Should I block it?

No, this file is 100% safe to run.

Additional versions

6.3.9600.16384 (winblue_rtm.130821-1623)	10.53%
6.2.9200.16384 (win8_rtm.120725-1247)	25.00%
6.2.9200.16384 (win8_rtm.120725-1247)	3.95%
6.2.8400.0 (winmain_win8rc.120518-1423)	1.32%
6.1.7600.16385 (win7_rtm.090713-1255)	9.21%
6.1.7600.16385 (win7_rtm.090713-1255)	23.68%
6.1.7600.16385 (win7_rtm.090713-1255)	6.58%
6.0.6000.16386 (vista_rtm.061101-2205)	13.16%
6.0.6000.16386 (vista_rtm.061101-2205)	3.95%
6.0.5308.17 (winmain_idx01.060217-2200)	2.63%

Relationships

Parent process

winlogon.exe (Windows Logon Application by Microsoft)

Related files

PE file structure

Show functions

Import table

advapi32.dll

RegCloseKey, RegQueryValueExW, RegOpenKeyExW, RegCreateKeyExW, RegQueryValueExA, RegOpenKeyExA

comctl32.dll

InitCommonControlsEx

d3d9.dll

Direct3DCreate9

gdi32.dll

SelectObject, CreateBitmap, CreateCompatibleDC, GetStockObject, GetDIBits, SetBkColor, SetTextColor, BitBlt, DeleteObject, DeleteDC, ExcludeClipRect, CreateFontW, GetDeviceCaps

kernel32.dll

GetTickCount, QueryPerformanceFrequency, GetCommandLineW, MulDiv, GetModuleHandleW, FindResourceW, SizeofResource, InterlockedExchange, InterlockedCompareExchange, GetStartupInfoA, SetUnhandledExceptionFilter, GetModuleHandleA, QueryPerformanceCounter, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, GetSystemInfo, GetVersionExA, IsProcessorFeaturePresent, GetProcAddress, OutputDebugStringA, MultiByteToWideChar, InitializeCriticalSection, DeleteCriticalSection, Sleep, LockResource, LoadResource

msvcrt.dll

DllMain

ole32.dll

CoInitializeEx, CoUninitialize

user32.dll

PostQuitMessage, DispatchMessageW, TranslateMessage, GetMessageW, PostMessageW, DefWindowProcW, KillTimer, SetTimer, EndPaint, BeginPaint, SetCursor, UnionRect, SetWindowPos, FillRect, SystemParametersInfoW, DrawTextW, ScreenToClient, InvalidateRect, UpdateWindow, SetRect, LoadCursorW, LoadIconW, RegisterClassW, AdjustWindowRect, CreateWindowExW, GetClientRect, EnumDisplaySettingsW, IntersectRect, OffsetRect, LoadStringW, GetDC, EnumDisplayMonitors, PeekMessageW, SystemParametersInfoA, GetSystemMetrics, GetWindowRect, GetWindowPlacement, IsIconic, SetRectEmpty, MessageBoxW

winmm.dll

timeGetTime

bubbles.scr

Bubbles Screen Saver by Microsoft

Remove bubbles.scr

Version:	6.2.9200.16384 (win8_rtm.120725-1247)
MD5:	117a1d3ad57239a3613dd8db5cfef848
SHA1:	003e2a6232df02ea4a54452dfef20da646a5d786
SHA256:	b082cf13641a0e2991ad036a787040215bb988dd8fb2c7a3e80966f064eefd63

This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is bubbles.scr?

Bubbles Screen Saver is a default Windows screen saver automatically installed with Windows.

Overview

bubbles.scr executes as a process with the local user's privileges typically within the context of its parent winlogon.exe (Windows Logon Application by Microsoft). The assembly utilizes the .NET run-time framework (which is required to be installed on the PC). This version is installed on Windows 8 and is compiled as a 64 bit program.

Details

File name:	bubbles.scr
Publisher:	Microsoft Corporation
Product name:	Bubbles Screen Saver
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\bubbles.scr
Original name:	Bubbles
File version:	6.2.9200.16384 (win8_rtm.120725-1247)
Product version:	6.2.9200.16384
Size:	877 KB (898,048 bytes)
Digital DNA
File packed:	No
Code language:	Microsoft Visual C# / Basic .NET
.NET CLR:	Yes
.NET NGENed:	No

More details

Behaviors

Screensaver

bubbles.scr

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00077768%	0.028634%
Kernel CPU:	0.00023300%	0.013761%
User CPU:	0.00054468%	0.014873%
Kernel CPU time:	973,758 ms/min	100,923,805ms/min
Memory
Private memory:	23.03 MB	21.59 MB
Private (maximum):	29.25 MB
Private (minimum):	19.13 MB
Non-paged memory:	23.03 MB	21.59 MB
Virtual memory:	108.46 MB	140.96 MB
Virtual memory (peak):	120.45 MB	169.69 MB
Working set:	25.67 MB	18.61 MB
Working set (peak):	37.27 MB	37.95 MB
Page faults:	2,114,873/min	2,039/min
Resource allocations
Threads:	2	12
Handles:	59	600
GUI GDI count:	16	103
GUI GDI peak:	18	142
GUI USER count:	5	49
GUI USER peak:	5	71

Process properties

Integrety level:	Undefined
Platform:	64-bit
Command line:	C:\Windows\System32\bubbles.scr /s
Owner:	User
Parent process:	winlogon.exe (Windows Logon Application by Microsoft)

Threads