Extended Key Usages
ExtKeyUsageCodeSigning
Static task
static1
Behavioral task
behavioral1
Sample
ShellExperienceHost.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ShellExperienceHost.exe
Resource
win10v2004-20230220-en
Target
ShellExperienceHost.exe
Size
1.6MB
MD5
9b8de9d4edf68eef2c1e490abc291567
SHA1
07bdf43cf49b2f404f8e67fd8f9feaa26ba37ec6
SHA256
0ca78990791f4c02a19dff504925657993b5c4cf0523cf0d40e11dee47012a7e
SHA512
c6d24dbe32e0fc7e96a7467c26d1a554879fe8a57296bd1231f8205d27c69a1f92b947af386d8cb10b30e34611a3818d6cc19e296da021785e7f7634cb5045ac
SSDEEP
24576:zuUWSfP6UDQ3Ux4ziHw/xUEQJ17On3Jr1KvVFFRHEvi2OiXPB:zuUlfP65Ux4FpUEQJ17On3JrcFdVEB
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
GetProcAddress
GetModuleHandleW
GetModuleFileNameA
GetModuleHandleExW
GetProcessHeap
HeapFree
HeapAlloc
WaitForSingleObject
InitializeCriticalSectionEx
CreateSemaphoreExW
DeleteCriticalSection
LeaveCriticalSection
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
InitializeSRWLock
EnterCriticalSection
ReleaseSemaphore
InitializeCriticalSection
OpenSemaphoreW
ReleaseMutex
ReleaseSRWLockShared
WaitForSingleObjectEx
CreateMutexExW
AcquireSRWLockShared
ReleaseSRWLockExclusive
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
CloseThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
SubmitThreadpoolWork
WaitForThreadpoolTimerCallbacks
EventRegister
EventWriteTransfer
EventActivityIdControl
EventUnregister
EventSetInformation
GetCurrentThreadId
TerminateProcess
GetStartupInfoW
GetCurrentProcessId
GetCurrentProcess
IsDebuggerPresent
OutputDebugStringW
DebugBreak
LCMapStringEx
FormatMessageW
CloseHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
SetLastError
GetLastError
CoTaskMemFree
CoCreateInstance
CoGetObjectContext
CoGetContextToken
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoIncrementMTAUsage
IIDFromString
CoGetApartmentType
DXGIDeclareAdapterRemovalSupport
MulDiv
InitOnceBeginInitialize
InitOnceExecuteOnce
WakeAllConditionVariable
InitializeConditionVariable
WakeConditionVariable
SleepConditionVariableSRW
InitOnceComplete
WindowsCompareStringOrdinal
WindowsCreateStringReference
WindowsPromoteStringBuffer
WindowsPreallocateStringBuffer
WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsGetStringLen
WindowsDuplicateString
WindowsDeleteStringBuffer
WindowsDeleteString
WindowsCreateString
WindowsConcatString
RoGetActivationFactory
DeleteFileW
MoveFileW
PathFileExistsW
?EventSourceAdd@Details@Platform@@YA?AVEventRegistrationToken@Foundation@Windows@@PEAPEAXPEAUEventLock@12@PE$AAVDelegate@2@@Z
?EventSourceRemove@Details@Platform@@YAXPEAPEAXPEAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z
??0InvalidArgumentException@Platform@@QE$AAA@XZ
??0NotImplementedException@Platform@@QE$AAA@XZ
?EventSourceUninitialize@Details@Platform@@YAXPEAPEAX@Z
?GetWeakReference@Details@Platform@@YAPEAU__abi_IUnknown@@QE$ADVObject@2@@Z
?CreateException@Exception@Platform@@SAPE$AAV12@HPE$AAVString@2@@Z
?get@Message@Exception@Platform@@QE$AAAPE$AAVString@3@XZ
?GetIBoxArrayVtable@Details@Platform@@YAPEAXPEAX@Z
?__abi_ObjectToString@__abi_details@@YAPE$AAVString@Platform@@PE$AAVObject@3@_N@Z
?GetIBoxVtable@Details@Platform@@YAPEAXPEAX@Z
?CreateValue@Details@Platform@@YAPE$AAVObject@2@W4TypeCode@2@PEBX@Z
?__abi_make_type_id@@YAPE$AAVType@Platform@@AEBU__abi_type_descriptor@@@Z
?GetTypeCode@Type@Platform@@SA?AW4TypeCode@2@PE$AAV12@@Z
??0NullReferenceException@Platform@@QE$AAA@XZ
?ReCreateException@Exception@Platform@@SAPE$AAV12@H@Z
??0Object@Platform@@QE$AAA@XZ
??0DisconnectedException@Platform@@QE$AAA@XZ
?AllocateException@Heap@Details@Platform@@SAPEAX_K0@Z
?GetObjectContext@Details@Platform@@YAPEAUIUnknown@@XZ
?GetProxyImpl@Details@Platform@@YAJPEAUIUnknown@@AEBU_GUID@@0PEAPEAU3@@Z
