home

HWShell.exe

汉王笔

Hanwang Technology Co., LTD

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘HWShell’.
Publisher:
汉王科技股份有限公司  (signed by Hanwang Technology Co., LTD)

Product:
汉王笔

Description:
HWShell 应用程序

Version:
1, 0, 0, 1

MD5:
060e89e4b279d62bb8a95eaa1de1196e

SHA-1:
d8d1a979e5b99d111f838d4d47c494c17acba4a4

SHA-256:
9606c99115c19b60fdd7a7f36f5fc9557009676be416dd2f8a514128c803afe8

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/26/2024 8:18:01 AM UTC  (today)

File size:
2.1 MB (2,236,288 bytes)

Product version:
11.0.0.1

Copyright:
(C) 汉王科技股份有限公司。保留所有权利。

Original file name:
HWShell.exe

File type:
Executable application (Win32 EXE)

Language:
Chinese (Simplified, China)

Common path:
C:\Program Files\hanvon\challenger\hwshell.exe

Digital Signature
Signed by:
Hanwang Technology Co., LTD

Authority:
VeriSign, Inc.

Valid from:
9/7/2010 8:00:00 PM

Valid to:
9/14/2013 7:59:59 PM

Subject:
CN="Hanwang Technology Co., LTD", OU="PC ", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Hanwang Technology Co., LTD", L=Beijing, S=Beijing, C=CN

Issuer:
CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa (c)09, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
75889BC72C8AFF58615C95BF67E188E8

File PE Metadata
Compilation timestamp:
1/9/2013 6:24:41 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
49152:kvT0ip2qm/WWQxvSBO169xmj15eAUbgXT0uGZ6+qPoUUcFUND:bipA/BdBO169xmj15eAE00VTqQUUcFy

Entry address:
0xF73D5

Entry point:
E8, 0E, 6C, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 51, C7, 01, 5C, 10, 54, 00, E8, 96, 6C, 00, 00, 59, C3, 8B, FF, 55, 8B, EC, 56, 8B, F1, E8, E3, FF, FF, FF, F6, 45, 08, 01, 74, 07, 56, E8, 8B, BD, F0, FF, 59, 8B, C6, 5E, 5D, C2, 04, 00, 8B, FF, 55, 8B, EC, 8B, 45, 08, 83, C1, 09, 51, 83, C0, 09, 50, E8, DB, 6C, 00, 00, F7, D8, 59, 1B, C0, 59, 40, 5D, C2, 04, 00, 8B, FF, 55, 8B, EC, 56, 8B, 75, 14, 85, F6, 75, 04, 33, C0, EB, 61, 83, 7D, 08, 00, 75, 13, E8, 35, 10, 00, 00, 6A, 16, 5E, 89, 30, E8, BC, 6E, 00...
 
[+]

Entropy:
6.9026

Code size:
1.1 MB (1,155,072 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
HWShell

Command:
C:\Program Files\hanvon\challenger\hwshell.exe


Scan HWShell.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.