Should I block it?

No, this file is 100% safe to run.

VersionsAdditional versions

6.3.9600.16384 (winblue_rtm.130821-1623) 1.93%
6.3.9600.16384 (winblue_rtm.130821-1623) 0.11%
6.3.9600.16384 (winblue_rtm.130821-1623) 2.90%
6.3.9431.0 (winmain_bluemp.130615-1214) 0.27%
6.3.9431.0 (winmain_bluemp.130615-1214) 0.05%
6.2.9200.16384 (win8_rtm.120725-1247) 2.68%
6.2.9200.16384 (win8_rtm.120725-1247) 15.40%
6.2.8400.0 (winmain_win8rc.120518-1423) 0.11%
6.2.8400.0 (winmain_win8rc.120518-1423) 0.11%
6.2.8250.0 (winmain_win8beta.120217-1520) 0.05%
6.2.8102.0 (winmain_win8m3.110823-1455) 0.11%
6.1.7600.16385 (win7_rtm.090713-1255) 6.49%
6.1.7600.16385 (win7_rtm.090713-1255) 43.56%
6.1.7600.16385 (win7_rtm.090713-1255) 20.49%
6.1.7600.16385 (win7_rtm.090713-1255) 4.02%
6.1.7600.16385 (win7_rtm.090713-1255) 0.05%
6.1.7600.16385 (win7_rtm.090713-1255) 0.05%
6.1.7600.16385 (win7_rtm.090713-1255) 0.21%
6.0.6001.18000 (longhorn_rtm.080118-1840) 0.91%
6.0.6001.18000 (longhorn_rtm.080118-1840) 0.11%
6.0.6001.18000 (longhorn_rtm.080118-1840) 0.16%
6.0.6000.16386 (vista_rtm.061101-2205) 0.21%

