Extended Key Usages
ExtKeyUsageCodeSigning
Static task
static1
Behavioral task
behavioral1
Sample
ShellExperienceHost.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
ShellExperienceHost.exe
Resource
win10v2004-20231020-en
Target
ShellExperienceHost.exe
Size
925KB
MD5
009eb7525eb2aea39526cca56fb38dec
SHA1
bcef0a2f1956a5bab7d045ea9504a13cc931cd45
SHA256
3f0048d3df9799044a828e8501198df34c96ada2a64e633a780ae28debfcea4b
SHA512
f77dbab864a648cb7a30575cd5b38168a33adc2f4da25f9f4918f16ec53b8599c0cc013c614e8c9279e193b2221047c6c8f7a81e10e73b384ef9040c4cb4bf03
SSDEEP
24576:8eN23XWEeXGKTv48Kq1MM4OHUWkYBMxYKrs:JEH5eXGxtqqYKQ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
_wcsdup
abort
___lc_collate_cp_func
calloc
__pctype_func
___lc_codepage_func
___lc_handle_func
___mb_cur_max_func
__crtCompareStringW
__crtLCMapStringW
setlocale
memcpy
??0exception@@QAE@ABQBDH@Z
_callnewh
_CxxThrowException
memset
wcslen
__ExceptionPtrCurrentException
_get_current_locale
_free_locale
?terminate@@YAXXZ
memmove
_vsnwprintf
free
malloc
memcpy_s
?set_terminate@@YAP6AXXZP6AXXZ@Z
??0exception@@QAE@ABV0@@Z
_controlfp
_except_handler4_common
_acmdln
_initterm
__setusermatherr
_ismbblead
__p__fmode
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
__p__commode
_XcptFilter
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UAE@XZ
realloc
strchr
??3@YAXPAX@Z
??1bad_cast@@UAE@XZ
__ExceptionPtrCopy
__ExceptionPtrDestroy
_purecall
??0bad_cast@@QAE@ABV0@@Z
wcsrchr
wcstol
__ExceptionPtrCreate
_errno
wcsstr
_vsnprintf_s
??0exception@@QAE@XZ
??0exception@@QAE@ABQBD@Z
??0bad_cast@@QAE@PBD@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
?CreateException@Exception@Platform@@SAP$AAV12@H@Z
?Allocate@Heap@Details@Platform@@SAPAXII@Z
?__abi_WinRTraiseCOMException@@YGXJ@Z
?__abi_WinRTraiseObjectDisposedException@@YGXXZ
?__abi_WinRTraiseDisconnectedException@@YGXXZ
?__abi_WinRTraiseWrongThreadException@@YGXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YGXXZ
?__abi_WinRTraiseChangedStateException@@YGXXZ
?__abi_WinRTraiseOutOfBoundsException@@YGXXZ
?__abi_WinRTraiseInvalidArgumentException@@YGXXZ
?__abi_WinRTraiseOutOfMemoryException@@YGXXZ
?__abi_WinRTraiseAccessDeniedException@@YGXXZ
?__abi_WinRTraiseFailureException@@YGXXZ
?__abi_WinRTraiseOperationCanceledException@@YGXXZ
?__abi_WinRTraiseNullReferenceException@@YGXXZ
?__abi_WinRTraiseInvalidCastException@@YGXXZ
?__abi_WinRTraiseNotImplementedException@@YGXXZ
?Free@Heap@Details@Platform@@SAXPAX@Z
?AlignedFree@Heap@Details@Platform@@SAXPAX@Z
?ReleaseTarget@ControlBlock@Details@Platform@@AAEXXZ
?ReleaseInContextImpl@Details@Platform@@YGJPAUIUnknown@@0@Z
?GetObjectContext@Details@Platform@@YGPAUIUnknown@@XZ
?__abi_FailFast@@YGXXZ
?GetCmdArguments@Details@Platform@@YGPAPA_WPAH@Z
?GetIidsFn@@YGJHPAKPBU__s_GUID@@PAPAVGuid@Platform@@@Z
?GetActivationFactoryByPCWSTR@@YGJPAXAAVGuid@Platform@@PAPAX@Z
?UninitializeData@Details@Platform@@YGXH@Z
?InitializeData@Details@Platform@@YGJH@Z
?get@FullName@Type@Platform@@Q$AAAP$AAVString@3@XZ
?__abi_ObjectToString@__abi_details@@YGP$AAVString@Platform@@P$AAVObject@3@_N@Z
?GetIBoxVtable@Details@Platform@@YGPAXPAX@Z
?CreateValue@Details@Platform@@YGP$AAVObject@2@W4TypeCode@2@PBX@Z
