileW
SetLastError
LoadLibraryW
GetModuleFileNameW
GetVersion
GetFileAttributesW
GetModuleHandleW
GetModuleHandleA
OutputDebugStringA
RaiseException
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
InterlockedDecrement
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
FindClose
DeleteCriticalSection
InterlockedIncrement
lstrlenW
WideCharToMultiByte
FlushInstructionCache
GetCurrentProcess
LoadLibraryA
FindResourceW
SizeofResource
LockResource
GetVersionExA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
LoadResource
FindResourceExW
lstrlenA
MultiByteToWideChar
FormatMessageW
InterlockedExchange
InterlockedCompareExchange
TerminateProcess
DuplicateHandle
GlobalUnlock
GlobalLock
GlobalSize
GetDriveTypeW
GetEnvironmentVariableW
InitializeCriticalSection
LocalFree
Sleep
CreateProcessW
GetSystemWindowsDirectoryW
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
DeleteFileW
ExpandEnvironmentStringsW
lstrcmpW
CreateEventW
SetEvent
UnhandledExceptionFilter
RegisterWindowMessageW
SetForegroundWindow
ShowWindowAsync
IsIconic
SetParent
SetScrollPos
GetScrollInfo
SetWindowPos
MapWindowPoints
GetWindowRect
GetWindow
ScreenToClient
WindowFromPoint
IsRectEmpty
PtInRect
SetMenuDefaultItem
ScrollWindowEx
ShowScrollBar
EqualRect
InvalidateRect
OffsetRect
KillTimer
SetTimer
SetScrollInfo
GetMessagePos
FillRect
FrameRect
GetSysColorBrush
DrawEdge
InflateRect
DrawFrameControl
LoadIconW
LoadStringW
MonitorFromPoint
GetMonitorInfoW
UpdateWindow
SetWindowTextW
UnionRect
ReleaseCapture
GetCapture
SetCapture
EndPaint
BeginPaint
EnableScrollBar
EnableWindow
IsWindowEnabled
CheckMenuRadioItem
GetMenuItemID
IsMenu
TrackPopupMenu
GetCursorPos
GetMenuStringW
LoadMenuW
SendDlgItemMessageW
GetDlgItem
ShowWindow
GetForegroundWindow
GetClientRect
GetKeyState
IntersectRect
SetRect
ReleaseDC
GetDC
GetParent
GetPropW
DrawIconEx
DestroyMenu
AppendMenuW
CreatePopupMenu
LoadBitmapW
DrawTextW
MessageBoxW
MessageBeep
SetRectEmpty
SetMenuItemInfoW
GetSystemMetrics
EnableMenuItem
InsertMenuItemW
DeleteMenu
GetMenuItemInfoW
GetMenuItemCount
CopyRect
SystemParametersInfoW
GetSysColor
SetCursor
CreateWindowExW
DestroyWindow
LoadImageW
DestroyIcon
CallNextHookEx
DefWindowProcW
CallWindowProcW
GetClassNameW
IsWindowVisible
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowLongW
PostMessageW
SendMessageW
RemovePropW
EnumChildWindows
SetPropW
GetWindowLongW
SetFocus
IsWindow
GetFocus
GetClassInfoExW
