Should I block it?

No, this file is 100% safe to run.

Additional versions

6.3.9600.16384 (winblue_rtm.130821-1623)	0.98%
6.2.9200.16384 (win8_rtm.120725-1247)	1.96%
6.2.9200.16384 (win8_rtm.120725-1247)	1.47%
6.2.9200.16384 (win8_rtm.120725-1247)	0.98%
6.2.9200.16384 (win8_rtm.120725-1247)	1.47%
6.1.7600.16385 (win7_rtm.090713-1255)	11.27%
6.1.7600.16385 (win7_rtm.090713-1255)	8.33%
6.0.6000.16386 (vista_rtm.061101-2205)	11.76%
6.0.6000.16386 (vista_rtm.061101-2205)	3.92%
6.0.6000.16386 (vista_rtm.061101-2205)	53.92%
6.0.6000.16386 (vista_rtm.061101-2205)	3.92%

Relationships

ersvc.dll (Windows Error Reporting Service by Microsoft)

PE file structure

Show functions

Import table

advapi32.dll

ConvertSidToStringSidW, RegisterEventSourceW, ReportEventW, DeregisterEventSource, DuplicateTokenEx, ConvertStringSidToSidW, SetTokenInformation, GetSidSubAuthorityCount, GetSidSubAuthority, RegGetValueW, RegOpenKeyExW, RegDeleteValueW, RegCloseKey, RegisterServiceCtrlHandlerExW, GetLengthSid, GetTokenInformation, CreateProcessAsUserW, TraceMessage, GetTraceEnableFlags, GetTraceEnableLevel, GetTraceLoggerHandle, RegisterTraceGuidsW, UnregisterTraceGuids, RevertToSelf, ImpersonateLoggedOnUser, OpenProcessToken, OpenThreadToken, SetServiceStatus, ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-appmodel-runtime-l1-1-0.dll

GetApplicationUserModelId, GetPackageFullName

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI, DelayLoadFailureHook

api-ms-win-core-errorhandling-l1-1-1.dll

UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetLastError

api-ms-win-core-handle-l1-1-0.dll

CloseHandle, DuplicateHandle

api-ms-win-core-heap-l1-2-0.dll

HeapFree, GetProcessHeap, HeapAlloc

api-ms-win-core-heap-obsolete-l1-1-0.dll

LocalFree

api-ms-win-core-interlocked-l1-2-0.dll

InterlockedExchange, InterlockedCompareExchange, InterlockedDecrement, InterlockedIncrement

api-ms-win-core-kernel32-legacy-l1-1-0.dll

LoadLibraryW, WTSGetActiveConsoleSessionId

api-ms-win-core-libraryloader-l1-1-1.dll

LoadLibraryExW, DisableThreadLibraryCalls, FreeLibrary, GetProcAddress

api-ms-win-core-memory-l1-1-1.dll

MapViewOfFile, CreateFileMappingW, ReadProcessMemory, UnmapViewOfFile

api-ms-win-core-namespace-l1-1-0.dll

OpenPrivateNamespaceW, ClosePrivateNamespace, CreatePrivateNamespaceW

api-ms-win-core-processthreads-l1-1-1.dll

GetProcessTimes, OpenThreadToken, OpenProcessToken, CreateProcessAsUserW, ResumeThread, TerminateProcess, GetCurrentProcessId, InitializeProcThreadAttributeList, UpdateProcThreadAttribute, DeleteProcThreadAttributeList, GetExitCodeProcess, GetProcessId, ProcessIdToSessionId, GetCurrentThreadId, GetCurrentProcess, CreateProcessW, OpenThread, CreateThread, GetThreadId, OpenProcess

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter

api-ms-win-core-psapi-l1-1-0.dll

QueryFullProcessImageNameW

api-ms-win-core-psapi-obsolete-l1-1-0.dll

K32GetModuleFileNameExW

api-ms-win-core-registry-l1-1-0.dll

RegGetValueW, RegSetValueExW, RegCreateKeyExW, RegCloseKey, RegOpenKeyExW

api-ms-win-core-string-obsolete-l1-1-0.dll

lstrlenW

api-ms-win-core-synch-l1-2-0.dll

Sleep, ResetEvent, SetEvent, CreateMutexW, InitializeCriticalSection, WaitForSingleObject, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, WaitForMultipleObjectsEx, CreateEventW, OpenEventW

