Shell Extensions
Icon overlays loaded into Explorer, and legacy shell objects, an autostart to check.
Use it to find a DLL running inside Explorer through an icon overlay, and review the legacy shell object list.
- SOFTWARE
- Persistence
What It Is
A shell extension handler is an in-process COM DLL that Windows Explorer loads to extend what it does. Examples add shortcut-menu items, property pages or custom icons for a file type. These handlers are registered as COM objects under HKEY_CLASSES_ROOT, with an InprocServer32 subkey giving the DLL path. An icon overlay handler, which adds a small badge to a file's icon, is registered by its CLSID under the ShellIconOverlayIdentifiers key in HKLM SOFTWARE.
What It Proves
A CLSID under ShellIconOverlayIdentifiers is loaded by Explorer, so its DLL runs in the shell whenever Explorer starts. ShellServiceObjectDelayLoad is a legacy companion location to review, not one proven to still load on Windows 10 and 11.
What It Does Not Prove
Each entry is a CLSID, so you must resolve it to a DLL through the Classes tree. Many legitimate extensions live here, and the Approved list does not by itself prove safety.
Where It Lives
Shell Extensions lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SOFTWARE\C:\What It Looks Like
These are two values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| WebCheck, a long standing entry in this legacy list, names a CLSID ws-042 does not register, so it resolves to no DLL. Resolve every other value the same way. |
| OneDrive's overlay handler loads into Explorer to draw sync badges. Its CLSID resolves through alice's Classes to the OneDrive DLL in her AppData, as expected. |
How to Read It
List the values under ShellServiceObjectDelayLoad, and the subkeys under Explorer ShellIconOverlayIdentifiers, whose default value is the CLSID. Resolve each CLSID to its InprocServer32 DLL in the Classes tree. Cross check the Shell Extensions Approved list. An unapproved or oddly pathed DLL is the signal.
- When Windows Writes It
- When a shell extension is registered or changed.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Autoruns, Registry Explorer, RECmd
Hunt It
Microsoft does not say which keys Defender records, so confirm it records these first. A hit shows a CLSID registered, not that Explorer loaded it. Resolve it to its DLL.
// CLSIDs added to the shell loading pointsDeviceRegistryEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Shell Extensions shows.
- COM Hijacking (User CLSID)Shows whether a user CLSID shadows one of these extensions.
- DLL Load, Sysmon Event 7Not in the RegistryShows the extension's DLL loading into Explorer, and which file it was.
Sources
The facts on this page come from these public pages, which say more on each point.