Should I block it?

No, this file is 100% safe to run.

Additional versions

6.3.9600.16384 (winblue_rtm.130821-1623)	2.26%
6.3.9600.16384 (winblue_rtm.130821-1623)	0.10%
6.3.9600.16384 (winblue_rtm.130821-1623)	1.85%
6.3.9600.16384 (winblue_rtm.130821-1623)	0.04%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.10%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.10%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.02%
6.2.9200.16518 (win8_gdr.130201-1704)	0.18%
6.2.9200.16398 (win8_gdr_oobssr.120820-1900)	0.14%
6.2.9200.16398 (win8_gdr_oobssr.120820-1900)	0.70%
6.2.9200.16398 (win8_gdr_oobssr.120820-1900)	0.80%
6.2.9200.16398 (win8_gdr_oobssr.120820-1900)	0.14%
6.2.9200.16384 (win8_rtm.120725-1247)	0.72%
6.2.9200.16384 (win8_rtm.120725-1247)	7.08%
6.2.9200.16384 (win8_rtm.120725-1247)	1.05%
6.2.9200.16384 (win8_rtm.120725-1247)	6.03%
6.2.8400.0 (winmain_win8rc.120518-1423)	0.02%
6.2.8400.0 (winmain_win8rc.120518-1423)	0.02%
6.2.8400.0 (winmain_win8rc.120518-1423)	0.04%
6.2.8400.0 (winmain_win8rc.120518-1423)	0.04%
6.2.8250.0 (winmain_win8beta.120217-1520)	0.02%
6.2.8250.0 (winmain_win8beta.120217-1520)	0.02%
6.2.8102.0 (winmain_win8m3.110823-1455)	0.04%
6.2.8102.0 (winmain_win8m3.110823-1455)	0.04%
6.1.7601.17514 (win7sp1_rtm.101119-1850)	17.52%
View more
6.1.7601.17514 (win7sp1_rtm.101119-1850)	8.47%
6.1.7600.16385 (win7_rtm.090713-1255)	2.44%
6.1.7600.16385 (win7_rtm.090713-1255)	1.70%
6.1.7600.16385 (win7_rtm.090713-1255)	0.02%
6.1.7600.16385 (win7_rtm.090713-1255)	10.61%
6.1.7600.16385 (win7_rtm.090713-1255)	18.28%
6.1.7600.16385 (win7_rtm.090713-1255)	0.02%
6.1.7600.16385 (win7_rtm.090713-1255)	0.02%
6.0.6002.18005 (lh_sp2rtm.090410-1830)	2.56%
6.0.6002.18005 (lh_sp2rtm.090410-1830)	0.68%
6.0.6001.18226 (vistasp1_gdr.090302-1506)	0.02%
6.0.6001.18226 (vistasp1_gdr.090302-1506)	0.18%
6.0.6000.16830 (vista_gdr.090302-1506)	0.10%
6.0.6000.16386 (vista_rtm.061101-2205)	0.02%
6.0.6000.16386 (vista_rtm.061101-2205)	2.89%
6.0.6000.16386 (vista_rtm.061101-2205)	0.02%
6.0.6000.16386 (vista_rtm.061101-2205)	0.18%
6.0.6000.16386 (vista_rtm.061101-2205)	0.64%
6.0.6000.16386 (vista_rtm.061101-2205)	0.18%
5.2.3790.4455 (srv03_sp2_gdr.090203-1205)	0.02%
5.2.3790.4455 (srv03_sp2_gdr.090203-1205)	0.02%
5.2.3790.3959 (srv03_sp2_rtm.070216-1710)	0.02%
5.2.3790.3959 (srv03_sp2_rtm.070216-1710)	0.02%
5.2.3790.3959 (srv03_sp2_rtm.070216-1710)	0.04%
5.1.2600.5755 (xpsp_sp3_qfe.090206-1316)	0.43%
5.1.2600.5755 (xpsp_sp3_gdr.090206-1234)	2.85%
29 other versions

Relationships

Parent process

svchost.exe (Host Process for Windows Services by Microsoft Corporation)

Child processes

Related files

Wmiprvse.exe

WMI Provider Host by Microsoft

Remove Wmiprvse.exe

Version:	6.1.7601.17514 (win7sp1_rtm.101119-1850)
MD5:	619a67c9f617b7e69315bb28ecd5e1df
SHA1:	9f5a4796b58d8b104a1c0f5a63daf0032b947966
SHA256:	f34f231d117ccdfebb9cb35c8d6fdfa7051da27fdc1204fccff361fc0b13a0ff

This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is Wmiprvse.exe?

WMI provides a uniform interface for any local or remote applications or scripts that obtain management data from a computer system, a network, or an enterprise. The uniform interface is designed such that WMI client applications and scripts do not have to call a wide variety of operating system application programming interfaces (APIs). Many APIs cannot be called by automation clients like scripts or Visual Basic applications. Other APIs do not make calls to remote computers.