RegisterClassExW
LoadCursorW
PeekMessageW
DispatchMessageW
IsChild
GetSubMenu
LoadStringA
RegisterClipboardFormatW
UnregisterClassA
CheckMenuItem
RoundRect
CreateSolidBrush
Rectangle
GetBkColor
SetPixel
SetViewportOrgEx
CreateCompatibleBitmap
SetBrushOrgEx
CreateBitmap
CreatePatternBrush
GetObjectW
SelectObject
CreateCompatibleDC
BitBlt
DeleteDC
DeleteObject
GetStockObject
CreateFontIndirectW
SaveDC
RestoreDC
SetBkMode
SetTextColor
CreateDIBSection
ExtTextOutW
IntersectClipRect
GetCurrentObject
GetDeviceCaps
DPtoLP
SetWindowOrgEx
LPtoDP
GetClipBox
CreatePen
SetBkColor
RegOpenKeyExW
RegCloseKey
RegSetValueExW
CryptGenRandom
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
RegDeleteKeyW
RegEnumKeyExW
RegQueryValueExW
ExtractIconExW
SHGetMalloc
SHLoadInProc
SHChangeNotify
DuplicateIcon
SHGetFileInfoW
SHGetDesktopFolder
SHGetPathFromIDListW
SHGetDataFromIDListW
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CoCreateGuid
StringFromGUID2
CoCreateInstance
CoTaskMemFree
StringFromCLSID
ReleaseStgMedium
CoInitializeEx
CoUninitialize
DispCallFunc
SysStringLen
SysFreeString
SysAllocString
VariantClear
VariantInit
?IGrooveDispatchImplHelper_SetObjectReturnValue@@YGXPAVGCoScriptDispatchTearoff@@PAUtagVARIANT@@@Z
?IGrooveDispatchImplHelper_FindMultiDispatchEntry@@YGPBUGrooveMultiDispatchEntry@@PBU1@ABU_GUID@@PB_W@Z
?HandleAllNoUIErrorCatch@@YGXXZ
?Encode@GCBase64Coder@@SG?AVGCStrRetVal@@PBEK_N@Z
?StartsWith@GCStr@@QBE_NPB_W@Z
?Set@GCStr@@QAEXPB_W@Z
?StringToLong@raw_GCStr@@SGJPB_WJ@Z
?Set@GCVariant@@QAEXABV1@@Z
?Empty@GCIPtrBase@@QAEXXZ
?SAFE_EMPTY_STRING_CBSTR@raw_GCStr@@2PB_WB
?Format@GCStr@@QAAJPB_WZZ
?CreateDirectories@GCFileInterface@@SGXPB_W@Z
?Append@GCStr@@QAEXPB_W@Z
?EndsWith@GCStr@@QBE_NPB_W@Z
?GetUserRootPath@GCStorageURIPathInfo@@QAEPB_WXZ
?CheckIsValid@GCStorageURIPathInfo@@QAEXXZ
??1GCStorageURIPathInfo@@QAE@XZ
??0GCStorageURIPathInfo@@QAE@XZ
??1GCEventSourceBase@@QAE@XZ
?CreateScriptDispatchTearoff@@YG?AV?$GCIPtrRetVal@UIDispatch@@$1?_GUID_00020400_0000_0000_c000_000000000046@@3U__s_GUID@@B@@PBUGrooveMultiDispatchEntry@@PAUIUnknown@@_N@Z
?ScriptHasInterfaceMethod@@YGJPAXPBXJGPAUtagDISPPARAMS@@PAUtagVARIANT@@@Z
?HandleAllIfMethodCatch@@YGJPBU_GUID@@@Z
??0GCStr@@QAE@PB_W@Z
?int_Inst@GCError@@CGPAUHINSTANCE__@@XZ
?int_RawError@GCError@@CG?AV1@KQAUHINSTANCE__@@JPB_W1KPAUIErrorInfo@@PAD@Z
?GOutputDebugString@@YGXPB_W@Z
?Append@GCStackStrBase@@QAEXQB_WK@Z