Relationships


PE structurePE file structure

Show functions
Import table
advapi32.dll
RegCreateKeyExW, RegQueryInfoKeyW, RegDeleteValueW, RegOpenKeyExW, RegEnumKeyExW, RegCloseKey, RegSetValueExW, TraceMessage, DuplicateTokenEx, RegQueryValueExW, GetUserNameW, GetTraceLoggerHandle, GetTraceEnableLevel, GetTraceEnableFlags, RegisterTraceGuidsW, UnregisterTraceGuids, SetServiceStatus, GetSecurityDescriptorSacl, GetSecurityDescriptorDacl, GetSecurityDescriptorGroup, GetSecurityDescriptorOwner, GetSecurityDescriptorControl, GetLengthSid, IsValidSid, CopySid, GetSidSubAuthority, InitializeSid, GetSidLengthRequired, SetSecurityDescriptorOwner, InitializeSecurityDescriptor, MakeAbsoluteSD, SetSecurityDescriptorGroup, SetSecurityDescriptorDacl, AddAce, InitializeAcl, GetAclInformation, IsValidSecurityDescriptor, RegEnumValueW, LookupAccountNameW, RegisterServiceCtrlHandlerW, StartServiceCtrlDispatcherW, OpenSCManagerW, OpenServiceW, CloseServiceHandle, CreateServiceW, ControlService, DeleteService, InitiateShutdownW, RegGetValueW, RegUnLoadKeyW, RegLoadKeyW, CheckTokenMembership, SetSecurityInfo, LsaNtStatusToWinError, GetSecurityDescriptorLength, GetSecurityInfo, EventRegister, EventEnabled, EventUnregister, EventWrite, SetThreadToken, OpenThreadToken, StartTraceW, EnableTrace, ControlTraceW, LsaFreeMemory, GetWindowsAccountDomainSid, ConvertSidToStringSidW, AdjustTokenPrivileges, RevertToSelf, ConvertStringSecurityDescriptorToSecurityDescriptorW, ImpersonateLoggedOnUser, LsaClose, SetFileSecurityW, LogonUserExExW, LookupPrivilegeValueW, EqualSid, LsaOpenPolicy, LsaQueryInformationPolicy, OpenProcessToken, QueryServiceStatus, EnumDependentServicesW, TraceEvent, LogonUserW, SetNamedSecurityInfoW
bcrypt.dll
BCryptOpenAlgorithmProvider, BCryptHashData, BCryptFinishHash, BCryptCloseAlgorithmProvider, BCryptCreateHash, BCryptGetProperty, BCryptDestroyHash
clusapi.dll
GetNodeClusterState
kernel32.dll
CreateThread, GetTickCount, RemoveDirectoryW, HeapSetInformation, CreateWaitableTimerW, WaitForSingleObjectEx, GetCommandLineW, GetCurrentThreadId, CopyFileW, DeviceIoControl, GetFullPathNameW, GetDriveTypeW, GetSystemWindowsDirectoryW, lstrlenW, GetVolumePathNameW, FindVolumeClose, OutputDebugStringW, GlobalAlloc, GlobalLock, GlobalFree, GlobalUnlock, SetErrorMode, CancelIoEx, GetFileAttributesExW, QueryDosDeviceW, DeleteVolumeMountPointW, GetLogicalDrives, SetVolumeMountPointW, SetWaitableTimer, GetLocalTime, GetFileSize, GetLongPathNameW, SetFileValidData, SetFilePointerEx, SetEndOfFile, GetVolumeInformationW, CancelIo, GetOverlappedResult, GetCurrentThread, SleepEx, SetFilePointer, CompareStringOrdinal, CopyFileExW, LocalAlloc, SetLastError, FormatMessageW, GetSystemDirectoryW, GetTickCount64, ExpandEnvironmentStringsW, GetWindowsDirectoryW, GetSystemInfo, GetProductInfo, GetComputerNameExW, GetTempPathW, GetVersionExW, SetFileAttributesW, GetFileInformationByHandle, GetVolumeNameForVolumeMountPointW, FindNextFileW, SetFileInformationByHandle, GetFileInformationByHandleEx, CreateDirectoryW, FindFirstFileW, GetVolumePathNamesForVolumeNameW, GetDiskFreeSpaceExW, GetFileAttributesW, OutputDebugStringA, GetCurrentProcessId, QueryPerformanceCounter, GetModuleHandleA, TerminateProcess, GetCurrentProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetStartupInfoW, InterlockedCompareExchange, FindNextVolumeW, FindFirstVolumeW, GetTimeZoneInformation, SetThreadExecutionState, FileTimeToLocalFileTime, Sleep, SetVolumeLabelW, FileTimeToSystemTime, CompareFileTime, FindClose, MoveFileW, ReadFile, MoveFileExW, FlushFileBuffers, WriteFile, DeleteFileW, GetSystemTimeAsFileTime, SystemTimeToFileTime, GetSystemTime, LocalFree, GetFileSizeEx, CreateFileW, ResetEvent, WaitForSingleObject, SetEvent, CloseHandle, CreateEventW, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, lstrcmpiW, EnterCriticalSection, GetProcAddress, GetLastError, RaiseException, MultiByteToWideChar, GetModuleFileNameW, LeaveCriticalSection, SizeofResource, InitializeCriticalSection, GetModuleHandleW, InterlockedDecrement, InterlockedIncrement, LoadLibraryExW, LoadResource, FreeLibrary, FindResourceExW, TlsGetValue, HeapDestroy, HeapAlloc, HeapReAlloc, HeapFree, HeapSize, GetProcessHeap, GetEnvironmentVariableW, InterlockedExchange, CreateSymbolicLinkW, CompareStringW, FindResourceW, LoadLibraryW, GetVersionExA
