CustomShellHost.exe
- File Path:
C:\WINDOWS\system32\CustomShellHost.exe - Description: CustomShellHost
Hashes
| Type | Hash |
|---|---|
| MD5 | 64D3EF230EA1825B86EC4519749EAF89 |
| SHA1 | 8EEA3D70F8AC0295596E39BA918E6E8D38C6DF57 |
| SHA256 | A05B28DFEAD053DCE2BCD0CA8CEC54650366AE06080561C4170E65DC6886C2DB |
| SHA384 | 041DF9C5ADF0ABCD6B0464CC354D1DA833DC0703A7116C0A7124BFE028CFC8089FA8458F5351E8BAEF0F1ED8A96715F9 |
| SHA512 | 0B546E216EBB21A49DB76067549C03A88A6837EB0D02798132F106F06C73FDBA700CFA687D2550AE921731E05FD88D6ABA9C0AAF347C271A58A56707EDAD5641 |
| SSDEEP | 24576:KEjPhtjawnV07p8kwP7MCVtkYQvODhHOERgGV+3KygHvQ/vbtW+SKhXmCSqLqpyT:KwPhtjawyp8kwICDDQWDhHOvGE6BPQ3z |
| IMP | 50E0C1A42BCBDB084E562F6015BDF223 |
| PESHA1 | 3C2D65355020C727AA5AB717002BF5C83987A380 |
| PE256 | 205BB4F6519DCCBAA51B90B9379D7C6DE25348EB9E9D845F389D9C85E6E1A479 |
Runtime Data
Child Processes:
explorer.exe
Loaded Modules:
| Path |
|---|
| C:\WINDOWS\System32\ADVAPI32.dll |
| C:\WINDOWS\System32\combase.dll |
| C:\WINDOWS\system32\CustomShellHost.exe |
| C:\WINDOWS\System32\GDI32.dll |
| C:\WINDOWS\System32\gdi32full.dll |
| C:\WINDOWS\System32\IMM32.DLL |
| C:\WINDOWS\System32\KERNEL32.DLL |
| C:\WINDOWS\System32\KERNELBASE.dll |
| C:\WINDOWS\System32\msvcp_win.dll |
| C:\WINDOWS\System32\msvcrt.dll |
| C:\WINDOWS\SYSTEM32\ntdll.dll |
| C:\WINDOWS\System32\ole32.dll |
| C:\WINDOWS\System32\OLEAUT32.dll |
| C:\WINDOWS\SYSTEM32\powrprof.dll |
| C:\WINDOWS\system32\PROPSYS.dll |
| C:\WINDOWS\System32\RPCRT4.dll |
| C:\WINDOWS\System32\sechost.dll |
| C:\WINDOWS\System32\SHCORE.dll |
| C:\WINDOWS\System32\SHELL32.dll |
| C:\WINDOWS\System32\SHLWAPI.dll |
| C:\WINDOWS\system32\SspiCli.dll |
| C:\WINDOWS\System32\ucrtbase.dll |
| C:\WINDOWS\system32\UMPDC.dll |
| C:\WINDOWS\System32\USER32.dll |
| C:\WINDOWS\system32\USERENV.dll |
| C:\WINDOWS\System32\win32u.dll |
| C:\WINDOWS\system32\WTSAPI32.dll |
| C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.22000.1_none_271a8fad6a2d1b1e\COMCTL32.dll |
Signature
- Status: Signature verified.
- Serial:
33000002ED2C45E4C145CF48440000000002ED - Thumbprint:
312860D2047EB81F8F58C29FF19ECDB4C634CF6A - Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
File Metadata
- Original Filename: CustomShellHost.exe
- Product Name: Microsoft Windows Operating System
- Company Name: Microsoft Corporation
- File Version: 10.0.22000.120 (WinBuild.160101.0800)
- Product Version: 10.0.22000.120
- Language: English (United States)
- Legal Copyright: Microsoft Corporation. All rights reserved.
- Machine Type: 64-bit
File Scan
- VirusTotal Detections: 0/72
- VirusTotal Link: https://www.virustotal.com/gui/file/a05b28dfead053dce2bcd0ca8cec54650366ae06080561c4170e65dc6886c2db/detection
MIT License. Copyright (c) 2020-2021 Strontic.