?Set@GCStackStrBase@@QAEXQB_WK@Z
?LongToString@raw_GCStr@@SGXJPAVGCStackStrBase@@J@Z
?int_DeallocateBufferIfNecessary@GCStackStrBase@@AAEXAAPA_W@Z
?_Release@GCStr@@AAEXXZ
?GetValue@GCRegistryKey@@QBEJAAKPB_WPAK@Z
?Open@GCRegistryKey@@QAEJK@Z
??1GCRegistryKey@@UAE@XZ
??0GCRegistryKey@@QAE@W4KEY_ROOT@0@PB_W_N@Z
?IGrooveDispatchImplHelper_IsSafeForScripting@@YG_NPBUGrooveSafeForScriptingEntry@@PAUITypeInfo@@ABU_GUID@@JG@Z
?ms_MainSTAThreadId@GCGrooveThreadId@@0KA
?hr_LoadTypeLib@GCTypeLibLoader@@SGJABU_GUID@@GGKPAPAUITypeLib@@@Z
?CreateInstanceNoRelease@GCIPtrBase@@IAEXABU_GUID@@0K@Z
?QueryInterfaceNoRelease@GCIPtrBase@@IAEXABU_GUID@@PAUIUnknown@@@Z
?IGrooveDispatchImplHelper_FindMultiDispatchEntry@@YGPBUGrooveMultiDispatchEntry@@PBU1@ABU_GUID@@J@Z
?Equals@GCStr@@QBE_NPB_W@Z
?CreateScriptDispatchTearoff@@YG?AV?$GCIPtrRetVal@UIDispatch@@$1?_GUID_00020400_0000_0000_c000_000000000046@@3U__s_GUID@@B@@PAUIUnknown@@_N@Z
?EndErrorBlock@GCCriticalErrorInfo@@SGXXZ
?StartErrorBlock@GCCriticalErrorInfo@@SGX_N@Z
??1GCAnyIPtr@@QAE@XZ
?int_Win32Error@GCError@@CG?AV1@KK@Z
?Set@GCVariant@@QAEXPB_W@Z
?AddSinkBase@IConnectionPointImplBase@@QAEJABU_GUID@@PAUIUnknown@@PAK@Z
?Length@raw_GCStr@@SGKABVGCStr@@@Z
?int_Equals@ObjectImpl@GWS@@ABE_NABVVariant@2@@Z
?int_Clone@ObjectImpl@GWS@@ABE?AVObject@2@XZ
?int_Deserialize@ObjectImpl@GWS@@AAEXPAUIXMLDOMNode@MSXML2@@PB_WPAVTypeResolver@2@@Z
?int_Serialize@ObjectImpl@GWS@@ABEXPAUIXMLDOMNode@MSXML2@@PB_W@Z
?CreateMethodArgs@Util@GWS@@SAPBUMethodArg@2@PB_WZZ
?CreateMethodDescriptors@Util@GWS@@SAPBUMethodDescriptor@2@PB_WZZ
?CreateAttrArgs@Util@GWS@@SAPBUAttrArg@2@PB_WZZ
?CreateAttrs@Util@GWS@@SAPBUAttr@2@PB_WZZ
?ReadValue@Util@GWS@@SG_NPB_W0PAX@Z
?RemoveSinkBase@GCEventSourceBase@@IAEJK@Z
?MakeTheCallsBase@GCEventSourceBase@@QAEXP6G_NPAXAAVGCFireCtx@@@Z0K0ABU_GUID@@@Z
?Init@GCFireCtx@@QAEXAAVGCDynamicUnkArray@@@Z
?DeallocateHashTable@@YGXPAXK@Z
?int_RawError@GCError@@CG?AV1@KJ@Z
??1GCError@@QAE@XZ
?int_FromLastErrorInfo@GCError@@CG?AV1@KJ_N@Z
?InterfaceSupportsErrorInfoHelper@GCoSupportErrorInfoTearOffBase@@AAEJPBXPAUIUnknown@@ABU_GUID@@@Z
?QueryInterfaceNoReleaseNoThrow@GCIPtrBase@@IAEJABU_GUID@@PAUIUnknown@@@Z
?ProvideIMarshal@GCFTMIMarshalProvider@@QAGJPAUIUnknown@@PAPAX@Z
?StopSharing@GCVariant@@AAEXXZ
?_Release@GCVariant@@AAEXXZ
?ToPowerOf2@@YGKK@Z
?AllocateHashTable@@YGPAXK@Z
?Hash@@YGKPBEKK@Z
?Compare@GCStr@@QBEJPB_W@Z
