This is a Windows system installed file with Windows File Protection (WFP) enabled.
wmiprvse.exe has 80 known versions, the most recent one is 6.3.9600.16384 (winblue_rtm.130821-1623). wmiprvse.exe is run as a standard windows process with NETWORK SERVICE privileges. The average file size is about 214.63 KB. During the process's lifecycle, the typical CPU resource utilization is less than 0.01%, the average private memory consumption is about 12.14 MB with the maximum memory reaching around 14.39 MB. Addionally, typically read and write I/O disk operations is about 3.72 KB per minute for reads and 122 Bytes per minute for writes.
WMI provides a uniform interface for any local or remote applications or scripts that obtain management data from a computer system, a network, or an enterprise. The uniform interface is designed such that WMI client applications and scripts do not have to call a wide variety of operating system application programming interfaces (APIs). Many APIs cannot be called by automation clients like scripts or Visual Basic applications. Other APIs do not make calls to remote computers.
Based on 40+ industry antivirus scanners, 3 of them detected the following malware.
United States installs about 44.86% of WMI Provider Host.
