Should I block it?

No, this file is 100% safe to run.

Additional versions

5.2.3790.3959 (srv03_sp2_rtm.070216-1710)	1.47%
5.2.3790.1830 (srv03_sp1_rtm.050324-1447)	1.47%
5.2.3790.1230 built by: DNSRV(bld4act)	45.59%
5.2.3790.1230 built by: DNSRV(bld4act)	1.47%
5.2.3790.1230 built by: dnsrv(bld4act)	41.18%
5.2.3790.1230 built by: dnsrv(bld4act)	4.41%
5.2.3790.1230 built by: dnsrv(bld4act)	1.47%
5.1.2600.2180 (private/xpsp_mce.040810-0205)	2.94%

Relationships

PE file structure

Show functions

Import table

advapi32.dll

RegQueryValueExW, RegCloseKey, RegOpenKeyExW, RegOpenKeyW, StopTraceW, EnableTrace, StartTraceW, ControlTraceW, RegSetValueExW, RegCreateKeyExW, ConvertStringSecurityDescriptorToSecurityDescriptorW, GetTraceEnableFlags, GetTraceEnableLevel, GetTraceLoggerHandle, RegisterTraceGuidsW, UnregisterTraceGuids, StartServiceCtrlDispatcherW, SetServiceStatus, RegisterServiceCtrlHandlerExW, GetTokenInformation, OpenThreadToken, LookupAccountSidW, CreateWellKnownSid, TraceMessage

kernel32.dll

ResetEvent, LocalFree, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, CreateTimerQueueTimer, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, CreateTimerQueue, CreateThread, QueueUserAPC, WaitForSingleObjectEx, GetCurrentThread, lstrcmpiW, DeleteTimerQueueEx, GetSystemDirectoryW, SearchPathW, SleepEx, DeleteTimerQueueTimer, ExpandEnvironmentStringsW, InterlockedDecrement, CloseHandle, WaitForSingleObject, TerminateProcess, CreateProcessW, GetLastError, Sleep, InterlockedIncrement, SetEvent, CreateEventW, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, EnterCriticalSection, LeaveCriticalSection, GetSystemTimeAsFileTime, GetModuleHandleA

msvcrt.dll

DllMain

rpcrt4.dll

RpcStringBindingComposeW, RpcBindingFromStringBindingW, RpcBindingSetAuthInfoExW, RpcServerUseProtseqEpW, RpcServerRegisterIfEx, RpcServerListen, RpcBindingFree, RpcImpersonateClient, RpcRevertToSelf, RpcServerUnregisterIf, RpcMgmtStopServerListening, RpcMgmtWaitServerListen, RpcBindingToStringBindingW, RpcStringBindingParseW, RpcServerInqCallAttributesW, UuidFromStringW, RpcAsyncCompleteCall, RpcAsyncInitializeHandle, RpcStringFreeW, NdrServerCall2, NdrClientCall2, NdrAsyncClientCall, UuidToStringW, UuidCreate

secur32.dll

GetUserNameExW

setupapi.dll

SetupDiEnumDeviceInterfaces, SetupDiGetClassDevsExW, SetupDiOpenDeviceInterfaceW, SetupDiGetDeviceInterfaceDetailW, SetupDiOpenDevRegKey, SetupDiDestroyDeviceInfoList, SetupDiCreateDeviceInfoList

user32.dll

UnregisterDeviceNotification, RegisterDeviceNotificationW

WdfMgr.exe

Windows User Mode Driver Manager by Microsoft

Remove WdfMgr.exe

Version:	5.2.3790.1230 built by: DNSRV(bld4act)
MD5:	c81b8635dee0d3ef5f64b3dd643023a5
SHA1:	f60b2c02776bb414b58a6416ac6f11772947ebfe
SHA256:	6d7438a5fb7168352099f726bd0980ad398a7cfe929b8d2bd362b238c1540d85

What is WdfMgr.exe?

The Windows User Mode Driver Framework service is a driver component that is used by Windows Media Player 10. The Windows User Mode Driver Framework service supports synchronization of content with hardware players.

Overview

wdfmgr.exe runs as a service under the name UMWdf (SYSTEM\CurrentControlSet\Services\UMWdf) with extensive SYSTEM privileges (full administrator access). and is compiled as a 32 bit program.

Details

File name:	wdfmgr.exe
Publisher:	Microsoft Corporation
Product name:	Windows User Mode Driver Manager
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\wdfmgr.exe
File version:	5.2.3790.1230 built by: DNSRV(bld4act)
Product version:	5.2.3790.1230
Size:	38 KB (38,912 bytes)
Digital DNA
PE subsystem:	Windows Console
Entropy:	6.072843
File packed:	No
Code language:	Microsoft Visual C++
.NET CLR:	No

More details

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'UMWdf'

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00478295%	0.028634%
Kernel CPU:	0.00294318%	0.013761%
User CPU:	0.00183977%	0.014873%
Kernel CPU time:	994 ms/min	100,923,805ms/min
User CPU time:	0 ms/min	0 ms/min
Context switches:	2/sec	284/sec
Memory
Private memory:	1.54 MB	21.59 MB
Private (maximum):	1.52 MB
Private (minimum):	1.16 MB
Non-paged memory:	1.54 MB	21.59 MB
Virtual memory:	14.82 MB	140.96 MB
Virtual memory (peak):	15.24 MB	169.69 MB
Working set:	1.16 MB	18.61 MB
Working set (peak):	1.85 MB	37.95 MB
Page faults:	507/min	2,039/min
I/O
I/O read transfer:	49 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	20 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	460 Bytes/sec	448.09 KB/min
I/O other operations:	9/sec	1,671/min
Resource allocations
Threads:	4	12
Handles:	65	600
GUI GDI count:	4	103
GUI USER count:	1	49

Process properties

Integrety level:	Undefined
Platform:	32-bit
Command line:	C:\Windows\System32\wdfmgr.exe
Owner:	SYSTEM
Windows Service
Service name:	SYSTEM\CurrentControlSet\Services\UMWdf
Display name:	UMWdf
Description:	“Enables Windows user mode drivers.”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Distribution by Windows OS

OS version	distribution
Microsoft Windows XP	80.88%
Windows XP Home Edition	13.24%
Microsoft Windows XP Home Edition	2.94%
Windows XP Professional	1.47%
Windows Server 2003, Standard Edition	1.47%

Distribution by country

United States installs about 16.33% of Windows User Mode Driver Manager.

Distribution by PC manufacturer

PC Manufacturer	distribution
Dell	42.55%
Toshiba	17.02%
American Megatrends	12.77%
Lenovo	8.51%
Intel	8.51%
ASUS	4.26%
Sahara	4.26%
GIGABYTE	2.13%

Remove Adware and Spyware Programs, FREE Download!