?EventSourceGetTargetArrayEvent@Details@Platform@@YAPEAXPEAXIPEBXPEA_J@Z
?Allocate@Heap@Details@Platform@@SAPEAX_K@Z
?__abi_FailFast@@YAXXZ
?ReleaseInContextImpl@Details@Platform@@YAJPEAUIUnknown@@0@Z
?ReleaseTarget@ControlBlock@Details@Platform@@AEAAXXZ
?AlignedFree@Heap@Details@Platform@@SAXPEAX@Z
??0FailureException@Platform@@QE$AAA@XZ
?__abi_WinRTraiseNotImplementedException@@YAXXZ
?__abi_WinRTraiseInvalidCastException@@YAXXZ
?__abi_WinRTraiseNullReferenceException@@YAXXZ
?__abi_WinRTraiseOperationCanceledException@@YAXXZ
?__abi_WinRTraiseFailureException@@YAXXZ
?__abi_WinRTraiseAccessDeniedException@@YAXXZ
?__abi_WinRTraiseOutOfMemoryException@@YAXXZ
?__abi_WinRTraiseInvalidArgumentException@@YAXXZ
?__abi_WinRTraiseOutOfBoundsException@@YAXXZ
?__abi_WinRTraiseChangedStateException@@YAXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YAXXZ
?__abi_WinRTraiseWrongThreadException@@YAXXZ
?__abi_WinRTraiseDisconnectedException@@YAXXZ
?InitializeData@Details@Platform@@YAJH@Z
?UninitializeData@Details@Platform@@YAXH@Z
?GetActivationFactoryByPCWSTR@@YAJPEAXAEAVGuid@Platform@@PEAPEAX@Z
?ReCreateFromException@Details@Platform@@YAJPE$AAVException@2@@Z
?GetIidsFn@@YAJHPEAKPEBU__s_GUID@@PEAPEAVGuid@Platform@@@Z
?__abi_cast_Object_to_String@__abi_details@@YAPE$AAVString@Platform@@_NPE$AAVObject@3@@Z
?__abi_cast_String_to_Object@__abi_details@@YAPE$AAVObject@Platform@@PE$AAVString@3@@Z
?get@FullName@Type@Platform@@QE$AAAPE$AAVString@3@XZ
??0ChangedStateException@Platform@@QE$AAA@XZ
?GetCmdArguments@Details@Platform@@YAPEAPEA_WPEAH@Z
?__abi_WinRTraiseObjectDisposedException@@YAXXZ
?__abi_WinRTraiseCOMException@@YAXJ@Z
?Allocate@Heap@Details@Platform@@SAPEAX_K0@Z
??0OutOfMemoryException@Platform@@QE$AAA@XZ
?EventSourceInitialize@Details@Platform@@YAXPEAPEAX@Z
??0OutOfBoundsException@Platform@@QE$AAA@XZ
?ResolveWeakReference@Details@Platform@@YAPE$AAVObject@2@AEBU_GUID@@PEAPEAU__abi_IUnknown@@@Z
?EventSourceGetTargetArray@Details@Platform@@YAPEAXPEAXPEAUEventLock@12@@Z
?Free@Heap@Details@Platform@@SAXPEAX@Z
?EventSourceGetTargetArraySize@Details@Platform@@YAIPEAX@Z
??0Delegate@Platform@@QE$AAA@XZ
_set_error_mode
_initterm
_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback
wcsnlen
memset
wcslen
_lock_locales
_unlock_locales
_o___pctype_func
_o___std_exception_copy
_o___std_exception_destroy
_o___stdio_common_vsnprintf_s
_o___stdio_common_vswprintf
_o__callnewh
_o__calloc_base
_o__cexit
_o__configthreadlocale
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__exit
_o__free_base
_o__get_narrow_winmain_command_line
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__malloc_base
_o__purecall
_o__register_onexit_function
_o___p__commode
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__wcsdup
_o_abort
_o_exit
_o_free
_o_malloc
_o_realloc
_o_set_terminate
_o_setlocale
_o_terminate
_o_wcstol
__CxxFrameHandler4
__std_terminate
wcsstr
wcsrchr
strchr
_CxxThrowException
__CxxFrameHandler3
__current_exception
__AdjustPointer
__processing_throw
__GetPlatformExceptionInfo
__C_specific_handler
memcmp
memcpy
_o____mb_cur_max_func
_o____lc_locale_name_func
_o____lc_collate_cp_func
_o____lc_codepage_func
memmove
RoOriginateError
SetRestrictedErrorInfo
GetRestrictedErrorInfo
RoFailFastWithErrorContext
RoReportUnhandledError
RoOriginateLanguageException
DecodePointer
EncodePointer
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
IsProcessorFeaturePresent
CompareStringEx
WideCharToMultiByte
GetStringTypeW
MultiByteToWideChar
QueryPerformanceCounter
GetSystemTimeAsFileTime
InterlockedPushEntrySList
InitializeSListHead
ResolveDelayLoadedAPI
DelayLoadFailureHook
SysFreeString
ceilf
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