Should I block it?

No, this file is 100% safe to run.

VersionsAdditional versions

6.3.9600.16384 (winblue_rtm.130821-1623) 6.65%
6.3.9431.0 (winmain_bluemp.130615-1214) 0.18%
6.2.9200.16398 (win8_gdr_oobssr.120820-1900) 1.26%
6.2.9200.16384 (win8_rtm.120725-1247) 18.71%
6.2.9200.16384 (win8_rtm.120725-1247) 0.72%
6.1.7600.16385 (win7_rtm.090713-1255) 42.45%
6.1.7600.16385 (win7_rtm.090713-1255) 12.59%
6.0.6002.18005 (lh_sp2rtm.090410-1830) 8.63%
6.0.6001.18000 (longhorn_rtm.080118-1840) 2.16%
6.0.6001.18000 (longhorn_rtm.080118-1840) 0.54%
6.0.6000.16386 (vista_rtm.061101-2205) 0.54%
5.1.2600.0 (xpclient.010817-1148) 4.86%
5.1.2600.0 (xpclient.010817-1148) 0.36%
5.1.2600.0 (xpclient.010817-1148) 0.18%
5.1.2600.0 (xpclient.010817-1148) 0.18%

Relationships

Parent process
Related files

PE structurePE file structure
Show functions
Import table
advapi32.dll
EqualSid, GetLengthSid, IsValidSid, CreateServiceW, StartServiceCtrlDispatcherW, RegisterServiceCtrlHandlerW, SetServiceStatus, UnregisterTraceGuids, RegisterTraceGuidsW, GetTraceLoggerHandle, GetTraceEnableLevel, GetTraceEnableFlags, TraceMessage, DeleteService, OpenServiceW, RegSetValueExW, RegCloseKey, RegCreateKeyW, RegDeleteKeyW, RegOpenKeyW, OpenSCManagerW
api-ms-win-core-apiquery-l1-1-0.dll
ApiSetQueryApiSetPresence
api-ms-win-core-com-l1-1-0.dll
CoImpersonateClient, StringFromGUID2, CoInitializeSecurity, CoRevokeClassObject, CoRegisterClassObject, CoRevertToSelf, CoInitializeEx
api-ms-win-core-debug-l1-1-1.dll
DebugBreak
api-ms-win-core-delayload-l1-1-1.dll
ResolveDelayLoadedAPI, DelayLoadFailureHook
api-ms-win-core-errorhandling-l1-1-1.dll
SetUnhandledExceptionFilter, GetLastError, UnhandledExceptionFilter
api-ms-win-core-interlocked-l1-2-0.dll
InterlockedDecrement, InterlockedIncrement, InterlockedCompareExchange, InterlockedExchange
api-ms-win-core-libraryloader-l1-1-1.dll
GetProcAddress, GetModuleFileNameW, LoadLibraryExW, GetModuleHandleA
api-ms-win-core-localization-l1-2-0.dll
LCMapStringW
api-ms-win-core-processenvironment-l1-2-0.dll
GetCommandLineW
api-ms-win-core-processthreads-l1-1-1.dll
GetCurrentProcessId, ExitProcess, GetCurrentThreadId, TerminateProcess, GetCurrentProcess
api-ms-win-core-profile-l1-1-0.dll
QueryPerformanceCounter
api-ms-win-core-synch-l1-2-0.dll
DeleteCriticalSection, EnterCriticalSection, SetEvent, LeaveCriticalSection, CreateEventW, Sleep, InitializeCriticalSectionAndSpinCount
api-ms-win-core-sysinfo-l1-2-0.dll
GetSystemTimeAsFileTime, GetTickCount
api-ms-win-security-base-l1-1-0.dll
EqualSid, GetLengthSid, IsValidSid
api-ms-win-security-base-l1-2-0.dll
GetLengthSid, EqualSid, IsValidSid
api-ms-win-service-core-l1-1-0.dll
SetServiceStatus, StartServiceCtrlDispatcherW
api-ms-win-service-core-l1-1-1.dll
SetServiceStatus, StartServiceCtrlDispatcherW
api-ms-win-service-management-l1-1-0.dll
OpenSCManagerW, CreateServiceW, OpenServiceW, DeleteService
api-ms-win-service-winsvc-l1-1-0.dll
RegisterServiceCtrlHandlerW
api-ms-win-service-winsvc-l1-2-0.dll
RegisterServiceCtrlHandlerW
kernel32.dll
InterlockedIncrement, Sleep, InterlockedCompareExchange, SetUnhandledExceptionFilter, GetModuleHandleA, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, LeaveCriticalSection, GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, DebugBreak, LCMapStringW, EnterCriticalSection, ExitProcess, SetEvent, LoadLibraryExW, GetLastError, CreateEventW, GetModuleFileNameW, lstrlenW, GetCommandLineW, DeleteCriticalSection, InterlockedDecrement, GetCurrentProcessId, GetProcAddress, InterlockedExchange
msvcrt.dll
DllMain
ntdll.dll
EtwUnregisterTraceGuids, EtwRegisterTraceGuidsW, EtwGetTraceLoggerHandle, EtwGetTraceEnableFlags, EtwTraceMessage, EtwGetTraceEnableLevel
ole32.dll
CoImpersonateClient, CoRegisterClassObject, CoRevokeClassObject, StringFromGUID2, CoRevertToSelf, CoInitialize, CoInitializeSecurity
user32.dll
DispatchMessageW, TranslateMessage, GetMessageW, PostQuitMessage, SetTimer, PostThreadMessageW

unsecapp.exe

Sink to receive asynchronous callbacks for WMI client application by Microsoft

Remove unsecapp.exe
Version:   6.1.7600.16385 (win7_rtm.090713-1255)
MD5:   521202aa6f2b74fccc6bc7e162109d71
SHA1:   6fee2b562f597c7801c21d863607d9bcbb2a8b09
SHA256:   3b2f41efda68c82d9d50af329ac9b403c806cbe74f87917cdb350e542adda017
This is a Windows system installed file with Windows File Protection (WFP) enabled.