msvcrt.dll
DllMain
netapi32.dll
NetShareAdd, NetApiBufferFree, NetShareDel, NetShareGetInfo
ntdll.dll
ZwDeviceIoControlFile, ZwResetEvent, ZwQueryInformationFile, RtlStringFromGUID, RtlFreeUnicodeString, RtlGUIDFromString, NtQuerySystemInformation, ZwAllocateUuids, NtOpenKey, NtDeviceIoControlFile, NtOpenSymbolicLinkObject, NtQuerySymbolicLinkObject, NtWaitForSingleObject, NtClose, NtCreateEvent, NtQueryValueKey, NtSetValueKey, NtOpenFile, NtResetEvent, NtCreateKey, NtSetSecurityObject, NtDeleteKey, NtQueryInformationFile, NtQueryKey, NtQueryVolumeInformationFile, NtSetInformationKey, RtlSetAllBits, RtlSetBits, RtlInitializeBitMap, RtlSetBit, RtlNumberOfSetBits, RtlAreBitsSet, RtlClearAllBits, EtwTraceMessage, RtlNumberOfClearBits, RtlCompareMemory, RtlFindNextForwardRunClear, RtlClearBits, RtlAreBitsClear, NtCreateFile, RtlDosPathNameToNtPathName_U, WinSqmAddToStreamEx, RtlCreateSystemVolumeInformationFolder, RtlGetSetBootStatusData, RtlUnlockBootStatusData, ZwDeleteFile, ZwQueryVolumeInformationFile, ZwWaitForSingleObject, ZwOpenSymbolicLinkObject, LdrGetDllHandle, LdrGetProcedureAddress, RtlGetVersion, RtlInitAnsiString, ZwQuerySymbolicLinkObject, ZwCreateEvent, RtlSetOwnerSecurityDescriptor, ZwOpenKey, RtlCreateSecurityDescriptor, RtlLengthSid, ZwEnumerateKey, ZwDeleteKey, RtlAllocateAndInitializeSid, ZwLoadKey, RtlAddAccessAllowedAceEx, ZwSetSecurityObject, RtlLengthSecurityDescriptor, ZwQueryValueKey, ZwCreateFile, ZwOpenProcessTokenEx, ZwSaveKey, ZwAdjustPrivilegesToken, ZwSetValueKey, ZwDeleteValueKey, RtlSetDaclSecurityDescriptor, RtlFreeSid, ZwQueryAttributesFile, RtlCreateAcl, ZwOpenThreadTokenEx, ZwCreateKey, ZwUnloadKey, RtlInitUnicodeString, WinSqmAddToStream, RtlNtStatusToDosError, RtlGetLastNtStatus, RtlFreeHeap, ZwClose, ZwQuerySystemInformation, ZwOpenFile, RtlAllocateHeap, ZwQueryKey, NtDeleteFile, NtAllocateUuids, NtSaveKey, NtDeleteValueKey, NtOpenThreadToken, NtOpenProcessToken, NtAdjustPrivilegesToken, NtLoadKey, NtUnloadKey, NtQueryAttributesFile, NtEnumerateKey
ole32.dll
CoRegisterClassObject, CoRevokeClassObject, CoCreateGuid, CLSIDFromString, CreateStreamOnHGlobal, CoTaskMemRealloc, CoTaskMemFree, CoTaskMemAlloc, StringFromGUID2, CoCreateInstance, CoInitializeEx, CoUninitialize, CoInitializeSecurity, CoSuspendClassObjects, CoResumeClassObjects, CreateClassMoniker, CoDisconnectObject, GetRunningObjectTable, CoImpersonateClient, CoRevertToSelf
rpcrt4.dll
UuidToStringW, UuidCreate, UuidFromStringW, RpcStringFreeW
setupapi.dll
SetupDiGetDeviceRegistryPropertyW, SetupDiDestroyDeviceInfoList, SetupGetInfDriverStoreLocationW, SetupDiGetClassDevsW, SetupDiEnumDeviceInterfaces, SetupDiGetDeviceInterfaceDetailW, SetupEnumPublishedInfW
spp.dll
SppFreeBadWritersArray
user32.dll
CharUpperW, MessageBoxW, UnregisterClassA, CharUpperBuffW, CharNextW, LoadStringW, PostThreadMessageW, GetMessageW, TranslateMessage, DispatchMessageW
virtdisk.dll
CreateVirtualDisk, GetVirtualDiskOperationProgress, GetStorageDependencyInformation, AttachVirtualDisk, OpenVirtualDisk, GetVirtualDiskPhysicalPath, SetVirtualDiskInformation, CompactVirtualDisk, DetachVirtualDisk, GetVirtualDiskInformation
vssapi.dll
VssFreeSnapshotPropertiesInternal, CreateVssBackupComponentsInternal, CreateVssExamineWriterMetadataInternal
wer.dll
WerReportSetParameter, WerReportSubmit, WerReportCreate, WerReportAddFile, WerReportCloseHandle
xmllite.dll
CreateXmlReaderInputWithEncodingName, CreateXmlReader

