Should I block it?

No, this file is 100% safe to run.

Additional versions

6.3.9600.16384 (winblue_rtm.130821-1623)	5.89%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.12%
6.2.9200.16384 (win8_rtm.120725-1247)	55.36%
6.2.9200.16384 (win8_rtm.120725-1247)	21.20%
6.2.8400.0 (winmain_win8rc.120518-1423)	0.24%
6.1.7600.16385 (win7_rtm.090713-1255)	5.30%
6.1.7600.16385 (win7_rtm.090713-1255)	4.83%
6.1.7600.16385 (win7_rtm.090713-1255)	2.24%
6.1.7600.16385 (win7_rtm.090713-1255)	2.47%
6.0.6000.16386 (vista_rtm.061101-2205)	1.18%
6.0.6000.16386 (vista_rtm.061101-2205)	0.59%
6.0.6000.16386 (vista_rtm.061101-2205)	0.47%
6.0.5716.32 (winmain(wmbla).060928-1756)	0.12%

Relationships

Parent process

svchost.exe (Host Process for Windows Services by Microsoft Corporation)

Related files

wudfsvc.dll (Windows Driver Foundation - User-mode Driver Framework Service by Microsoft)

PE file structure

Show functions

Import table

advapi32.dll

GetTraceEnableFlags, GetTraceEnableLevel, GetTraceLoggerHandle, RegisterTraceGuidsW, TraceMessage, UnregisterTraceGuids, RegQueryValueExW, RegCloseKey, RegOpenKeyExW, TraceEvent, ConvertStringSidToSidW, RegSetValueExW, RevertToSelf, EventRegister, EventWrite, EventUnregister, EventActivityIdControl

api-ms-win-core-com-l1-1-1.dll

CLSIDFromString, CoInitializeEx, CoUninitialize

api-ms-win-core-errorhandling-l1-1-1.dll

SetLastError, GetLastError, RaiseException, SetUnhandledExceptionFilter, UnhandledExceptionFilter

api-ms-win-core-file-l1-2-1.dll

CreateFileW, WriteFile, FlushFileBuffers, ReadFile

api-ms-win-core-handle-l1-1-0.dll

CloseHandle

api-ms-win-core-heap-l1-2-0.dll

HeapAlloc, GetProcessHeap, HeapFree, HeapSetInformation

api-ms-win-core-heap-obsolete-l1-1-0.dll

LocalAlloc, LocalFree

api-ms-win-core-io-l1-1-1.dll

GetOverlappedResult, DeviceIoControl

api-ms-win-core-libraryloader-l1-1-1.dll

LoadLibraryExW, GetModuleHandleA, GetProcAddress, LoadLibraryExA, FreeLibrary

api-ms-win-core-namedpipe-l1-2-0.dll

WaitNamedPipeW, SetNamedPipeHandleState, TransactNamedPipe

api-ms-win-core-processenvironment-l1-2-0.dll

SetEnvironmentVariableW, ExpandEnvironmentStringsW

api-ms-win-core-processthreads-l1-1-2.dll

GetCurrentThread, TlsFree, GetCurrentProcess, TlsSetValue, GetCurrentProcessId, TlsAlloc, TlsGetValue, GetCurrentThreadId, TerminateProcess, CreateThread

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey, RegQueryValueExW, RegSetValueExW, RegOpenKeyExW

api-ms-win-core-rtlsupport-l1-2-0.dll

RtlCaptureContext

api-ms-win-core-synch-l1-2-0.dll

DeleteCriticalSection, InitializeCriticalSection, Sleep, WaitForSingleObject, CreateEventW, EnterCriticalSection, SetEvent, WaitForMultipleObjectsEx, InitializeCriticalSectionAndSpinCount, LeaveCriticalSection

api-ms-win-core-sysinfo-l1-2-1.dll

GetTickCount, GetSystemTimeAsFileTime, GetSystemDirectoryW, GetOsSafeBootMode

api-ms-win-core-threadpool-l1-2-0.dll

SetThreadpoolThreadMinimum, SetThreadpoolThreadMaximum, CloseThreadpool, CreateThreadpool, CreateThreadpoolWait, SetThreadpoolWait, WaitForThreadpoolWaitCallbacks, CloseThreadpoolWait, CloseThreadpoolCleanupGroupMembers, CloseThreadpoolCleanupGroup, CreateThreadpoolCleanupGroup

api-ms-win-eventing-classicprovider-l1-1-0.dll

TraceMessage, RegisterTraceGuidsW, GetTraceEnableFlags, GetTraceEnableLevel, UnregisterTraceGuids, GetTraceLoggerHandle

api-ms-win-eventing-provider-l1-1-0.dll

EventActivityIdControl, EventUnregister, EventWrite, EventRegister

api-ms-win-security-base-l1-2-0.dll

RevertToSelf

api-ms-win-security-sddl-l1-1-0.dll

ConvertStringSidToSidW

devobj.dll

DevObjGetDeviceRegistryProperty, DevObjCreateDeviceInfoList, DevObjOpenDevRegKey, DevObjGetDeviceInstanceId, DevObjDestroyDeviceInfoList, DevObjEnumDeviceInfo, DevObjGetClassDevs