About Wmiprvse.exe (from Microsoft)

“Windows Management Instrumentation (WMI) is the infrastructure for management data and operations on Windows-based operating systems. You can write WMI scripts or applications to automate administrati”

Details

File name:	wmiprvse.exe
Publisher:	Microsoft Corporation
Product name:	WMI Provider Host
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\wbem\wmiprvse.exe
File version:	6.1.7601.17514 (win7sp1_rtm.101119-1850)
Product version:	6.1.7601.17514
Size:	364 KB (372,736 bytes)
Digital DNA
Entropy:	6.464498
File packed:	No
Code language:	Microsoft Visual C++
.NET CLR:	No

More details

Network connections

[UDP] listens on port 63433

[UDP] listens on port 63756

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.04769464%	0.028634%
Kernel CPU:	0.03033275%	0.013761%
User CPU:	0.01736189%	0.014873%
Kernel CPU time:	113,250,288 ms/min	100,923,805ms/min
CPU cycles:	638,066/sec	17,470,203/sec
Context switches:	159/sec	284/sec
Memory
Private memory:	14.35 MB	21.59 MB
Private (maximum):	14.58 MB
Private (minimum):	6.63 MB
Non-paged memory:	14.35 MB	21.59 MB
Virtual memory:	81.04 MB	140.96 MB
Virtual memory (peak):	87.64 MB	169.69 MB
Working set:	17.84 MB	18.61 MB
Working set (peak):	20.02 MB	37.95 MB
Page faults:	3,169,572/min	2,039/min
I/O
I/O read transfer:	13.38 KB/sec	1.02 MB/min
I/O read operations:	7/sec	343/min
I/O write transfer:	691 Bytes/sec	274.99 KB/min
I/O write operations:	8/sec	227/min
I/O other transfer:	90.51 KB/sec	448.09 KB/min
I/O other operations:	8,317/sec	1,671/min
Resource allocations
Threads:	11	12
Handles:	276	600

Process properties

Integrety level:	System
Platform:	64-bit
Command line:	C:\Windows\System32\wbem\wmiprvse.exe
Owner:	NETWORK SERVICE
Parent process:	svchost.exe (Host Process for Windows Services by Microsoft Corporation)

Threads

Averages

ntdll.dll
Total CPU:	1.76794816%	0.272967%
Kernel CPU:	1.07737710%	0.107585%
User CPU:	0.69057106%	0.165382%
CPU cycles:	33,699,050/sec	5,741,424/sec
Context switches:	100/sec	79/sec
Memory:	1.66 MB	1.16 MB
WmiPerfClass.dll
Total CPU:	0.24777018%
Kernel CPU:	0.11514105%
User CPU:	0.13262913%
CPU cycles:	4,977,283/sec
Memory:	148 KB
cimwin32.dll
Total CPU:	0.16831420%
Kernel CPU:	0.12886192%
User CPU:	0.03945229%
CPU cycles:	3,782,183/sec
Context switches:	27/sec
Memory:	1.98 MB
CorperfmonExt.dll
Total CPU:	0.15723379%
Kernel CPU:	0.12996026%
User CPU:	0.02727353%
CPU cycles:	2,060,506/sec
Memory:	148 KB
ADVAPI32.dll
Total CPU:	0.03429508%
Kernel CPU:	0.00166065%
User CPU:	0.03263444%
CPU cycles:	340,390/sec
Context switches:	1/sec
Memory:	876 KB
rasctrs.dll
Total CPU:	0.03170832%
Kernel CPU:	0.01459293%
User CPU:	0.01711540%
CPU cycles:	34,449/sec
Context switches:	1/sec
Memory:	32 KB
perfdisk.dll
Total CPU:	0.02473924%
Kernel CPU:	0.00672947%
User CPU:	0.01800977%
CPU cycles:	33,080/sec
Context switches:	1/sec
Memory:	52 KB
NCObjAPI.DLL
Total CPU:	0.01876011%
Kernel CPU:	0.00000530%
User CPU:	0.01875481%
CPU cycles:	12,751/sec
Memory:	88 KB
aspnet_perf.dll
Total CPU:	0.01810006%
Kernel CPU:	0.00857584%
User CPU:	0.00952422%
CPU cycles:	156,124/sec
Context switches:	2/sec
Memory:	52 KB
wmiprvse.exe (main module)
Total CPU:	0.00385496%
Kernel CPU:	0.00285413%
User CPU:	0.00100083%
CPU cycles:	94,817/sec
Memory:	380 KB
ole32.dll
Total CPU:	0.00089644%
Kernel CPU:	0.00003960%
User CPU:	0.00085684%
CPU cycles:	1,621/sec
Memory:	2.01 MB
MSVCR100.dll
Total CPU:	0.00085493%
Kernel CPU:	0.00008844%
User CPU:	0.00076649%
CPU cycles:	14,175/sec
Memory:	836 KB

Common loaded modules

These are modules that are typiclaly loaded within the context of this process.

shell32.dll (Windows Shell Common Dll by Microsoft Corporation)

Distribution by Windows OS

OS version	distribution
Windows 7 Home Premium	32.00%
Windows 8.1	21.50%
Windows 7 Ultimate	9.00%
Windows 8.1 Pro	6.50%
Windows 8	5.00%
Windows 8 Single Language	5.00%
Windows 8.1 Single Language	4.50%
Windows 7 Professional	4.00%
Windows 8 Pro	3.50%
Windows 8.1 Pro with Media Center	2.50%
Windows 7 Home Basic	2.50%
Windows Vista Home Premium	1.50%
Windows 8 Enterprise	1.00%
Windows 8.1 N	0.50%
Windows Seven Black Edition	0.50%
Windows 8.1 Enterprise Evaluation	0.50%

Distribution by country

United States installs about 44.72% of WMI Provider Host.

Distribution by PC manufacturer

PC Manufacturer	distribution
Dell	23.75%
Hewlett-Packard	18.01%
ASUS	16.86%
Acer	12.64%
Toshiba	8.43%
Lenovo	8.43%
Sony	5.36%
GIGABYTE	2.30%
Alienware	1.92%
Samsung	1.53%
Intel	0.77%

Remove Adware and Spyware Programs, FREE Download!