CallingShellApp.exe
- File Path:
C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\CallingShellApp.exe
- Description: Calling App to host call progress on shell
Hashes
| Type |
Hash |
| MD5 |
C5415F104A4060D90CE1675383308A66 |
| SHA1 |
1FF6961AF28778A3154A2522930F79CF25BC8861 |
| SHA256 |
E3041999EB0A4378E18D792A3CAE1D8F60DD3C438069ACA0B17AA6457C2DA4FB |
| SHA384 |
EAD6789E0964EBEB46E7D54E06FFED2E71886F09FE967A56699431193850DD5424EFEA63AE96DDF0DC496D2EC25A9C3B |
| SHA512 |
FF6F7C208F8B42BF32ED0462D76D264D4D89277FB183D3ACFE4B62D4572D782C99D8EAFB430AC9AEE9C601D70282298C72645E3EACA2E217179969CC0E9F6FE2 |
| SSDEEP |
6144:+Gr4CVtlX5mblAO7rVLqUjKcHIgm0DtpY0ZpRO:+GrV5mOL3cHIgm0bD |
| IMP |
B5960A682BD4DDB8B60C1FE8588A5B6B |
| PESHA1 |
0CEE4FBD40E832A215DDAB68E661432EF64E08D0 |
| PE256 |
9F9C901F7103998D7F8059EC795F5C153A983BA11542FE61E5A7CDAA201DDC58 |
Runtime Data
Child Processes:
CallingShellApp.exe WerFault.exe
Open Handles:
| Path |
Type |
| (RW-) C:\Users\user |
File |
| \BaseNamedObjects__ComCatalogCache__ |
Section |
| \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db |
Section |
| \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db |
Section |
| \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2 |
Section |
| \BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 |
Section |
| \BaseNamedObjects\NLS_CodePage_437_3_2_0_0 |
Section |
Loaded Modules:
| Path |
| C:\Windows\System32\combase.dll |
| C:\Windows\System32\KERNEL32.DLL |
| C:\Windows\System32\KERNELBASE.dll |
| C:\Windows\SYSTEM32\ntdll.dll |
| C:\Windows\System32\RPCRT4.dll |
| C:\Windows\System32\ucrtbase.dll |
| C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\CallingShellApp.exe |
Signature
- Status: Signature verified.
- Serial:
3300000266BD1580EFA75CD6D3000000000266
- Thumbprint:
A4341B9FD50FB9964283220A36A1EF6F6FAA7840
- Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Original Filename: CallingShellApp.exe
- Product Name: Microsoft Windows Operating System
- Company Name: Microsoft Corporation
- File Version: 10.0.19041.546 (WinBuild.160101.0800)
- Product Version: 10.0.19041.546
- Language: English (United States)
- Legal Copyright: Microsoft Corporation. All rights reserved.
- Machine Type: 64-bit
File Scan
- VirusTotal Detections: 0/75
- VirusTotal Link: https://www.virustotal.com/gui/file/e3041999eb0a4378e18d792a3cae1d8f60dd3c438069aca0b17aa6457c2da4fb/detection
MIT License. Copyright (c) 2020-2021 Strontic.