Overview

unsecapp.exe executes as a process with the local user's privileges typically within the context of its parent svchost.exe (Host Process for Windows Services by Microsoft Corporation). This version is designed to run on Windows 7 and is compiled as a 64 bit program.

DetailsDetails

File name:unsecapp.exe
Publisher:Microsoft Corporation
Product name:Sink to receive asynchronous callbacks for WMI client application
Description:Microsoft® Windows® Operating System
Typical file path:C:\Windows\System32\wbem\unsecapp.exe
Original name:unsecapp.dll
File version:6.1.7600.16385 (win7_rtm.090713-1255)
Product version:6.1.7600.16385
Size:46 KB (47,104 bytes)
Digital DNA
PE subsystem:Windows GUI
Entropy:6.314833
File packed:No
Code language:Microsoft Visual C++
.NET CLR:No
More details

ResourcesResource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)
Averages
 
CPU
Total CPU:0.00023451%
0.028634%
Kernel CPU:0.00012805%
0.013761%
User CPU:0.00010646%
0.014873%
Kernel CPU time:160,075 ms/min
100,923,805ms/min
CPU cycles:27,120/sec
17,470,203/sec
Context switches:3/sec
284/sec
Memory
Private memory:2.34 MB
21.59 MB
Private (maximum):5.87 MB
Private (minimum):3.65 MB
Non-paged memory:2.34 MB
21.59 MB
Virtual memory:47.05 MB
140.96 MB
Virtual memory (peak):49.93 MB
169.69 MB
Working set:4.21 MB
18.61 MB
Working set (peak):6.36 MB
37.95 MB
Page faults:8,606/min
2,039/min
I/O
I/O read transfer:172 Bytes/sec
1.02 MB/min
I/O read operations:1/sec
343/min
I/O other transfer:16 Bytes/sec
448.09 KB/min
I/O other operations:3/sec
1,671/min
Resource allocations
Threads:4
12
Handles:77
600
GUI GDI count:9
103
GUI GDI peak:9
142
GUI USER count:3
49
GUI USER peak:5
71

BehaviorsProcess properties

Integrety level:Medium
Platform:64-bit
Command line:C:\Windows\System32\wbem\unsecapp.exe -embedding
Owner:User
Parent process:svchost.exe (Host Process for Windows Services by Microsoft Corporation)

ResourcesThreads

Averages
 
ntdll.dll
Total CPU:0.01964757%
0.272967%
Kernel CPU:0.00000000%
0.107585%
User CPU:0.01964757%
0.165382%
CPU cycles:105,830/sec
5,741,424/sec
Memory:1.66 MB
1.16 MB
unsecapp.exe (main module)
Total CPU:0.00082895%
Kernel CPU:0.00034274%
User CPU:0.00048621%
CPU cycles:18,465/sec
Memory:60 KB

Common loaded modules

These are modules that are typiclaly loaded within the context of this process.

Windows OS versionsDistribution by Windows OS

OS versiondistribution
Windows 7 Home Premium 31.00%
Windows 8 13.00%
Windows 7 Ultimate 11.00%
Windows 8.1 10.00%
Windows 7 Professional 7.50%
Windows 8.1 Single Language 5.50%
Windows 8 Single Language 4.50%
Windows Vista Home Premium 4.00%
Windows 7 Home Basic 3.50%
Windows 8.1 Pro 2.50%
Windows 8 Pro 2.00%
Windows Vista Ultimate 1.00%
Windows Vista Home Basic 1.00%
Windows 8 Pro with Media Center 1.00%
Windows 8.1 Pro with Media Center 0.50%
Windows 7 Starter 0.50%
Windows Vista Business 0.50%
Windows 7 Enterprise 0.50%
Windows 8.1 Pro Preview with Media Center 0.50%

Distribution by countryDistribution by country

United States installs about 41.71% of Sink to receive asynchronous callbacks for WMI client application.

OEM distributionDistribution by PC manufacturer

PC Manufacturerdistribution
Acer 25.56%
Dell 15.56%
Hewlett-Packard 13.70%
Toshiba 11.85%
Lenovo 9.63%
ASUS 9.63%
Sony 4.44%
MSI 1.48%
NEC 1.48%
Alienware 1.11%
GIGABYTE 1.11%
Samsung 1.11%
Intel 0.74%
Medion 0.74%
Apple 0.74%
Gateway 0.74%
Sahara 0.37%
Back to top
Should I remove It? Clean your PC of unwanted adware, toolbars and bloatware.

Download it for FREE