?int_COMError@GCError@@CG?AV1@JPAUIUnknown@@ABU_GUID@@11@Z
?Throw@GCError@@QBEXXZ
?HandleMessageMapErrorCatch@@YGXKIJ@Z
?HandleAllErrorCatch@@YGXXZ
?GetHandle@GCGrooveResourceModule@@SGPAUHINSTANCE__@@XZ
?Equals@raw_GCStr@@SG_NPB_W0@Z
?Create@GCRegistryKey@@QAEJK@Z
?SetValue@GCRegistryKey@@QAEJKPB_W@Z
?ConcatStringsWithLengths@GCStackStrBase@@QAAKKQB_WK0KZZ
??0GCRegistryKey@@QAE@PAUHKEY__@@PB_W_N@Z
?Set@GCErrorInfo@@SGXPAUIErrorInfo@@@Z
?SetWithConvert@GCStr@@QAEXPBD@Z
?EnableUIThreadProxy@@YGX_N@Z
?SetThreadName@@YGXPB_WK@Z
?EnumConnectionsBase@IConnectionPointImplBase@@QAEJPAPAUIEnumConnections@@@Z
??4GCAtom@@QAEABV0@PB_W@Z
?GrooveHandleShipAssert@@YGXPBDK0K@Z
?ms_RunningProcessChecked@GCSafeScriptingSupport@@0_NA
?ms_RunningInGrooveProcess@GCSafeScriptingSupport@@0_NA
?int_IsRunningInGrooveProcess@GCSafeScriptingSupport@@CG_NXZ
??1GCAtom@@QAE@XZ
?QIBase@IConnectionPointImplBase@@QAEJABU_GUID@@PAPAX@Z
?FindConnectionPointBase@IConnectionPointContainerGrooveBase@@QAEJPBU_ATL_CONNMAP_ENTRY@ATL@@ABU_GUID@@PAPAUIConnectionPoint@@@Z
?EnumConnectionPointsBase@IConnectionPointContainerGrooveBase@@QAEJPBU_ATL_CONNMAP_ENTRY@ATL@@HPAPAUIEnumConnectionPoints@@@Z
?IsWindowsVistaOrLater@GCOSVersionInformation@@SG_NXZ
?Set@raw_GCStr@@SGXAAVGCStr@@PB_WK@Z
?DeTokenize@raw_GCStr@@SG?AVGCStrRetVal@@ABVGCArrayStr@@PB_W@Z
?ToLowerInPlace@raw_GCStr@@SGXPA_WK@Z
?DeleteValue@GCRegistryKey@@QAEJPB_W@Z
?SetValue@GCRegistryKey@@QAEJPB_W0@Z
?GetValue@GCRegistryKey@@QBEJAAVGCStr@@PB_WPAK@Z
?FindLastChar@raw_GCStr@@SG_NPB_W_WAAK@Z
?EndsWithNoCase@GCStr@@QBE_NPB_W@Z
?Serialize@?$PersistHelper@UTimeRep@GWS@@@GWS@@SGXPAUIXMLDOMNode@MSXML2@@PB_WUTimeRep@2@@Z
?Deserialize@?$PersistHelper@UTimeRep@GWS@@@GWS@@SG?AUTimeRep@2@PAUIXMLDOMNode@MSXML2@@PB_WPAVTypeResolver@2@@Z
?DefaultValue@TimeRep@GWS@@2U12@A
?Decode@GCBase64Coder@@SGPAEPB_WAAKPA_N@Z
?LoadRBDString@GCRBDStringLoader@@SG?AVGCStrRetVal@@PB_W0@Z
?Mid@raw_GCStr@@SG?AVGCStrRetVal@@PB_WKK@Z
?Find@raw_GCStr@@SG_NPB_W_WAAK@Z
?Last@raw_GCStr@@SG?AVGCStrRetVal@@PB_WK@Z
?First@raw_GCStr@@SG?AVGCStrRetVal@@PB_WK@Z
?ToLowerCase@GCChar@@SG_W_W@Z
?ToLower@raw_GCStr@@SG?AVGCStrRetVal@@PB_W@Z
?Find@GCStr@@QBE_NPB_WAAK@Z
?MessageFormat@GCStr@@QAEJKPB_W000ABVGCLocale@@QAUHINSTANCE__@@@Z
?Serialize@?$PersistHelper@_N@GWS@@SGXPAUIXMLDOMNode@MSXML2@@PB_W_N@Z
??0GCDateFormat@@QAE@W4STYLE@0@0ABVGCLocale@@@Z
??1GCDate@@QAE@XZ
?Format@GCDateFormat@@QBE?AVGCStrRetVal@@ABVGCDate@@@Z
