Should I block it?

No, this file is 100% safe to run.

Additional versions

6.3.9600.16384 (winblue_rtm.130821-1623)	0.18%
6.1.7600.16385 (win7_rtm.090713-1255)	0.18%
6.0.6000.16386 (vista_rtm.061101-2205)	78.92%
6.0.6000.16386 (vista_rtm.061101-2205)	5.23%
6.0.6000.16386 (vista_rtm.061101-2205)	15.50%

Relationships

Parent process

svchost.exe (Host Process for Windows Services by Microsoft Corporation)

Related files

PE file structure

Show functions

Import table

advapi32.dll

TraceEvent, GetTraceEnableFlags, GetTraceEnableLevel, GetTraceLoggerHandle, RegisterTraceGuidsA, UnregisterTraceGuids, RegCloseKey, RegSetValueW, RegOpenKeyExW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegDeleteKeyW

kernel32.dll

FreeLibrary, LoadLibraryA, lstrlenW, GetFileAttributesW, GetFileAttributesA, GetLastError, ReleaseMutex, CloseHandle, WaitForSingleObject, CreateMutexW, GetCurrentProcess, GetModuleHandleA, ExpandEnvironmentStringsW, GetExitCodeProcess, CreateProcessW, GetModuleHandleW, HeapSetInformation, GetVersionExA, SetFileAttributesW, DeleteFileW, FindFirstFileExW, FindClose, FindNextFileW, FindFirstFileW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetShortPathNameW, CreateDirectoryW, InterlockedCompareExchange, GetTickCount, QueryPerformanceCounter, SetUnhandledExceptionFilter, GetStartupInfoW, Sleep, InterlockedExchange, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, UnhandledExceptionFilter, GetProcAddress, SetConsoleCtrlHandler, GetCurrentThreadId

msoert2.dll

CopyRegistry

msvcrt.dll

DllMain

ole32.dll

CoUninitialize, CoFreeAllLibraries, CoTaskMemFree, CoInitializeEx, CoCreateInstance, OleInitialize, CoFreeUnusedLibraries, CoFreeUnusedLibrariesEx, OleUninitialize

shell32.dll

SHCreateItemFromParsingName, SHGetSpecialFolderPathW, SHSetLocalizedName, SHGetSpecialFolderLocation, SHChangeNotify

shlwapi.dll

PathFindFileNameW, PathCombineW, SHRegGetPathW, SHRegGetValueA, StrStrIW, SHDeleteValueW, SHRegGetBoolUSValueA, PathRemoveBlanksW, PathRemoveFileSpecW, PathAddExtensionW, PathAppendW, StrCmpW, StrCmpNIW, SHDeleteKeyW, SHSetValueW, SHRegGetValueW, StrCmpIW, SHGetValueW

user32.dll

SetWindowsHookExA, GetGUIThreadInfo, IsChild, UnhookWindowsHookEx, GetLastActivePopup, GetPropW, GetParent, CallNextHookEx, SendMessageW, IsDialogMessageW, SetPropW, FindWindowW, GetWindowThreadProcessId, AllowSetForegroundWindow, SetForegroundWindow, SendMessageTimeoutA, MessageBoxW, LoadStringW

winmail.exe

Windows Mail by Microsoft

Remove winmail.exe

Version:	6.3.9600.16384 (winblue_rtm.130821-1623)
MD5:	d963411f6a531302bef2d9652d8a7e54
SHA1:	adc6bfadc2869b6c9044e601731d6d9ac7a6832e

This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is winmail.exe?

Windows Mail is an email and newsgroup client included in Windows. Windows Mail is not a component of Internet Explorer, unlike Outlook Express, which was bundled with Internet Explorer. Unlike its predecessor Outlook Express, Windows Mail does not have WebDAV, making it incapable of accessing web-based email services through WebDAV.

Overview

winmail.exe executes as a process with the local user's privileges typically within the context of its parent svchost.exe (Host Process for Windows Services by Microsoft Corporation). and is compiled as a 64 bit program.

Details

File name:	winmail.exe
Publisher:	Microsoft Corporation
Product name:	Windows Mail
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Program Files\windows mail\winmail.exe
Original name:	WinMail.exe.mui
File version:	6.3.9600.16384 (winblue_rtm.130821-1623)
Product version:	6.3.9600.16384
Size:	388.5 KB (397,824 bytes)
Build date:	8/22/2013 3:29 AM
Digital DNA
PE subsystem:	Windows GUI
Entropy:	6.769864
File packed:	No
Code language:	Microsoft Visual C++
.NET CLR:	No

More details

Behaviors

Shell open commands

snews
nntp
news
mailto

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00004692%	0.028634%
Kernel CPU:	0.00003367%	0.013761%
User CPU:	0.00001325%	0.014873%
Kernel CPU time:	953 ms/min	100,923,805ms/min
CPU cycles:	42,202/sec	17,470,203/sec
Memory
Private memory:	8.66 MB	21.59 MB
Private (maximum):	4.21 MB
Private (minimum):	2.66 MB
Non-paged memory:	8.66 MB	21.59 MB
Virtual memory:	1.19 GB	140.96 MB
Virtual memory (peak):	1.2 GB	169.69 MB
Working set:	2.97 MB	18.61 MB
Working set (peak):	14.77 MB	37.95 MB
Page faults:	51,003/min	2,039/min
I/O
I/O read transfer:	8.67 KB/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	9.25 KB/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	84 Bytes/sec	448.09 KB/min
I/O other operations:	3/sec	1,671/min
Resource allocations
Threads:	6	12
Handles:	287	600
GUI GDI count:	48	103
GUI GDI peak:	49	142
GUI USER count:	40	49
GUI USER peak:	42	71

Process properties

Integrety level:	Medium
Platform:	64-bit
Command line:	"C:\Program Files\windows mail\winmail.exe" -embedding
Owner:	User
Parent process:	svchost.exe (Host Process for Windows Services by Microsoft Corporation)

Threads