home

wshelper.exe

Wondershare Studio

Wondershare

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘Wondershare Helper Compact.exe’.
Publisher:
Wondershare

Product:
Wondershare Studio

Version:
2.1.2.4

MD5:
62671fd60d37214538cc44d0d603bc21

SHA-1:
0a665da9f65f82f0f1afc9bef7a03fb033fc29b4

SHA-256:
121d9f9658a5c462d7597a6efd54a769eb40e8b4a5a16382b2bc0d4434970559

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/23/2024 9:24:34 AM UTC  (today)

File size:
1.9 MB (1,980,416 bytes)

Product version:
1.2.5.30

Copyright:
Copyright (c) 2014 Wondershare Software All Rights Reserved

Trademarks:
Wondershare

Original file name:
Wondershare Studio

File type:
Executable application (Win32 EXE)

Language:
Chinese

Common path:
C:\Program Files\common files\wondershare\wondershare helper compact\wshelper.exe

File PE Metadata
Compilation timestamp:
12/18/2013 4:43:05 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:xjzBplZJ8f8kfZetrcicOAyVgpToT2+Wz2qvCCWmA3dEI3vlhtVrF7KHgn61l5ZV:xXDO8kdYW2YA62oVsrWiTlTa68z

Entry address:
0x19340C

Entry point:
55, 8B, EC, 83, C4, E0, 33, C0, 89, 45, E0, 89, 45, E4, 89, 45, EC, 89, 45, E8, B8, FC, 17, 59, 00, E8, 26, 5F, E7, FF, 33, C0, 55, 68, C7, 35, 59, 00, 64, FF, 30, 64, 89, 20, E8, 03, E3, FF, FF, A1, C8, 36, 5A, 00, 8B, 00, E8, A3, B3, E7, FF, 84, C0, 0F, 84, 48, 01, 00, 00, 8D, 55, E8, 33, C0, E8, 11, 01, E7, FF, 8B, 45, E8, 8D, 55, EC, E8, 9A, B9, E7, FF, 8D, 45, EC, BA, E0, 35, 59, 00, E8, 8D, 36, E7, FF, 8B, 4D, EC, B2, 01, A1, EC, 64, 4C, 00, E8, 0E, 67, F3, FF, 8B, 15, 58, 30, 5A, 00, 89, 02, E8, D9...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
1.6 MB (1,648,640 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
Wondershare Helper Compact.exe

Command:
C:\Program Files\common files\wondershare\wondershare helper compact\wshelper.exe


Scan wshelper.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.