api-ms-win-core-sysinfo-l1-2-0.dll

GetSystemDirectoryW, GetSystemTime, GetTickCount, GetSystemTimeAsFileTime

api-ms-win-core-threadpool-l1-2-0.dll

WaitForThreadpoolWaitCallbacks, TrySubmitThreadpoolCallback, CloseThreadpoolWait, SetThreadpoolWait, CloseThreadpoolCleanupGroup, LeaveCriticalSectionWhenCallbackReturns, CreateThreadpoolCleanupGroup, CloseThreadpoolCleanupGroupMembers, CreateThreadpoolWait

api-ms-win-core-threadpool-legacy-l1-1-0.dll

UnregisterWaitEx

api-ms-win-core-timezone-l1-1-0.dll

SystemTimeToFileTime

api-ms-win-core-util-l1-1-0.dll

DecodePointer, EncodePointer

api-ms-win-core-version-l1-1-0.dll

VerQueryValueW, GetFileVersionInfoExW, GetFileVersionInfoSizeExW

api-ms-win-eventing-classicprovider-l1-1-0.dll

TraceMessage

api-ms-win-security-base-l1-2-0.dll

AllocateAndInitializeSid, GetTokenInformation, FreeSid, SetTokenInformation, ImpersonateLoggedOnUser, GetSidSubAuthority, GetSidSubAuthorityCount, SetSecurityDescriptorDacl, CheckTokenMembership, RevertToSelf, InitializeSecurityDescriptor, DuplicateToken, CreateWellKnownSid, DuplicateTokenEx

api-ms-win-service-core-l1-1-0.dll

RegisterServiceCtrlHandlerExW, SetServiceStatus

api-ms-win-service-core-l1-1-1.dll

RegisterServiceCtrlHandlerExW, SetServiceStatus

api-ms-win-service-management-l1-1-0.dll

CloseServiceHandle, OpenServiceW, OpenSCManagerW

api-ms-win-service-management-l2-1-0.dll

QueryServiceConfigW

kernel32.dll

LoadLibraryExW, CompareFileTime, GetFileInformationByHandle, CreateFileW, FindNextChangeNotification, FindFirstChangeNotificationW, FindResourceW, DisableThreadLibraryCalls, DecodePointer, InitializeCriticalSection, DeleteCriticalSection, FreeLibrary, LocalFree, CloseHandle, UnmapViewOfFile, LeaveCriticalSection, EnterCriticalSection, OpenEventW, GetLastError, GetCurrentProcessId, HeapFree, CreatePrivateNamespaceW, HeapAlloc, GetProcessHeap, ClosePrivateNamespace, WaitForSingleObject, EncodePointer, GetProcAddress, LoadLibraryW, CreateProcessW, GetSystemDirectoryW, DuplicateHandle, GetCurrentProcess, OpenProcess, GetThreadId, GetProcessId, WaitForMultipleObjects, ResumeThread, MapViewOfFile, CreateFileMappingW, ProcessIdToSessionId, CreateEventW, SetEvent, CloseThreadpoolCleanupGroupMembers, InterlockedDecrement, TerminateProcess, InterlockedIncrement, LeaveCriticalSectionWhenCallbackReturns, TrySubmitThreadpoolCallback, CreateThread, CreateThreadpoolCleanupGroup, DelayLoadFailureHook, InterlockedCompareExchange, LoadLibraryA, GetCommandLineA, GetVersionExA, GetModuleHandleA, ExitProcess, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, HeapDestroy, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, OutputDebugStringA, UnhandledExceptionFilter, SetUnhandledExceptionFilter, HeapReAlloc, HeapSize, WriteFile, GetModuleHandleW, GetCPInfo, GetACP, GetOEMCP, Sleep, VirtualAlloc, SetFilePointer, GetConsoleCP, GetConsoleMode, MultiByteToWideChar, GetLocaleInfoA, GetStringTypeA, GetStringTypeW, LCMapStringA, LCMapStringW, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, VirtualProtect, GetSystemInfo, VirtualQuery, CreateFileA, FlushFileBuffers, OpenThread, SetThreadpoolWait, SystemTimeToFileTime, GetSystemTime, CloseThreadpoolWait, WaitForThreadpoolWaitCallbacks, GetProcessTimes, GetExitCodeProcess, lstrlenW, CreateThreadpoolWait, InterlockedCompareExchange64, DeleteTimerQueueEx, CreateTimerQueueTimer, CreateTimerQueue, SizeofResource, LockResource, LoadResource, GetSystemWow64DirectoryW, RegCreateKeyExW, RegSetValueExW, K32GetModuleFileNameExW, QueryFullProcessImageNameW, LoadLibraryExA, InterlockedExchange, OpenPrivateNamespaceW, ResetEvent, UnregisterWait, CloseThreadpoolCleanupGroup, ReadProcessMemory