??0GCStr@@QAE@ABV0@@Z
??1GCLocale@@QAE@XZ
?GetDefault@GCLocale@@SG?BV1@XZ
?StringToUnsignedLong@raw_GCStr@@SGKPB_WJ@Z
?GetCharSet@GCIntlFontUtil@@SGEPB_W@Z
?LongToString@raw_GCStr@@SG?AVGCStrRetVal@@JJ@Z
?Tokenize_Helper@raw_GCStr@@CGXPB_W0PAVGCArrayStr@@PAV?$GCSet@VGCStr@@PB_WV?$GCHashMapResizeHelper@$01$00$03@@@@@Z
?EndsWith_Helper@raw_GCStr@@CG_NPB_W0_N@Z
?StartsWithNoCase@GCStr@@QBE_NPB_W@Z
?LaunchURL@GCHelpLauncher@@SGXPB_WPAUHWND__@@@Z
?GetHandle@GCStdCryptProv@@SGKXZ
?GetApplicationName@GCMso@@SGPB_WXZ
?FormatHelper@GCStr@@AAEJPB_WPADI@Z
?WriteValue@Util@GWS@@SA?AVGCStrRetVal@@PB_WZZ
?Set@GCError@@QAEXJPAUIUnknown@@ABU_GUID@@@Z
??0GCError@@QAE@XZ
?Set@GCVariant@@QAEXPAUIDispatch@@@Z
?int_ErrorBase@GCError@@CG?AV1@KJPB_W00PAUIErrorInfo@@JABU_GUID@@0K@Z
?Alloc@GCThunkHeap@@SGPAXK@Z
?Free@GCThunkHeap@@SGXPAX@Z
?SetFromResource@GCStr@@QAEXKQAUHINSTANCE__@@@Z
?EqualsNoCase@GCStr@@QBE_NPB_W@Z
?UsingLocalProtocol@Util@GWS@@SG_NXZ
?Prepare@SoapHttpClientImpl@GWS@@QAEXPB_W0_N@Z
??1ArrayInitializer@GWS@@QAE@XZ
??0ArrayInitializer@GWS@@QAA@HZZ
?Invoke@SoapHttpClientImpl@GWS@@IAE?AV?$Array@VObject@GWS@@@2@PB_WABV32@@Z
?DynamicCastHelper@Util@GWS@@SG?AVObject@2@PBVTypeInfo@2@ABVVariant@2@@Z
?GetMetadataLock@Object@GWS@@SGPAVGCUnenforcedReentrantSemaphore@@XZ
?CreateSerializationElement@Util@GWS@@SG?AV?$GCIPtrRetVal@UIXMLDOMElement@MSXML2@@$1?IID_IXMLDOMElement@2@3U_GUID@@B@@PAUIXMLDOMNode@MSXML2@@PBVTypeInfo@2@PB_W@Z
??1ArrayTypeInfoBase@GWS@@IAE@XZ
?TryDynamicCastHelper@Util@GWS@@SG_NAAVObject@2@PBVTypeInfo@2@ABVVariant@2@@Z
?DeserializeObject@Util@GWS@@SG?AVObject@2@PBVTypeInfo@2@PAUIXMLDOMNode@MSXML2@@PB_WPAVTypeResolver@2@@Z
??0ArrayTypeInfoBase@GWS@@IAE@PBVTypeInfo@1@@Z
?Deserialize@?$PersistHelper@_N@GWS@@SG_NPAUIXMLDOMNode@MSXML2@@PB_WPAVTypeResolver@2@@Z
?ConcatStringsToBuffer@raw_GCStr@@SAKPA_WKKPB_W1ZZ
??0GCStr@@QAE@PBDW4ExplicitConvert@0@@Z
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_decode_pointer
_onexit
_lock
__dllonexit
__CxxFrameHandler3
_encode_pointer
_unlock
?terminate@@YAXXZ
_beginthread
memcmp
_itow_s
_wtoi64
abs
strchr
qsort
floor
labs
strlen
memmove_s
_wcsicmp
_purecall
memcpy_s
memset
swprintf_s
_recalloc
free
_wcslwr_s
wcslen
wcscmp
_CxxThrowException
?GrooveDelete@@YAXPAX@Z
?GrooveNew@@YAPAXI@Z
ord31
ord11
ord32
ord10
ord44
ord43
ord23
ord61
ord55
ord19
ord15
ord18
ord22
ord64
ord58
ord24
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