kernel32.dll

GetProcAddress, GetModuleHandleW, GetVersionExW, WaitForSingleObject, CloseHandle, TlsFree, GetLastError, TlsGetValue, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, TlsSetValue, TlsAlloc, InitializeCriticalSectionAndSpinCount, GetSystemDirectoryW, HeapSetInformation, InterlockedIncrement, InterlockedDecrement, InterlockedCompareExchange, CreateThread, LocalFree, CreateEventW, SetEvent, GetOverlappedResult, DeviceIoControl, CreateFileW, SetEnvironmentVariableW, InitializeCriticalSection, InterlockedExchange, BindIoCompletionCallback, FreeLibrary, LoadLibraryExW, GetCurrentProcessId, HeapFree, HeapAlloc, GetProcessHeap, FlushFileBuffers, Sleep, ReadFile, WriteFile, GetCurrentThread, VerifyVersionInfoW, VerSetConditionMask, LocalAlloc, LoadLibraryA, RaiseException, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentThreadId, GetTickCount, QueryPerformanceCounter, GetModuleHandleA, SetUnhandledExceptionFilter, OutputDebugStringA, RtlCaptureContext, WaitNamedPipeW, SetNamedPipeHandleState, TransactNamedPipe, ExpandEnvironmentStringsW, SetThreadpoolThreadMinimum, SetThreadpoolThreadMaximum, CloseThreadpool, CreateThreadpool, CreateThreadpoolWait, SetThreadpoolWait, WaitForThreadpoolWaitCallbacks, CloseThreadpoolWait, WaitForMultipleObjects, LoadLibraryExA

msvcrt.dll

DllMain

ntdll.dll

DbgPrintEx, RtlNtStatusToDosError, NtQueryInformationFile, RtlUnwind, NtSetInformationFile, RtlInitUnicodeString, RtlSetIoCompletionCallback, VerSetConditionMask, RtlVerifyVersionInfo

ole32.dll

CoInitializeEx, CLSIDFromString, CoUninitialize

rpcrt4.dll

UuidFromStringW

user32.dll

GetSystemMetrics

wudfplatform.dll

GetAndInitializePlatformObject, ShutdownPlatformLibrary, WudfWaitForDebugger, WudfDebugBreakPoint, WudfIsUserDebuggerPresent, WdfGetLpcInterface, InitializePlatformLibrary, WudfIsKernelDebuggerPresent

WUDFHost.exe

Windows Driver Foundation - User-mode Driver Framework Host Process by Microsoft

Remove WUDFHost.exe

Version:	6.1.7600.16385 (win7_rtm.090713-1255)
MD5:	95d498927f74aca3593d653d42099915
SHA1:	ceb24a9cb9a5d8810e97810d01987e71583f62cc
SHA256:	e2194b2ea9832eab69d76f578c8905fd7956d74cd85e4e10251606c048903941

This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is WUDFHost.exe?

Windows Driver Foundation (WDF) is a set of Microsoft tools that aid in the creation of device drivers for Windows. The User-Mode Driver Framework, for writing certain classes of driver that can run in user-mode.

About WUDFHost.exe (from Microsoft)

“WDF implements the fundamental features of a Windows driver and enables you to focus on the specific details of your hardware or filter. WDF defines a single driver model that you can use to create ob”

Overview

WUDFHost.exe executes as a process with LOCAL SERVICE privileges typically within the context of its parent svchost.exe (Host Process for Windows Services by Microsoft Corporation). This version is designed to run on Windows 7 and is compiled as a 64 bit program.

Details

File name:	WUDFHost.exe
Publisher:	Microsoft Corporation
Product name:	Windows Driver Foundation - User-mode Driver Framework Host Process
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\wudfhost.exe
Original name:	WUDFHost.exe.mui
File version:	6.1.7600.16385 (win7_rtm.090713-1255)
Product version:	6.1.7600.16385
Size:	221.5 KB (226,816 bytes)
Digital DNA
Entropy:	5.856292
File packed:	No
Code language:	Microsoft Visual C++
.NET CLR:	No

More details

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00079241%	0.028634%
Kernel CPU:	0.00053427%	0.013761%
User CPU:	0.00025814%	0.014873%
Kernel CPU time:	108,406 ms/min	100,923,805ms/min
CPU cycles:	2,585/sec	17,470,203/sec
Context switches:	11/sec	284/sec
Memory
Private memory:	2.47 MB	21.59 MB
Private (maximum):	6 MB
Private (minimum):	4.47 MB
Non-paged memory:	2.47 MB	21.59 MB
Virtual memory:	42.77 MB	140.96 MB
Virtual memory (peak):	44.31 MB	169.69 MB
Working set:	4.66 MB	18.61 MB
Working set (peak):	6.36 MB	37.95 MB
Page faults:	2,592/min	2,039/min
I/O
I/O read transfer:	54 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O other transfer:	19 Bytes/sec	448.09 KB/min
I/O other operations:	1/sec	1,671/min
Resource allocations
Threads:	8	12
Handles:	251	600

