Should I block it?

No, this file is 100% safe to run.

Additional versions

6.3.9600.16384 (winblue_rtm.130821-1623)	2.26%
6.3.9600.16384 (winblue_rtm.130821-1623)	0.10%
6.3.9600.16384 (winblue_rtm.130821-1623)	1.85%
6.3.9600.16384 (winblue_rtm.130821-1623)	0.04%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.10%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.10%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.02%
6.2.9200.16518 (win8_gdr.130201-1704)	0.18%
6.2.9200.16398 (win8_gdr_oobssr.120820-1900)	0.14%
6.2.9200.16398 (win8_gdr_oobssr.120820-1900)	0.70%
6.2.9200.16398 (win8_gdr_oobssr.120820-1900)	0.80%
6.2.9200.16398 (win8_gdr_oobssr.120820-1900)	0.14%
6.2.9200.16384 (win8_rtm.120725-1247)	0.72%
6.2.9200.16384 (win8_rtm.120725-1247)	7.08%
6.2.9200.16384 (win8_rtm.120725-1247)	1.05%
6.2.9200.16384 (win8_rtm.120725-1247)	6.03%
6.2.8400.0 (winmain_win8rc.120518-1423)	0.02%
6.2.8400.0 (winmain_win8rc.120518-1423)	0.02%
6.2.8400.0 (winmain_win8rc.120518-1423)	0.04%
6.2.8400.0 (winmain_win8rc.120518-1423)	0.04%
6.2.8250.0 (winmain_win8beta.120217-1520)	0.02%
6.2.8250.0 (winmain_win8beta.120217-1520)	0.02%
6.2.8102.0 (winmain_win8m3.110823-1455)	0.04%
6.2.8102.0 (winmain_win8m3.110823-1455)	0.04%
6.1.7601.17514 (win7sp1_rtm.101119-1850)	17.52%
View more
6.1.7601.17514 (win7sp1_rtm.101119-1850)	8.47%
6.1.7600.16385 (win7_rtm.090713-1255)	2.44%
6.1.7600.16385 (win7_rtm.090713-1255)	1.70%
6.1.7600.16385 (win7_rtm.090713-1255)	0.02%
6.1.7600.16385 (win7_rtm.090713-1255)	10.61%
6.1.7600.16385 (win7_rtm.090713-1255)	18.28%
6.1.7600.16385 (win7_rtm.090713-1255)	0.02%
6.1.7600.16385 (win7_rtm.090713-1255)	0.02%
6.0.6002.18005 (lh_sp2rtm.090410-1830)	2.56%
6.0.6002.18005 (lh_sp2rtm.090410-1830)	0.68%
6.0.6001.18226 (vistasp1_gdr.090302-1506)	0.02%
6.0.6001.18226 (vistasp1_gdr.090302-1506)	0.18%
6.0.6000.16830 (vista_gdr.090302-1506)	0.10%
6.0.6000.16386 (vista_rtm.061101-2205)	0.02%
6.0.6000.16386 (vista_rtm.061101-2205)	2.89%
6.0.6000.16386 (vista_rtm.061101-2205)	0.02%
6.0.6000.16386 (vista_rtm.061101-2205)	0.18%
6.0.6000.16386 (vista_rtm.061101-2205)	0.64%
6.0.6000.16386 (vista_rtm.061101-2205)	0.18%
5.2.3790.4455 (srv03_sp2_gdr.090203-1205)	0.02%
5.2.3790.4455 (srv03_sp2_gdr.090203-1205)	0.02%
5.2.3790.3959 (srv03_sp2_rtm.070216-1710)	0.02%
5.2.3790.3959 (srv03_sp2_rtm.070216-1710)	0.02%
5.2.3790.3959 (srv03_sp2_rtm.070216-1710)	0.04%
5.1.2600.5755 (xpsp_sp3_qfe.090206-1316)	0.43%
5.1.2600.5755 (xpsp_sp3_gdr.090206-1234)	2.85%
29 other versions

Relationships

PE file structure

Show functions

Import table

advapi32.dll

ReportEventW, SetSecurityDescriptorDacl, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, SetEntriesInAclW, FreeSid, AllocateAndInitializeSid, InitializeSecurityDescriptor, RegDisablePredefinedCache, RegSetValueExW, MakeSelfRelativeSD, GetSecurityDescriptorLength, AddAce, InitializeAcl, GetLengthSid, CopySid, RegCloseKey, RegCreateKeyExW, RegDeleteKeyExW, RegOpenKeyExW, RevertToSelf, SetThreadToken, RegisterEventSourceW, DeregisterEventSource, ImpersonateLoggedOnUser, OpenProcessToken, GetAclInformation, OpenThreadToken, ConvertStringSecurityDescriptorToSecurityDescriptorW, MakeAbsoluteSD, MapGenericMask, AccessCheck, RegQueryValueExW, GetTokenInformation, TraceMessage, RegDeleteKeyW, GetTraceEnableFlags, GetTraceEnableLevel, GetTraceLoggerHandle, RegisterTraceGuidsW, UnregisterTraceGuids, EventUnregister, EventRegister, EventWrite

