Extended Key Usages
ExtKeyUsageCodeSigning
Static task
static1
Behavioral task
behavioral1
Sample
SettingSyncHost.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
SettingSyncHost.exe
Resource
win10v2004-20230221-en
Target
SettingSyncHost.exe
Size
808KB
MD5
4a6de1c22cc7dd0e1fe961cd332612c7
SHA1
973ceaf0f02eb90553b36b3ae5d859245bf5f3b4
SHA256
beac3a39f7b8e0e3542ba6b8ab57ebfb1621c7b6c24524ebb195d1952cf27528
SHA512
fb08a4bdf7583fe3d283b64d03fdeefdc1fed0da12984afa530eb06d0372492829fac145416caa6c7982fa0d11afc648e92930ebd4a21879924cfea01bb63617
SSDEEP
24576:G3TDDYN/r99VuTK0/Bss6xp/z1HgcgAWAvv5H:+TOfuG0pss6xpmle5H
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
iswalnum
wcschr
wcsstr
_CxxThrowException
_vsnprintf_s
wcstok_s
swscanf_s
_ftol2
??0exception@@QAE@ABV0@@Z
memcmp
_wcstoui64
_vsnwprintf
strncmp
memmove
_except_handler4_common
_controlfp
_wcsnicmp
wcsncpy_s
malloc
?terminate@@YAXXZ
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
_wcmdln
_initterm
__setusermatherr
__p__fmode
_callnewh
_cexit
??1type_info@@UAE@XZ
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
memmove_s
realloc
_wcsicmp
toupper
time
_XcptFilter
free
_get_errno
_set_errno
??1exception@@UAE@XZ
_purecall
??0exception@@QAE@XZ
memcpy_s
memcpy
srand
rand
memset
LoadResource
GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
SizeofResource
GetModuleFileNameW
LockResource
CreateSemaphoreExW
ReleaseSemaphore
InitializeSRWLock
WaitForSingleObject
InitializeCriticalSection
ReleaseMutex
CreateEventW
WaitForSingleObjectEx
AcquireSRWLockShared
InitializeCriticalSectionEx
DeleteCriticalSection
ReleaseSRWLockShared
OpenSemaphoreW
SetEvent
CreateMutexExW
CreateEventExW
ResetEvent
ReleaseSRWLockExclusive
OpenEventW
EnterCriticalSection
AcquireSRWLockExclusive
CreateMutexW
LeaveCriticalSection
TryAcquireSRWLockExclusive
HeapAlloc
GetProcessHeap
HeapFree
HeapSetInformation
SetUnhandledExceptionFilter
SetLastError
GetLastError
RaiseException
UnhandledExceptionFilter
TerminateProcess
OpenProcessToken
GetCurrentProcess
OpenThreadToken
ProcessIdToSessionId
GetCurrentThreadId
GetStartupInfoW
SetThreadPriority
SetPriorityClass
CreateProcessW
GetCurrentThread
GetCurrentProcessId
GetUserGeoID
FormatMessageW
GetGeoInfoW
LCMapStringEx
OutputDebugStringW
DebugBreak
IsDebuggerPresent
CloseHandle
DuplicateHandle
CoCreateFreeThreadedMarshaler
StringFromGUID2
CoDisableCallCancellation
CoEnableCallCancellation
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCancelCall
StringFromCLSID
CoReleaseMarshalData
CoCreateGuid
CoGetCallContext
CoUninitialize
CoFreeUnusedLibraries
CoInitializeEx
CoGetMalloc
CoCreateInstance
CoSetProxyBlanket
StringFromIID
CoResumeClassObjects
CoRegisterClassObject
CoWaitForMultipleHandles
CoTaskMemAlloc
CoTaskMemRealloc
CoRevokeClassObject
CoAddRefServerProcess
CoGetApartmentType
CoReleaseServerProcess
CoTaskMemFree
CLSIDFromString
PropVariantClear
WindowsIsStringEmpty
WindowsCreateString
WindowsCreateStringReference
WindowsCompareStringOrdinal
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsStringHasEmbeddedNull
SHTaskPoolQueueTask
SHTaskPoolGetUniqueContext
LocalAlloc
LocalFree
LocalReAlloc
