Should I block it?

No, this file is 100% safe to run.

Additional versions

6.3.9600.16384 (winblue_rtm.130821-1623)	6.65%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.18%
6.2.9200.16398 (win8_gdr_oobssr.120820-1900)	1.26%
6.2.9200.16384 (win8_rtm.120725-1247)	18.71%
6.2.9200.16384 (win8_rtm.120725-1247)	0.72%
6.1.7600.16385 (win7_rtm.090713-1255)	42.45%
6.1.7600.16385 (win7_rtm.090713-1255)	12.59%
6.0.6002.18005 (lh_sp2rtm.090410-1830)	8.63%
6.0.6001.18000 (longhorn_rtm.080118-1840)	2.16%
6.0.6001.18000 (longhorn_rtm.080118-1840)	0.54%
6.0.6000.16386 (vista_rtm.061101-2205)	0.54%
5.1.2600.0 (xpclient.010817-1148)	4.86%
5.1.2600.0 (xpclient.010817-1148)	0.36%
5.1.2600.0 (xpclient.010817-1148)	0.18%
5.1.2600.0 (xpclient.010817-1148)	0.18%

Relationships

Parent process

svchost.exe (Host Process for Windows Services by Microsoft Corporation)

Related files

PE file structure

Show functions

Import table

advapi32.dll

EqualSid, GetLengthSid, IsValidSid, CreateServiceW, StartServiceCtrlDispatcherW, RegisterServiceCtrlHandlerW, SetServiceStatus, UnregisterTraceGuids, RegisterTraceGuidsW, GetTraceLoggerHandle, GetTraceEnableLevel, GetTraceEnableFlags, TraceMessage, DeleteService, OpenServiceW, RegSetValueExW, RegCloseKey, RegCreateKeyW, RegDeleteKeyW, RegOpenKeyW, OpenSCManagerW

api-ms-win-core-apiquery-l1-1-0.dll

ApiSetQueryApiSetPresence

api-ms-win-core-com-l1-1-0.dll

CoImpersonateClient, StringFromGUID2, CoInitializeSecurity, CoRevokeClassObject, CoRegisterClassObject, CoRevertToSelf, CoInitializeEx

api-ms-win-core-debug-l1-1-1.dll

DebugBreak

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI, DelayLoadFailureHook

api-ms-win-core-errorhandling-l1-1-1.dll

SetUnhandledExceptionFilter, GetLastError, UnhandledExceptionFilter

api-ms-win-core-interlocked-l1-2-0.dll

InterlockedDecrement, InterlockedIncrement, InterlockedCompareExchange, InterlockedExchange

api-ms-win-core-libraryloader-l1-1-1.dll

GetProcAddress, GetModuleFileNameW, LoadLibraryExW, GetModuleHandleA

api-ms-win-core-localization-l1-2-0.dll

LCMapStringW

api-ms-win-core-processenvironment-l1-2-0.dll

GetCommandLineW

api-ms-win-core-processthreads-l1-1-1.dll

GetCurrentProcessId, ExitProcess, GetCurrentThreadId, TerminateProcess, GetCurrentProcess

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter

api-ms-win-core-synch-l1-2-0.dll

DeleteCriticalSection, EnterCriticalSection, SetEvent, LeaveCriticalSection, CreateEventW, Sleep, InitializeCriticalSectionAndSpinCount

api-ms-win-core-sysinfo-l1-2-0.dll

GetSystemTimeAsFileTime, GetTickCount

api-ms-win-security-base-l1-1-0.dll

EqualSid, GetLengthSid, IsValidSid

api-ms-win-security-base-l1-2-0.dll

GetLengthSid, EqualSid, IsValidSid

api-ms-win-service-core-l1-1-0.dll

SetServiceStatus, StartServiceCtrlDispatcherW

api-ms-win-service-core-l1-1-1.dll

SetServiceStatus, StartServiceCtrlDispatcherW

api-ms-win-service-management-l1-1-0.dll

OpenSCManagerW, CreateServiceW, OpenServiceW, DeleteService

api-ms-win-service-winsvc-l1-1-0.dll

RegisterServiceCtrlHandlerW

api-ms-win-service-winsvc-l1-2-0.dll

RegisterServiceCtrlHandlerW

kernel32.dll

InterlockedIncrement, Sleep, InterlockedCompareExchange, SetUnhandledExceptionFilter, GetModuleHandleA, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, LeaveCriticalSection, GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, DebugBreak, LCMapStringW, EnterCriticalSection, ExitProcess, SetEvent, LoadLibraryExW, GetLastError, CreateEventW, GetModuleFileNameW, lstrlenW, GetCommandLineW, DeleteCriticalSection, InterlockedDecrement, GetCurrentProcessId, GetProcAddress, InterlockedExchange

msvcrt.dll

DllMain

ntdll.dll

EtwUnregisterTraceGuids, EtwRegisterTraceGuidsW, EtwGetTraceLoggerHandle, EtwGetTraceEnableFlags, EtwTraceMessage, EtwGetTraceEnableLevel