api-ms-win-core-apiquery-l1-1-0.dll

ApiSetQueryApiSetPresence

api-ms-win-core-com-l1-1-0.dll

CoGetClassObject, CoCreateGuid, CoRevertToSelf, CoImpersonateClient, CoSwitchCallContext, CoGetCallContext, StringFromGUID2, CLSIDFromString, CoMarshalInterThreadInterfaceInStream, CoGetInterfaceAndReleaseStream, CoRegisterClassObject, CoCreateInstance, CoFreeUnusedLibrariesEx, CoInitializeSecurity, CoRevokeClassObject, CoUninitialize, CoInitializeEx

api-ms-win-core-delayload-l1-1-1.dll

DelayLoadFailureHook, ResolveDelayLoadedAPI

api-ms-win-core-errorhandling-l1-1-0.dll

SetUnhandledExceptionFilter, GetLastError, UnhandledExceptionFilter

api-ms-win-core-errorhandling-l1-1-1.dll

SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetLastError

api-ms-win-core-handle-l1-1-0.dll

CloseHandle, DuplicateHandle

api-ms-win-core-heap-l1-1-0.dll

HeapSetInformation, GetProcessHeap, HeapCreate, HeapDestroy, HeapAlloc, HeapFree

api-ms-win-core-heap-l1-2-0.dll

HeapFree, HeapDestroy, HeapCreate, GetProcessHeap, HeapSetInformation, HeapAlloc

api-ms-win-core-heap-obsolete-l1-1-0.dll

LocalAlloc, LocalFree

api-ms-win-core-interlocked-l1-1-0.dll

InterlockedExchange, InterlockedIncrement, InterlockedDecrement, InterlockedCompareExchange

api-ms-win-core-interlocked-l1-1-1.dll

InterlockedCompareExchange, InterlockedExchange, InterlockedDecrement, InterlockedIncrement

api-ms-win-core-interlocked-l1-2-0.dll

InterlockedIncrement, InterlockedDecrement, InterlockedExchange, InterlockedCompareExchange

api-ms-win-core-kernel32-legacy-l1-1-0.dll

GetStartupInfoA

api-ms-win-core-kernel32-legacy-l1-1-1.dll

GetStartupInfoA

api-ms-win-core-libraryloader-l1-1-1.dll

GetModuleFileNameW, GetModuleHandleExW, FreeLibrary, GetModuleHandleA, GetProcAddress

api-ms-win-core-libraryloader-l1-2-0.dll

GetModuleHandleA, FreeLibrary, GetModuleHandleExW, GetModuleFileNameW, GetProcAddress

api-ms-win-core-localization-l1-1-1.dll

LCMapStringW

api-ms-win-core-localization-l1-2-0.dll

LCMapStringW

api-ms-win-core-localization-l1-2-1.dll

LCMapStringW

api-ms-win-core-memory-l1-1-1.dll

UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, MapViewOfFile

api-ms-win-core-memory-l1-1-2.dll

OpenFileMappingW, CreateFileMappingW, MapViewOfFile, UnmapViewOfFile

api-ms-win-core-processenvironment-l1-1-0.dll

GetCommandLineW

api-ms-win-core-processenvironment-l1-1-1.dll

GetCommandLineW

api-ms-win-core-processenvironment-l1-2-0.dll

GetCommandLineW

api-ms-win-core-processthreads-l1-1-1.dll

TlsAlloc, TerminateProcess, GetCurrentProcessId, TlsFree, GetCurrentThreadId, CreateThread, GetCurrentProcess, SetThreadToken, GetCurrentThread, OpenThreadToken, SwitchToThread, OpenProcessToken, IsProcessorFeaturePresent

api-ms-win-core-processthreads-l1-1-2.dll

TlsAlloc, GetCurrentProcess, GetCurrentThreadId, GetCurrentThread, OpenThreadToken, GetCurrentProcessId, OpenProcessToken, SwitchToThread, CreateThread, TerminateProcess, TlsFree, SetThreadToken

