Should I block it?

No, this file is 100% safe to run.

Relationships

pwecdrvr.dll (Passport Web Edition Client Service Driver by NCR)

PE file structure

Show functions

Import table

advapi32.dll

QueryServiceStatus, DeregisterEventSource, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, RegOpenKeyA, RegCreateKeyA, RegCloseKey, RegQueryValueExA, RegSetValueExA, RegisterEventSourceA, CloseServiceHandle, DeleteService, ControlService, RegDeleteValueA, OpenSCManagerA, OpenServiceA, ReportEventA

kernel32.dll

GetLastError, CreateThread, WaitForSingleObject, Sleep, OpenEventA, SetEvent, CloseHandle, SetCurrentDirectoryA, CreateDirectoryA, GetModuleFileNameA, CreateEventA, GetModuleHandleA, GetStartupInfoA

msvcrt.dll

DllMain

ole32.dll

CoCreateGuid

pwecdrvr.dll

pptcLogString, pptcStopHttpServer, pptcStartHttpServer

rpcrt4.dll

UuidToStringA, RpcStringFreeA

user32.dll

PostQuitMessage, DefWindowProcA, PostMessageA, DispatchMessageA, CreateWindowExA, ShowWindow, TranslateMessage, GetMessageA, RegisterClassA

pwecsrvc.exe

Passport Web Edition Client Service Driver by NCR

Remove pwecsrvc.exe

Version:	2, 1, 0, 3
MD5:	a244dc912fb9ac44aff70d022e9375cf
SHA1:	2ae1192fe43872fdf4ca4068330485d9f3c9d2d8
SHA256:	73cd13c7620988d41e9ca8db0d8988ce11de40d1875e7c1fcafc861fbcd1c102

Overview

pwecsrvc.exe executes as a process with the local user's privileges. It is set to be start when the PC boots and any user logs into Windows (added to the Run registry key for the all users under the local machine). This particular version is usually found on Windows 7 Home Premium (6.1.7601.65536).

Details

File name:	pwecsrvc.exe
Publisher:	NCR Corporation
Product name:	Passport Web Edition Client Service Driver
Typical file path:	C:\Program Files\ncr\passport web edition\pwecsrvc.exe
File version:	2, 1, 0, 3
Size:	20.1 KB (20,579 bytes)
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
Code language:	Microsoft Visual C++
.NET CLR:	No

More details

Behaviors

Startup files (all users) run

Runs under the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'

'Passport Web Edition Client' → C:\Program Files\NCR\Passport Web Edition\pwecsrvc.exe

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00030753%	0.028634%
Kernel CPU:	0.00023147%	0.013761%
User CPU:	0.00007606%	0.014873%
Kernel CPU time:	141 ms/min	100,923,805ms/min
Context switches:	3/sec	284/sec
Memory
Private memory:	27.55 MB	21.59 MB
Private (maximum):	4.95 MB
Private (minimum):	4.91 MB
Non-paged memory:	27.55 MB	21.59 MB
Virtual memory:	64.53 MB	140.96 MB
Virtual memory (peak):	65.53 MB	169.69 MB
Working set:	4.95 MB	18.61 MB
Working set (peak):	4.95 MB	37.95 MB
Page faults:	1,292/min	2,039/min
I/O
I/O read transfer:	19 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	2 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	168 Bytes/sec	448.09 KB/min
I/O other operations:	2/sec	1,671/min
Resource allocations
Threads:	6	12
Handles:	103	600
GUI GDI count:	11	103
GUI USER count:	11	49

Process properties

Integrety level:	Undefined
Platform:	32-bit
Command line:	"C:\Program Files\ncr\passport web edition\pwecsrvc.exe"
Owner:	User
Parent process:	Explorer.EXE (Windows Explorer by Microsoft)

Threads

Averages

pwecsrvc.exe (main module)
Total CPU:	0.00023237%	0.272967%
Kernel CPU:	0.00023237%	0.107585%
User CPU:	0.00000000%	0.165382%
Context switches:	1/sec	79/sec
Memory:	20 KB	1.16 MB
msvcrt.dll (Windows NT CRT DLL by Microsoft)
Total CPU:	0.00005165%
Kernel CPU:	0.00000000%
User CPU:	0.00005165%
Context switches:	1/sec
Memory:	352 KB

Common loaded modules

These are modules that are typiclaly loaded within the context of this process.

Distribution by Windows OS

OS version	distribution
Windows 7 Home Premium	100.00%

Distribution by PC manufacturer

PC Manufacturer	distribution
Dell	100.00%

Remove Adware and Spyware Programs, FREE Download!