ole32.dll

CoImpersonateClient, CoRegisterClassObject, CoRevokeClassObject, StringFromGUID2, CoRevertToSelf, CoInitialize, CoInitializeSecurity

user32.dll

DispatchMessageW, TranslateMessage, GetMessageW, PostQuitMessage, SetTimer, PostThreadMessageW

unsecapp.exe

Sink to receive asynchronous callbacks for WMI client application by Microsoft

Remove unsecapp.exe

Version:	6.0.6002.18005 (lh_sp2rtm.090410-1830)
MD5:	8274c87726d4561ee8750d883764acc1
SHA1:	6ac45ce4530d440eeb6a49c91ba673f6a098706f
SHA256:	78f96e2d1ab6731ea64aedfbe365aa574de0280ff97d86dd0c89ad94acc30e1a

This is a Windows system installed file with Windows File Protection (WFP) enabled.

Overview

unsecapp.exe executes as a process with the local user's privileges typically within the context of its parent svchost.exe (Host Process for Windows Services by Microsoft Corporation). and is compiled as a 32 bit program.

Details

File name:	unsecapp.exe
Publisher:	Microsoft Corporation
Product name:	Sink to receive asynchronous callbacks for WMI client application
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\wbem\unsecapp.exe
Original name:	unsecapp.dll
File version:	6.0.6002.18005 (lh_sp2rtm.090410-1830)
Product version:	6.0.6002.18005
Size:	37 KB (37,888 bytes)
Digital DNA
PE subsystem:	Windows GUI
Entropy:	6.314833
File packed:	No
Code language:	Microsoft Visual C++
.NET CLR:	No

More details

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00177743%	0.028634%
Kernel CPU:	0.00101583%	0.013761%
User CPU:	0.00076160%	0.014873%
Kernel CPU time:	1,209,414 ms/min	100,923,805ms/min
CPU cycles:	130,501/sec	17,470,203/sec
Context switches:	2/sec	284/sec
Memory
Private memory:	2.41 MB	21.59 MB
Private (maximum):	4.01 MB
Private (minimum):	2.75 MB
Non-paged memory:	2.41 MB	21.59 MB
Virtual memory:	46.35 MB	140.96 MB
Virtual memory (peak):	48.87 MB	169.69 MB
Working set:	3.04 MB	18.61 MB
Working set (peak):	4.71 MB	37.95 MB
Page faults:	12,468/min	2,039/min
I/O
I/O read transfer:	105 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	0 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	187 Bytes/sec	448.09 KB/min
I/O other operations:	2/sec	1,671/min
Resource allocations
Threads:	3	12
Handles:	82	600
GUI GDI count:	8	103
GUI USER count:	4	49

Process properties

Integrety level:	Medium
Platform:	32-bit
Command line:	C:\Windows\System32\wbem\unsecapp.exe -embedding
Owner:	User
Parent process:	svchost.exe (Host Process for Windows Services by Microsoft Corporation)

Threads

Averages

RPCRT4.dll
Total CPU:	0.01388814%	0.272967%
Kernel CPU:	0.01344672%	0.107585%
User CPU:	0.00044142%	0.165382%
CPU cycles:	67,734/sec	5,741,424/sec
Memory:	780 KB	1.16 MB
unsecapp.exe (main module)
Total CPU:	0.00279323%
Kernel CPU:	0.00104524%
User CPU:	0.00174799%
CPU cycles:	60,336/sec
Memory:	48 KB

Distribution by Windows OS

OS version	distribution
Windows 7 Home Premium	31.00%
Windows 8	13.00%
Windows 7 Ultimate	11.00%
Windows 8.1	10.00%
Windows 7 Professional	7.50%
Windows 8.1 Single Language	5.50%
Windows 8 Single Language	4.50%
Windows Vista Home Premium	4.00%
Windows 7 Home Basic	3.50%
Windows 8.1 Pro	2.50%
Windows 8 Pro	2.00%
Windows Vista Ultimate	1.00%
Windows Vista Home Basic	1.00%
Windows 8 Pro with Media Center	1.00%
Windows 8.1 Pro with Media Center	0.50%
Windows 7 Starter	0.50%
Windows Vista Business	0.50%
Windows 7 Enterprise	0.50%
Windows 8.1 Pro Preview with Media Center	0.50%

Distribution by country

United States installs about 41.71% of Sink to receive asynchronous callbacks for WMI client application.

Distribution by PC manufacturer

PC Manufacturer	distribution
Acer	25.56%
Dell	15.56%
Hewlett-Packard	13.70%
Toshiba	11.85%
Lenovo	9.63%
ASUS	9.63%
Sony	4.44%
MSI	1.48%
NEC	1.48%
Alienware	1.11%
GIGABYTE	1.11%
Samsung	1.11%
Intel	0.74%
Medion	0.74%
Apple	0.74%
Gateway	0.74%
Sahara	0.37%

Remove Adware and Spyware Programs, FREE Download!