WideCharToMultiByte
MultiByteToWideChar
CompareStringOrdinal
EventWriteTransfer
EventProviderEnabled
EventSetInformation
EventUnregister
EventRegister
CreateFileW
GetFileAttributesW
FindClose
RemoveDirectoryW
FindNextFileW
GetTempFileNameW
FindFirstFileW
GetFileAttributesExW
CompareFileTime
DeleteFileW
CreateDirectoryW
WriteFile
SetFileAttributesW
SetFileTime
InitOnceExecuteOnce
SleepConditionVariableSRW
Sleep
InitOnceComplete
InitOnceBeginInitialize
WakeAllConditionVariable
RegDeleteTreeW
RegQueryValueExW
RegDeleteValueW
RegQueryInfoKeyW
RegOpenCurrentUser
RegEnumKeyExW
RegGetValueW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegEnumValueW
RegOpenKeyExW
TraceMessage
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
ZwClose
AlpcGetMessageAttribute
AlpcInitializeMessageAttribute
TpWaitForAlpcCompletion
ZwAlpcConnectPort
RtlWaitOnAddress
ZwAlpcQueryInformation
TpReleaseAlpcCompletion
ZwAlpcSendWaitReceivePort
ZwAlpcDisconnectPort
TpAllocAlpcCompletion
RtlWakeAddressAll
ZwAlpcCancelMessage
RtlFreeHeap
RtlAllocateHeap
RtlInitUnicodeString
vDbgPrintEx
NtPowerInformation
RtlGetSuiteMask
RtlPublishWnfStateData
NtCreateWnfStateName
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlFreeUnicodeString
RtlConvertSidToUnicodeString
NtQueryWnfStateData
EtwTraceMessage
EtwEventActivityIdControl
NtSetInformationProcess
NtSetInformationThread
RtlNtStatusToDosError
SHCreateThreadWithHandle
FindResourceW
IStream_Reset
IStream_Copy
SHCreateStreamOnFileW
IStream_Read
IStream_WriteStr
SHOpenRegStream2W
IStream_Write
SHCreateMemStream
IStream_Size
GetTempPathW
GetSystemTime
GetTickCount
GetVersionExW
GetTickCount64
GetSystemTimeAsFileTime
GetSystemDirectoryW
CommandLineToArgvW
SHStrDupW
RoOriginateError
RoOriginateErrorW
SetRestrictedErrorInfo
RoTransformError
DecodePointer
EncodePointer
RoGetActivationFactory
RoRegisterActivationFactories
RoActivateInstance
RoRevokeActivationFactories
QueryPerformanceCounter
CreateThreadpoolTimer
CloseThreadpoolWait
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpool
CloseThreadpool
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolTimerCallbacks
CharLowerBuffW
PathAllocCombine
PathCchAppend
RegDeleteKeyValueW
CreateTimerQueueTimer
DeleteTimerQueueTimer
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
StrRChrW
StrStrIW
QISearch
StrToIntExW
RoGetAgileReference
PathGetCharTypeW
PathStripPathW
PathFindFileNameW
GetTokenInformation
AdjustTokenPrivileges
GetSidSubAuthority
CreateWellKnownSid
SHDeleteValueW
SHSetValueW
SHRegGetPathW
SHRegGetValueW
SHRegSetPathW
SHDeleteKeyW
UuidCreate
ExpandEnvironmentStringsW
PowerDeterminePlatformRoleEx
GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW
ApiSetQueryApiSetPresence
SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
ResolveDelayLoadedAPI
DelayLoadFailureHook
PSPropertyBag_WriteUnknown
PropVariantToUInt32
PropVariantToBoolean
PSPropertyBag_WriteStr
PropVariantToStringAlloc
PSCreateMemoryPropertyStore
QueryFullProcessImageNameW
GetProfileType
GetOsSafeBootMode
UrlEscapeW
SystemTimeToFileTime
FileTimeToSystemTime
RoGetMatchingRestrictedErrorInfo
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