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter

api-ms-win-core-registry-l1-1-0.dll

RegSetValueExW, RegDeleteKeyExW, RegCreateKeyExW, RegQueryValueExW, RegCloseKey, RegOpenKeyExW

api-ms-win-core-string-l1-1-0.dll

GetStringTypeExW, CompareStringW

api-ms-win-core-synch-l1-1-1.dll

WaitForSingleObject, CreateEventW, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, LeaveCriticalSection, SetEvent, Sleep, WaitForMultipleObjectsEx, EnterCriticalSection

api-ms-win-core-synch-l1-2-0.dll

WaitForMultipleObjectsEx, InitializeCriticalSectionAndSpinCount, LeaveCriticalSection, Sleep, WaitForSingleObject, CreateEventW, SetEvent, EnterCriticalSection, DeleteCriticalSection

api-ms-win-core-sysinfo-l1-1-1.dll

GetSystemTimeAsFileTime, GetTickCount

api-ms-win-core-sysinfo-l1-2-0.dll

GetTickCount, GetSystemTimeAsFileTime

api-ms-win-core-sysinfo-l1-2-1.dll

GetTickCount, GetSystemTimeAsFileTime

api-ms-win-core-threadpool-l1-1-1.dll

ChangeTimerQueueTimer

api-ms-win-core-threadpool-legacy-l1-1-0.dll

ChangeTimerQueueTimer

api-ms-win-eventing-provider-l1-1-0.dll

EventUnregister, EventRegister, EventWrite

api-ms-win-legacy-kernel32-l1-1-0.dll

GetStartupInfoA

api-ms-win-obsolete-kernelbase-l1-1-0.dll

LocalFree, LocalAlloc

api-ms-win-security-base-l1-1-0.dll

SetSecurityDescriptorGroup, SetSecurityDescriptorDacl, GetTokenInformation, SetSecurityDescriptorOwner, FreeSid, GetAclInformation, InitializeSecurityDescriptor, MapGenericMask, AccessCheck, MakeAbsoluteSD, RevertToSelf, MakeSelfRelativeSD, GetSecurityDescriptorLength, GetLengthSid, CopySid, AddAce, InitializeAcl, ImpersonateLoggedOnUser, AllocateAndInitializeSid

api-ms-win-security-base-l1-2-0.dll

InitializeSecurityDescriptor, RevertToSelf, MakeAbsoluteSD, ImpersonateLoggedOnUser, GetAclInformation, AllocateAndInitializeSid, AccessCheck, FreeSid, MakeSelfRelativeSD, GetSecurityDescriptorLength, AddAce, InitializeAcl, GetTokenInformation, MapGenericMask, GetLengthSid, CopySid, SetSecurityDescriptorOwner, SetSecurityDescriptorGroup, SetSecurityDescriptorDacl

kernel32.dll

WaitForMultipleObjects, Sleep, GetCurrentThreadId, TerminateProcess, GetCurrentProcess, GetProcAddress, FreeLibrary, GetModuleHandleExW, WaitForSingleObject, DuplicateHandle, HeapSetInformation, CreateThread, lstrlenW, GetModuleFileNameW, InterlockedDecrement, GetVersionExW, MapViewOfFile, CreateFileMappingW, OpenFileMappingW, EnterCriticalSection, LeaveCriticalSection, TlsAlloc, TlsFree, ChangeTimerQueueTimer, InterlockedExchange, InitializeCriticalSectionAndSpinCount, SwitchToThread, CreateEventW, LCMapStringW, GetTickCount, GetCurrentThread, GetStringTypeExW, HeapFree, HeapAlloc, HeapDestroy, HeapCreate, GetProcessHeap, UnhandledExceptionFilter, GetSystemTimeAsFileTime, QueryPerformanceCounter, GetModuleHandleA, SetUnhandledExceptionFilter, GetStartupInfoA, SetEvent, InterlockedIncrement, CloseHandle, GetCurrentProcessId, GetLastError, GetCommandLineW, CompareStringW, LocalFree, InterlockedCompareExchange, DeleteCriticalSection, UnmapViewOfFile, WaitForMultipleObjectsEx

msvcrt.dll

DllMain

ncobjapi.dll

WmiCreateObjectWithFormat, WmiEventSourceConnect, WmiEventSourceDisconnect, WmiDestroyObject, WmiSetAndCommitObject

ntdll.dll

NtQuerySystemInformation, EtwGetTraceEnableFlags, EtwGetTraceEnableLevel, EtwGetTraceLoggerHandle, EtwRegisterTraceGuidsW, EtwUnregisterTraceGuids, EtwTraceMessage, RtlLengthSid, RtlCreateAcl, RtlNtStatusToDosError, RtlAddAccessAllowedAce