wbengine.exe

Microsoft Block Level Backup Engine Service EXE by Microsoft

Remove wbengine.exe
Version:   6.0.6001.18000 (longhorn_rtm.080118-1840)
MD5:   20b23332885dfb93fe0185362ee811e9
SHA1:   27a4e669f9ccf8a3b9118159d505b729f8eb257e
SHA256:   67b8026e8285feb6e3939deee4e0f2fd0fa0917e0ed0f1fae56b7841af74c8f8
This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is wbengine.exe?

Block Level Backup Engine Service allows for a Complete PC backup at the block level of the Hard Drive, versus file by file. This means you get an image of the hard drive. This service backs up your PC at the block level and not file by file. This essentially means creating an image of the drive. This service is part of Vista's drive backup capability.

Overview

wbengine.exe runs as a service under the name Servicio del módulo de copia de seguridad a nivel de bloque (wbengine) within the local user context. .

DetailsDetails

File name:wbengine.exe
Publisher:Microsoft Corporation
Product name:Microsoft® Block Level Backup Engine Service EXE
Description:Microsoft® Windows® Operating System
Typical file path:C:\Windows\System32\wbengine.exe
Original name:wbengine.exe.mui
File version:6.0.6001.18000 (longhorn_rtm.080118-1840)
Product version:6.0.6001.18000
Size:897 KB (918,528 bytes)
Digital DNA
PE subsystem:Windows GUI
Entropy:6.665709
File packed:No
Code language:Microsoft Visual C++
.NET CLR:No
More details

BehaviorsBehaviors

Services
Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)
  • 'wbengine' (Servicio del módulo de copia de seguridad a nivel de bloque)
  • 'wbengine'

Windows OS versionsDistribution by Windows OS

OS versiondistribution
Windows 7 Home Premium 33.00%
Windows 8.1 18.50%
Windows 7 Ultimate 14.00%
Windows 8.1 Pro 8.00%
Windows 7 Professional 6.00%
Windows 8 4.00%
Windows 8.1 Single Language 3.50%
Windows 8.1 Pro with Media Center 3.00%
Windows 8 Pro 3.00%
Windows 8 Single Language 2.50%
Windows 7 Home Basic 1.50%
Windows 8 Enterprise N 1.00%
Windows 8.1 N 0.50%
Windows Seven Black Edition 0.50%
Windows 8.1 Enterprise Evaluation 0.50%
Windows 8 Enterprise 0.50%

Distribution by countryDistribution by country

United States installs about 46.73% of Microsoft® Block Level Backup Engine Service EXE.

OEM distributionDistribution by PC manufacturer

PC Manufacturerdistribution
Dell 19.53%
Hewlett-Packard 17.97%
ASUS 17.97%
Acer 12.50%
Toshiba 10.16%
Lenovo 9.38%
Sony 4.69%
Intel 2.34%
GIGABYTE 1.95%
Samsung 1.56%
Alienware 1.17%
Medion 0.78%
Should I remove It? Clean your PC of unwanted adware, toolbars and bloatware.

Download it for FREE