Should I block it?

No, this file is 100% safe to run.

VersionsAdditional versions

6.3.9600.16384 (winblue_rtm.130821-1623) 50.00%
6.1.7600.16385 (win7_rtm.090713-1255) 50.00%

Relationships

Parent process
Child processes
Related files

PE structurePE file structure
Show functions
Import table
advapi32.dll
SetSecurityDescriptorOwner, InitializeAcl, AddAccessAllowedAce, GetAce, AddAce, LookupAccountNameW, GetTokenInformation, SetSecurityDescriptorGroup, IsValidSid, GetLengthSid, CopySid, InitializeSecurityDescriptor, GetSecurityDescriptorDacl, GetAclInformation, CreateWellKnownSid, LookupAccountSidW, OpenProcessToken, SetSecurityDescriptorDacl
kernel32.dll
QueryPerformanceCounter, GetModuleHandleA, SetUnhandledExceptionFilter, GetTickCount, InterlockedCompareExchange, Sleep, InterlockedExchange, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, GetProcAddress, EncodeSystemPointer, CloseHandle, RaiseException, GetModuleFileNameW, SetCurrentDirectoryW, LoadLibraryW, FreeLibrary, GetLastError, GetStartupInfoW
mscoree.dll
DllMain
msvcrt.dll
DllMain
ole32.dll
CoUninitialize, CoInitializeEx, CoInitializeSecurity, CoCreateInstance
shlwapi.dll
PathRemoveFileSpecW

ehshell.exe

Windows Media Center by Microsoft

Remove ehshell.exe
Version:   6.3.9600.16384 (winblue_rtm.130821-1623)
MD5:   42c61f5d0b6dc7daaf14c05491d79f68
SHA1:   b87f13a25f66903ecf1bc999a4a3c45a951bbd0d
This is a Windows system installed file with Windows File Protection (WFP) enabled.

Overview

ehshell.exe executes as a process with the local user's privileges usually within the context of Windows Explorer. and is compiled as a 64 bit program.

DetailsDetails

File name:ehshell.exe
Publisher:Microsoft Corporation
Product name:Windows Media Center
Description:Microsoft® Windows® Operating System
Typical file path:C:\windows\ehome\ehshell.exe
File version:6.3.9600.16384 (winblue_rtm.130821-1623)
Product version:6.3.9600.16384
Size:102.5 KB (104,960 bytes)
Build date:8/22/2013 6:02 AM
Digital DNA
PE subsystem:Windows GUI
File packed:No
Code language:Microsoft Visual C++
.NET CLR:No
More details

ResourcesResource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)
Averages
 
CPU
Total CPU:0.00013903%
0.028634%
Kernel CPU:0.00001454%
0.013761%
User CPU:0.00012448%
0.014873%
Kernel CPU time:1,213,094 ms/min
100,923,805ms/min
CPU cycles:9,821,546/sec
17,470,203/sec
Context switches:614/sec
284/sec
Memory
Private memory:474.48 MB
21.59 MB
Private (maximum):378.32 MB
Private (minimum):8.92 MB
Non-paged memory:474.48 MB
21.59 MB
Virtual memory:1.22 GB
140.96 MB
Virtual memory (peak):1.29 GB
169.69 MB
Working set:38.45 MB
18.61 MB
Working set (peak):399.52 MB
37.95 MB
Page faults:5,200,744/min
2,039/min
I/O
I/O read transfer:5.55 MB/sec
1.02 MB/min
I/O read operations:231/sec
343/min
I/O write transfer:130.56 KB/sec
274.99 KB/min
I/O write operations:169/sec
227/min
I/O other transfer:77.69 KB/sec
448.09 KB/min
I/O other operations:840/sec
1,671/min
Resource allocations
Threads:58
12
Handles:46583
600
GUI GDI count:139
103
GUI GDI peak:217
142
GUI USER count:75
49
GUI USER peak:93
71

BehaviorsProcess properties

Integrety level:Medium
Platform:64-bit
Command line:"C:\windows\ehome\ehshell.exe"
Owner:User
Parent process:explorer.exe (Windows Explorer by Microsoft Corporation)

ResourcesThreads

Averages
 
msvcrt.dll
Total CPU:0.49737491%
0.272967%
Kernel CPU:0.21324691%
0.107585%
User CPU:0.28412800%
0.165382%
CPU cycles:58,811,298/sec
5,741,424/sec
Context switches:96/sec
79/sec
Memory:668 KB
1.16 MB
DSOUND.dll
Total CPU:0.13342171%
Kernel CPU:0.03221097%
User CPU:0.10121074%
CPU cycles:2,747,215/sec
Context switches:28/sec
Memory:540 KB
ehshell.exe (main module)
Total CPU:0.10222481%
Kernel CPU:0.01515491%
User CPU:0.08706990%
CPU cycles:7,705,238/sec
Context switches:47/sec
Memory:120 KB
ehPresenter.dll
Total CPU:0.03891924%
Kernel CPU:0.01884411%
User CPU:0.02007513%
CPU cycles:18,802,765/sec
Context switches:71/sec
Memory:164 KB
msvidctl.dll
Total CPU:0.01856009%
Kernel CPU:0.00874344%
User CPU:0.00981665%
CPU cycles:1,474,577/sec
Context switches:25/sec
Memory:3.42 MB
mcplayer.dll
Total CPU:0.01044973%
Kernel CPU:0.00562901%
User CPU:0.00482073%
CPU cycles:1,988,759/sec
Context switches:36/sec
Memory:968 KB
EVR.dll
Total CPU:0.00779652%
Kernel CPU:0.00230423%
User CPU:0.00549228%
CPU cycles:2,082,297/sec
Context switches:25/sec
Memory:652 KB
clr.dll
Total CPU:0.00630132%
Kernel CPU:0.00082215%
User CPU:0.00547917%
CPU cycles:203,010/sec
Memory:9.48 MB
quartz.dll
Total CPU:0.00367728%
Kernel CPU:0.00331429%
User CPU:0.00036299%
CPU cycles:900,796/sec
Context switches:7/sec
Memory:1.69 MB
mswmdm.dll
Total CPU:0.00010749%
Kernel CPU:0.00009772%
User CPU:0.00000977%
CPU cycles:3,438/sec
Memory:416 KB
sqlcese40.dll
Total CPU:0.00001954%
Kernel CPU:0.00001954%
User CPU:0.00000000%
CPU cycles:1,404/sec
Memory:528 KB
ntdll.dll
Total CPU:0.00001954%
Kernel CPU:0.00001954%
User CPU:0.00000000%
CPU cycles:19/sec
Memory:1.66 MB

Common loaded modules

These are modules that are typiclaly loaded within the context of this process.

Windows OS versionsDistribution by Windows OS

OS versiondistribution
Windows 8.1 Pro with Media Center 50.00%
Windows 7 Ultimate 50.00%

Distribution by countryDistribution by country

United States installs about 100.00% of Windows Media Center.
Back to top
Should I remove It? Clean your PC of unwanted adware, toolbars and bloatware.

Download it for FREE