ole32.dll

CoImpersonateClient, CLSIDFromString, CoGetClassObject, CoCreateGuid, CoMarshalInterThreadInterfaceInStream, CoGetInterfaceAndReleaseStream, CoUninitialize, CoFreeUnusedLibrariesEx, CoRegisterClassObject, CoCreateInstance, CoInitializeSecurity, CoRevertToSelf, CoInitializeEx, StringFromGUID2, CoGetCallContext, CoSwitchCallContext, CoRevokeClassObject

user32.dll

LoadCursorW, DefWindowProcW, DeleteMenu, GetSystemMenu, UpdateWindow, ShowWindow, CreateWindowExW, RegisterClassW, LoadIconW, UnregisterClassW, DestroyWindow, DispatchMessageW, TranslateMessage, GetMessageW, PeekMessageW, MsgWaitForMultipleObjects, MsgWaitForMultipleObjectsEx, PostMessageW

Wmiprvse.exe

WMI Provider Host by Microsoft

Remove Wmiprvse.exe

Version:	6.0.6000.16386 (vista_rtm.061101-2205)
MD5:	cd8a7f4847dd181903e6b2f1924e723e
SHA1:	7c0182eb81364930db86c8858abf0f5dd7f8e674
SHA256:	08add27e0154dc7c3340b5122bab5f149902d269f6e528c993b0b4199d8477fd

This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is Wmiprvse.exe?

WMI provides a uniform interface for any local or remote applications or scripts that obtain management data from a computer system, a network, or an enterprise. The uniform interface is designed such that WMI client applications and scripts do not have to call a wide variety of operating system application programming interfaces (APIs). Many APIs cannot be called by automation clients like scripts or Visual Basic applications. Other APIs do not make calls to remote computers.

About Wmiprvse.exe (from Microsoft)

“Windows Management Instrumentation (WMI) is the infrastructure for management data and operations on Windows-based operating systems. You can write WMI scripts or applications to automate administrati”

Details

File name:	wmiprvse.exe
Publisher:	Microsoft Corporation
Product name:	WMI Provider Host
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\wbem\wmiprvse.exe
File version:	6.0.6000.16386 (vista_rtm.061101-2205)
Product version:	6.0.6000.16386
Size:	239.5 KB (245,248 bytes)
Digital DNA
Entropy:	6.464498
File packed:	No
Code language:	Microsoft Visual C++
.NET CLR:	No

More details

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	1.51183353%	0.028634%
Kernel CPU:	1.46772547%	0.013761%
User CPU:	0.04410806%	0.014873%
Kernel CPU time:	321,362 ms/min	100,923,805ms/min
Memory
Private memory:	4.94 MB	21.59 MB
Private (maximum):	8.99 MB
Private (minimum):	8.99 MB
Non-paged memory:	4.94 MB	21.59 MB
Virtual memory:	51.17 MB	140.96 MB
Virtual memory (peak):	59.33 MB	169.69 MB
Working set:	9.09 MB	18.61 MB
Working set (peak):	9.41 MB	37.95 MB
Resource allocations
Threads:	8	12
Handles:	176	600

Process properties

Platform:	32-bit
Command line:	C:\Windows\System32\wbem\wmiprvse.exe
Owner:	SYSTEM

Distribution by Windows OS

OS version	distribution
Windows 7 Home Premium	32.00%
Windows 8.1	21.50%
Windows 7 Ultimate	9.00%
Windows 8.1 Pro	6.50%
Windows 8	5.00%
Windows 8 Single Language	5.00%
Windows 8.1 Single Language	4.50%
Windows 7 Professional	4.00%
Windows 8 Pro	3.50%
Windows 8.1 Pro with Media Center	2.50%
Windows 7 Home Basic	2.50%
Windows Vista Home Premium	1.50%
Windows 8 Enterprise	1.00%
Windows 8.1 N	0.50%
Windows Seven Black Edition	0.50%
Windows 8.1 Enterprise Evaluation	0.50%

Distribution by country

United States installs about 44.72% of WMI Provider Host.

Distribution by PC manufacturer

PC Manufacturer	distribution
Dell	23.75%
Hewlett-Packard	18.01%
ASUS	16.86%
Acer	12.64%
Toshiba	8.43%
Lenovo	8.43%
Sony	5.36%
GIGABYTE	2.30%
Alienware	1.92%
Samsung	1.53%
Intel	0.77%

Remove Adware and Spyware Programs, FREE Download!

Should I block it?

Additional versions

Relationships

PE file structure

Wmiprvse.exe

WMI Provider Host by Microsoft

What is Wmiprvse.exe?

About Wmiprvse.exe (from Microsoft)

Details

Resource utilization

Process properties

Distribution by Windows OS

Distribution by country

Distribution by PC manufacturer

"Should I Block It?" client app is coming soon

Download it for FREE


Custom Search