?__abi_make_type_id@@YGP$AAVType@Platform@@ABU__abi_type_descriptor@@@Z
?GetTypeCode@Type@Platform@@SA?AW4TypeCode@2@P$AAV12@@Z
?__abi_cast_String_to_Object@__abi_details@@YGP$AAVObject@Platform@@P$AAVString@3@@Z
?__abi_cast_Object_to_String@__abi_details@@YGP$AAVString@Platform@@_NP$AAVObject@3@@Z
?EventSourceGetTargetArrayEvent@Details@Platform@@YGPAXPAXIPBXPA_J@Z
?EventSourceGetTargetArraySize@Details@Platform@@YGIPAX@Z
?EventSourceGetTargetArray@Details@Platform@@YGPAXPAXPAUEventLock@12@@Z
?ResolveWeakReference@Details@Platform@@YGP$AAVObject@2@ABU_GUID@@PAPAU__abi_IUnknown@@@Z
??0ChangedStateException@Platform@@Q$AAA@XZ
?EventSourceInitialize@Details@Platform@@YGXPAPAX@Z
??0OutOfBoundsException@Platform@@Q$AAA@XZ
??0FailureException@Platform@@Q$AAA@XZ
??0OutOfMemoryException@Platform@@Q$AAA@XZ
?EventSourceAdd@Details@Platform@@YG?AVEventRegistrationToken@Foundation@Windows@@PAPAXPAUEventLock@12@P$AAVDelegate@2@@Z
?EventSourceRemove@Details@Platform@@YGXPAPAXPAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z
??0InvalidArgumentException@Platform@@Q$AAA@XZ
??0NotImplementedException@Platform@@Q$AAA@XZ
?EventSourceUninitialize@Details@Platform@@YGXPAPAX@Z
?GetWeakReference@Details@Platform@@YGPAU__abi_IUnknown@@Q$ADVObject@2@@Z
?CreateException@Exception@Platform@@SAP$AAV12@HP$AAVString@2@@Z
?get@Message@Exception@Platform@@Q$AAAP$AAVString@3@XZ
?GetIBoxArrayVtable@Details@Platform@@YGPAXPAX@Z
??0NullReferenceException@Platform@@Q$AAA@XZ
?ReCreateException@Exception@Platform@@SAP$AAV12@H@Z
??0Object@Platform@@Q$AAA@XZ
??0DisconnectedException@Platform@@Q$AAA@XZ
?AllocateException@Heap@Details@Platform@@SAPAXII@Z
?GetProxyImpl@Details@Platform@@YGJPAUIUnknown@@ABU_GUID@@0PAPAU3@@Z
??0Delegate@Platform@@Q$AAA@XZ
?Allocate@Heap@Details@Platform@@SAPAXI@Z
?__abi_translateCurrentException@@YGJ_N@Z
CoGetObjectContext
CoTaskMemFree
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoGetApartmentType
CoMarshalInterThreadInterfaceInStream
CoGetContextToken
CoGetInterfaceAndReleaseStream
EventActivityIdControl
EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
HeapFree
HeapAlloc
GetProcessHeap
OutputDebugStringW
FormatMessageW
ReleaseSemaphore
EnterCriticalSection
CreateEventExW
OpenSemaphoreW
CreateSemaphoreExW
WaitForSingleObjectEx
DeleteCriticalSection
InitOnceComplete
InitOnceBeginInitialize
Sleep
LeaveCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseMutex
ResetEvent
SetEvent
CreateMutexExW
MulDiv
GetModuleFileNameA
LoadLibraryExW
GetModuleHandleExW
GetProcAddress
GetModuleHandleA
GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
CloseHandle
GetStartupInfoA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
DecodePointer
EncodePointer
RoOriginateError
RoFailFastWithErrorContext
RoReportUnhandledError
SetRestrictedErrorInfo
WindowsCreateStringReference
WindowsDuplicateString
WindowsDeleteString
WindowsCompareStringOrdinal
WindowsIsStringEmpty
WindowsConcatString
WindowsGetStringRawBuffer
WindowsCreateString
WindowsGetStringLen
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
DelayLoadFailureHook
ResolveDelayLoadedAPI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