Should I block it?

No, this file is 100% safe to run.

Additional versions

6.1.7600.16385 (win7_rtm.090713-1255)	80.00%
6.1.7600.16385 (win7_rtm.090713-1255)	20.00%

(Note, Microsoft publishes each variation of this file with the same version, but the hashes are unique.)

Relationships

Parent process

svchost.exe (Host Process for Windows Services by Microsoft Corporation)

Related files

PE file structure

Show functions

Import table

advapi32.dll

TraceMessage, GetTraceEnableFlags, GetTraceEnableLevel, GetTraceLoggerHandle, RegisterTraceGuidsW, UnregisterTraceGuids, EventRegister, EventUnregister, RegDeleteKeyValueW, RegGetValueW, RegSetKeyValueW, RegCloseKey, RegEnumKeyExW, RegOpenKeyExW, RegEnumValueW, EventWrite

bcrypt.dll

BCryptDestroyHash, BCryptCloseAlgorithmProvider, BCryptOpenAlgorithmProvider, BCryptFinishHash, BCryptGetProperty, BCryptCreateHash, BCryptHashData

devobj.dll

DevObjGetDeviceProperty, DevObjOpenDeviceInfo, DevObjCreateDeviceInfoList, DevObjDestroyDeviceInfoList

dmrc.dll

DMrcQueryModelId, DMrcGetProperties, DMrcQueryClose, DMrcInit, DMrcExit, DMrcQueryHardwareId

kernel32.dll

GlobalAlloc, AcquireSRWLockShared, ReleaseSRWLockShared, GetComputerNameExW, SetThreadpoolTimer, CloseThreadpoolTimer, WaitForThreadpoolTimerCallbacks, CloseThreadpoolWork, WaitForThreadpoolWorkCallbacks, ResetEvent, SubmitThreadpoolWork, CreateThreadpoolWork, GlobalFree, ReadFile, WriteFile, SetFilePointerEx, GetFileSizeEx, WaitForSingleObject, GetCurrentProcess, CreateFileW, InterlockedIncrement, InterlockedDecrement, SetEvent, CloseHandle, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, InitializeSRWLock, DuplicateHandle, GetTickCount, CreateEventW, CreateThreadpoolTimer, GetLastError, InterlockedExchange, MultiByteToWideChar, GetSystemFirmwareTable, UnhandledExceptionFilter, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, QueryPerformanceCounter, Sleep, GetModuleHandleA, SetUnhandledExceptionFilter, GetStartupInfoA, InterlockedCompareExchange

msvcrt.dll

DllMain

ole32.dll

CoAddRefServerProcess, CoReleaseServerProcess, CoUninitialize, CLSIDFromString, IIDFromString, StringFromIID, StringFromGUID2, CoTaskMemFree, CoTaskMemAlloc, PropVariantClear, CreateStreamOnHGlobal, CoCreateInstance, CoInitializeEx, CoRegisterClassObject, CoRevokeClassObject

propsys.dll

PSPropertyKeyFromString

user32.dll

GetDisplayConfigBufferSizes, DisplayConfigGetDeviceInfo, QueryDisplayConfig

xmllite.dll

CreateXmlReader

DeviceDisplayObjectProvider.exe

Device Display Object Function Discovery Provider by Microsoft

Remove DeviceDisplayObjectProvider.exe

Version:	6.1.7600.16385 (win7_rtm.090713-1255)
MD5:	41df87cc97cd4727e5fe266c6c06e10d
SHA1:	0bbfe2506656fe8ebd432c3721758207f36fa0fd
SHA256:	19f8797dc1c69909d8d0fb563d13e955dc98a1d22fdf8b2c551731323d672505

This is a Windows system installed file with Windows File Protection (WFP) enabled.

Overview

devicedisplayobjectprovider.exe executes as a process with the local user's privileges typically within the context of its parent svchost.exe (Host Process for Windows Services by Microsoft Corporation). The assembly utilizes the .NET run-time framework (which is required to be installed on the PC). This version is designed to run on Windows 7 and is compiled as a 32 bit program.

Details

File name:	devicedisplayobjectprovider.exe
Publisher:	Microsoft Corporation
Product name:	Device Display Object Function Discovery Provider
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\devicedisplayobjectprovider.exe
File version:	6.1.7600.16385 (win7_rtm.090713-1255)
Product version:	6.1.7600.16385
Size:	84.5 KB (86,528 bytes)
Digital DNA
File packed:	No
Code language:	Microsoft Visual C# / Basic .NET
.NET CLR:	Yes
.NET NGENed:	No

More details

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00580242%	0.028634%
Kernel CPU:	0.00377675%	0.013761%
User CPU:	0.00202567%	0.014873%
Kernel CPU time:	2,839 ms/min	100,923,805ms/min
CPU cycles:	1,404,076/sec	17,470,203/sec
Memory
Private memory:	7.37 MB	21.59 MB
Private (maximum):	48.48 MB
Private (minimum):	12.16 MB
Non-paged memory:	7.37 MB	21.59 MB
Virtual memory:	83.8 MB	140.96 MB
Virtual memory (peak):	85.09 MB	169.69 MB
Working set:	48.41 MB	18.61 MB
Working set (peak):	48.55 MB	37.95 MB
Page faults:	13,174/min	2,039/min
I/O
I/O read transfer:	128 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O other transfer:	5.73 KB/sec	448.09 KB/min
I/O other operations:	246/sec	1,671/min
Resource allocations
Threads:	13	12
Handles:	353	600
GUI GDI count:	9	103
GUI GDI peak:	9	142
GUI USER count:	5	49
GUI USER peak:	5	71

Process properties

Integrety level:	Medium
Platform:	32-bit
Command line:	C:\Windows\System32\devicedisplayobjectprovider.exe -embedding
Owner:	User
Parent process:	svchost.exe (Host Process for Windows Services by Microsoft Corporation)

Threads

Averages

DeviceDisplayObjectProvider.exe (main module)
Total CPU:	0.00435144%	0.272967%
Kernel CPU:	0.00266701%	0.107585%
User CPU:	0.00168443%	0.165382%
CPU cycles:	124,918/sec	5,741,424/sec
Memory:	96 KB	1.16 MB
ntdll.dll
Total CPU:	0.00257686%
Kernel CPU:	0.00210892%
User CPU:	0.00046794%
CPU cycles:	113,328/sec
Memory:	1.23 MB

Common loaded modules

These are modules that are typiclaly loaded within the context of this process.

Distribution by Windows OS

OS version	distribution
Windows 7 Home Premium	80.00%
Windows 7 Professional	20.00%

Distribution by country

United States installs about 60.00% of Device Display Object Function Discovery Provider.

Distribution by PC manufacturer

PC Manufacturer	distribution
Sony	40.00%
Acer	40.00%
Hewlett-Packard	20.00%

Remove Adware and Spyware Programs, FREE Download!