msvcrt.dll

DllMain

ntdll.dll

RtlUnwind, NtAlpcCreatePort, AlpcInitializeMessageAttribute, AlpcGetMessageAttribute, NtSetSystemInformation, ShipAssert, WinSqmEventWrite, NtDuplicateToken, NtQueryInformationToken, RtlUpcaseUnicodeChar, WinSqmAddToStream, NtAlpcAcceptConnectPort, NtAlpcConnectPort, NtAlpcSendWaitReceivePort, RtlInitUnicodeString, RtlCreateBoundaryDescriptor, RtlCreateServiceSid, RtlAddSIDToBoundaryDescriptor, RtlDeleteBoundaryDescriptor, NtAlpcOpenSenderProcess, NtAlpcOpenSenderThread, NtClose, NtOpenEvent, NtTerminateProcess, EtwUnregisterTraceGuids, EtwRegisterTraceGuidsW, EtwGetTraceLoggerHandle, EtwGetTraceEnableLevel, EtwGetTraceEnableFlags, EtwTraceMessage, NtQueryInformationProcess

Export table

ServiceMain

SvchostPushServiceGlobals

wersvc.dll

Windows Error Reporting Service by Microsoft

Remove wersvc.dll

Version:	6.1.7600.16385 (win7_rtm.090713-1255)
MD5:	08e420d873e4fd85241ee2421b02c4a4
SHA1:	5415e924085e2ab2ca86ed9014a2df5d5f993c32
SHA256:	e1e9436eb096ff7de9a76da6217035257ef9fc7565ddb9016dca3859e7f1ef0f

This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is wersvc.dll?

The error reporting feature enables users to notify Microsoft of application faults, kernel faults, unresponsive applications, and other application specific problems. Microsoft can use the error reporting feature to provide customers with troubleshooting information, solutions, or updates for their specific problems.

About wersvc.dll (from Microsoft)

“Windows provides crash, non-response, and kernel fault error reporting by default without requiring changes to your application. The report will include minidump and heap dump information if required.”

Details

File name:	wersvc.dll
Publisher:	Microsoft Corporation
Product name:	Windows Error Reporting Service
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\wersvc.dll
Original name:	wersvc
File version:	6.1.7600.16385 (win7_rtm.090713-1255)
Product version:	6.1.7600.16385
Size:	63.5 KB (65,024 bytes)
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
Code language:	Microsoft Visual C# / Basic .NET
.NET CLR:	Yes
.NET NGENed:	No

More details

Behaviors

Hosted services

Runs as a shared service under the Windows svcHost

Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'
Shared name is 'WerSvc'

Distribution by Windows OS

OS version	distribution
Windows Vista Home Premium	51.00%
Windows Vista Home Basic	11.50%
Windows 7 Home Premium	7.00%
Windows Vista Ultimate	7.00%
Windows 7 Ultimate	6.50%
Windows 7 Ultimate N	4.50%
Windows Vista Business	4.00%
Windows 7 Professional	2.00%
Windows 8	2.00%
Windows 8 Pro	1.50%
Windows 8 Pro with Media Center	1.00%
Windows 8.1 Pro	0.50%
Windows 8.1 Enterprise	0.50%
Windows Vista™ Home Premium	0.50%
Microsoft Windows XP	0.50%

Distribution by country

United States installs about 58.76% of Windows Error Reporting Service.

Distribution by PC manufacturer

PC Manufacturer	distribution
Dell	27.54%
Hewlett-Packard	21.56%
Toshiba	11.98%
ASUS	10.78%
Sony	9.58%
Gateway	7.19%
Acer	5.39%
Samsung	1.80%
Lenovo	1.20%
Intel	1.20%
American Megatrends	0.60%
GIGABYTE	0.60%
Packard Bell	0.60%

Remove Adware and Spyware Programs, FREE Download!