Process properties

Integrety level:	System
Platform:	64-bit
Command lines:	"C:\Windows\System32\wudfhost.exe" -hostguiC:{193a1820-d9ac-4997-8c55-be817523f6aa} -ioeventportnamC:hostprocess-a1f42010-328f-4af7-bc7f-b8782d9fdd43 -systemeventportnamC:hostprocess-7fc6276a-dc1e-406e-a326-5b0a33f2c800 -iocanceleventportnamC:hostprocess-66c40a73-83bf-47bc-9aa3-60d66577c863 -nonstatechangingeventportnamC:hostprocess-b3f4210a-469b-430d-910c-702ad15f4483 -servicesiC:s-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -lifetimeiC:28e3f68f-8cbf-4244-90a3-9353cc52b7d7 "C:\Windows\System32\wudfhost.exe" -hostguiC:{193a1820-d9ac-4997-8c55-be817523f6aa} -ioeventportnamC:hostprocess-058d8a2e-9a98-4fa9-bbf5-441491f33bc5 -systemeventportnamC:hostprocess-de3fdb7f-d46e-481e-8814-2881befcf980 -iocanceleventportnamC:hostprocess-0f703874-bd12-4efc-b505-ef1cbff17433 -nonstatechangingeventportnamC:hostprocess-c85bbf64-357a-4636-bc3d-6b9023d453ac -servicesiC:s-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -lifetimeiC:9d4fa435-3b87-44a3-969f-a8193c39b06d "C:\Windows\System32\wudfhost.exe" -hostguiC:{193a1820-d9ac-4997-8c55-be817523f6aa} -ioeventportnamC:hostprocess-5ccec962-fe26-4c94-9368-239f1df54d36 -systemeventportnamC:hostprocess-fcf4dd08-aca5-4e86-a5f4-0ce8de4b2b61 -iocanceleventportnamC:hostprocess-87e500cd-27f5-40c9-84b0-94b084f06479 -nonstatechangingeventportnamC:hostprocess-325a7e6f-72e0-4d0c-b50c-b28c9588f52a -servicesiC:s-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -lifetimeiC:e04ad612-a5b4-4b38-b84b-d2af6af5766c "C:\Windows\System32\wudfhost.exe" -hostguiC:{193a1820-d9ac-4997-8c55-be817523f6aa} -ioeventportnamC:hostprocess-98aee6b3-2d12-414a-a01d-b077928b176a -systemeventportnamC:hostprocess-493cde4e-2e76-4623-a810-83506acfab0a -iocanceleventportnamC:hostprocess-a00a26f9-6ca0-44a9-94d1-d15910cdfe5e -nonstatechangingeventportnamC:hostprocess-57d39e1e-e534-470e-9d14-238c944260c8 -servicesiC:s-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -lifetimeiC:5996d374-8025-4996-9624-9090d829e462 "C:\Windows\System32\wudfhost.exe" -hostguiC:{193a1820-d9ac-4997-8c55-be817523f6aa} -ioeventportnamC:hostprocess-9aacfcb1-f87a-4afc-a25e-0b4fdc71600c -systemeventportnamC:hostprocess-5abf5152-ed56-4ba1-bc57-92ce43206043 -iocanceleventportnamC:hostprocess-e3ccc5cd-09f6-4d1d-a1b3-9110c7593d13 -nonstatechangingeventportnamC:hostprocess-9cf551a0-059a-4644-a917-0bb198abe2be -servicesiC:s-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -lifetimeiC:f5af9ba7-0a56-4f65-b5a5-adc4ba26d500 "C:\Windows\System32\wudfhost.exe" -hostguiC:{193a1820-d9ac-4997-8c55-be817523f6aa} -ioeventportnamC:hostprocess-0c76b5e0-0be2-4e2c-a018-84a40aefb99a -systemeventportnamC:hostprocess-29f21d71-df9b-4ad0-b1d0-f9ccb2e3b3d2 -iocanceleventportnamC:hostprocess-06d9a134-a43a-47c3-987c-c8686a91bf94 -nonstatechangingeventportnamC:hostprocess-0fb03d99-ffb7-416c-b527-8b59987569e3 -servicesiC:s-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -lifetimeiC:2be3c9e9-f03f-4a61-b29d-d6a25d6272c9 "C:\Windows\System32\wudfhost.exe" -hostguiC:{193a1820-d9ac-4997-8c55-be817523f6aa} -ioeventportnamC:hostprocess-44c55ff7-af49-4bae-9532-ffac00131c6e -systemeventportnamC:hostprocess-bd6bd275-fb29-4b1c-8b13-97d274eff1a4 -iocanceleventportnamC:hostprocess-821f2483-e977-4d62-948e-c5d8d7274052 -nonstatechangingeventportnamC:hostprocess-962bb55f-e028-4a34-a61a-f31375ac240e -servicesiC:s-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -lifetimeiC:d9f6ee51-226d-4f09-b045-acdd6c407144 (19 more)
Owner:	LOCAL SERVICE
Parent process:	svchost.exe (Host Process for Windows Services by Microsoft Corporation)

Threads