Should I block it?
No, this file is 100% safe to run.
Additional versions
 PE file structure
|
Show functions |
Import table
csrsrv.dll
CsrUnhandledExceptionFilter, CsrServerInitialization
ntdll.dll
RtlSetHeapInformation, RtlSetProcessIsCritical, NtTerminateThread, NtSetInformationProcess, RtlSetUnhandledExceptionFilter, NtTerminateProcess, RtlFreeAnsiString, RtlAllocateHeap, isspace, RtlUnicodeStringToAnsiString, RtlNormalizeProcessParams, DbgBreakPoint, RtlUnhandledExceptionFilter, RtlUnwind, _aullshr
csrss.exe
Client Server Runtime Process by Microsoft
| Version: | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) |
| MD5: | 5906a8a851f83e8e7554a94a4c180662 |
| SHA1: | 498416c9a4dba6d236582128381a44345c06d23c |
| SHA256: | b02fc7476b9e8571cc50bd28cde5224920187d8597e471dcd509716a69b3766c |
This is a Windows system installed file with Windows File Protection (WFP) enabled.
What is csrss.exe?
Client/Server Runtime Subsystem, or csrss.exe, is a component of the Microsoft Windows NT operating system that provides the user mode side of the Win32 subsystem and is included in Windows 2000, XP, 2003, Vista, Server 2008 and 7. Because most of the Win32 subsystem operations have been moved to kernel mode drivers, in Windows NT 4 and later CSRSS is mainly responsible for Win32 console handling and GUI shutdown.
About csrss.exe (from Microsoft)
“CSRSS runs as a user-mode system service. When a user-mode process calls a function involving console windows, process/thread creation, or Side-by-Side support, instead of issuing a system call, the W”
Details
| File name: | csrss.exe |
| Publisher: | Microsoft Corporation |
| Product name: | Client Server Runtime Process |
| Description: | Microsoft® Windows® Operating System |
| Typical file path: | C:\Windows\System32\csrss.exe |
| Original name: | CSRSS.Exe.MUI |
| File version: | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) |
| Product version: | 5.1.2600.2180 |
| Size: | 6 KB (6,144 bytes) |
| Build date: | 8/4/2004 2:03 PM |
| Digital DNA |
| Entropy: | 4.291245 |
| File packed: | No |
| .NET CLR: | No |
More details
Behaviors
Scheduled task
- Entry path '\{1B908455-E233-4AF6-9EA8-FB47FE9E21E2}'
Resource utilization
(Note: statistics below are averages based on a minimum sample size of 200 unique participants)
Averages
| CPU |
| Total CPU: | 0.01116122% | |
| Kernel CPU: | 0.00528187% | |
| User CPU: | 0.00587934% | |
| Kernel CPU time: | 49,872 ms/min | |
| Context switches: | 187/sec | |
| Memory |
| Private memory: | 2.14 MB | |
| Private (maximum): | 4.51 MB | |
| Private (minimum): | 200 KB | |
| Non-paged memory: | 2.14 MB | |
| Virtual memory: | 64.74 MB | |
| Virtual memory (peak): | 107.2 MB | |
| Working set: | 2.33 MB | |
| Working set (peak): | 4.63 MB | |
| Resource allocations |
| Threads: | 14 | |
| Handles: | 416 | |
| GUI GDI count: | 67 | |
| GUI USER count: | 60 | |
Process properties
| Integrety level: | Undefined |
| Platform: | 32-bit |
| Command line: | C:\Windows\System32\csrss.exe objectdirectory=\windows sharedsection=1024,3072,512 windows=on subsystemtype=windows serverdll=basesrv,1 serverdll=winsrC:userserverdllinitialization,3 serverdll=winsrC:conserverdllinitialization,2 profilecontrol=off maxrequestthreads=16 |
| Owner: | SYSTEM |
| Parent process: | smss.exe (Windows NT Session Manager by Microsoft) |
Distribution by Windows OS
| OS version | distribution |
| Windows 7 Home Premium |
58.00% |
|
| Windows 7 Ultimate |
23.00% |
|
| Windows 7 Professional |
12.00% |
|
| Windows 7 Home Basic |
5.00% |
|
| Windows Seven Black Edition |
1.00% |
|
| Windows Vista Home Premium |
1.00% |
|
Distribution by country
United States installs about 49.49% of Client Server Runtime Process.
Distribution by PC manufacturer
| PC Manufacturer | distribution |
| Dell |
26.56% |
|
| Hewlett-Packard |
19.14% |
|
| Acer |
15.23% |
|
| ASUS |
14.06% |
|
| Toshiba |
12.50% |
|
| Sony |
6.25% |
|
| Alienware |
1.56% |
|
| Samsung |
1.56% |
|
| GIGABYTE |
1.56% |
|
| Lenovo |
1.56% |
|
