Should I block it?

No, this file is 100% safe to run.

Additional versions

6.3.9600.16384 (winblue_rtm.130821-1623)	4.87%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.16%
6.2.9200.16384 (win8_rtm.120725-1247)	15.16%
6.2.9200.16384 (win8_rtm.120725-1247)	1.36%
6.2.8400.0 (winmain_win8rc.120518-1423)	0.16%
6.2.8400.0 (winmain_win8rc.120518-1423)	0.08%
6.1.7601.17514 (win7sp1_rtm.101119-1850)	43.89%
6.1.7601.17514 (win7sp1_rtm.101119-1850)	15.24%
6.1.7600.16385 (win7_rtm.090713-1255)	4.07%
6.1.7600.16385 (win7_rtm.090713-1255)	0.08%
6.1.7600.16385 (win7_rtm.090713-1255)	3.27%
6.0.6002.18005 (lh_sp2rtm.090410-1830)	1.84%
6.0.6002.18005 (lh_sp2rtm.090410-1830)	8.46%
6.0.6001.18094 (vistasp1_gdr.080618-1506)	0.72%
6.0.6000.16705 (vista_gdr.080618-1506)	0.64%

PE file structure

Show functions

Import table

advapi32.dll

RegisterServiceCtrlHandlerExW, RegCreateKeyExW, RegSetValueExW, RegDeleteValueW, RegEnumKeyExW, RegDeleteKeyW, RegOpenKeyExW, EventWrite, SetServiceStatus, EventRegister, EventUnregister, UnregisterTraceGuids, RegisterTraceGuidsW, GetTraceLoggerHandle, GetTraceEnableLevel, GetTraceEnableFlags, RegOpenKeyW, RegQueryValueExW, RegCloseKey, AllocateAndInitializeSid, FreeSid, InitializeSecurityDescriptor, SetSecurityDescriptorOwner, SetSecurityDescriptorGroup, GetLengthSid, InitializeAcl, AddAccessAllowedAce, AddAccessDeniedAce, GetAce, SetSecurityDescriptorDacl, GetSecurityDescriptorLength, MakeSelfRelativeSD, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, TraceMessage

authz.dll

AuthzAccessCheck, AuthziInitializeAuditParams, AuthziFreeAuditEventType, AuthziInitializeAuditEvent, AuthziLogAuditEvent, AuthzFreeAuditEvent, AuthziInitializeAuditEventType

crypt32.dll

CertStrToNameW

firewallapi.dll

FWChangeNotificationDestroy, FwIsRemoteManagementEnabled, FWChangeNotificationCreate

fwpuclnt.dll

IPsecGetStatistics0, FwpmEngineClose0, IkeextGetConfigParameters0, IkeextSetConfigParameters0, FwpmEngineOpen0, IkeextGetStatistics0, IkeextSaDestroyEnumHandle0, FwpmFreeMemory0, IkeextSaEnum0, IkeextSaCreateEnumHandle0, IPsecSaDestroyEnumHandle0, IPsecSaEnum0, IPsecSaCreateEnumHandle0, IkeextSaDeleteById0, FwpmIPsecTunnelAdd0, IPsecSaContextDeleteById0, IPsecSaContextEnum0, IPsecSaContextCreateEnumHandle0, FwpmTransactionAbort0, FwpmProviderAdd0, FwpmTransactionBegin0, FwpmTransactionCommit0, FwpmProviderContextAdd0, FwpmProviderContextDeleteByKey0, FwpmFilterAdd0, FwpmFilterDeleteByKey0, FwpmIPsecTunnelDeleteByKey0

fwremotesvr.dll

FwRpcAPIsInitialize, FwRpcAPIsShutdown

iphlpapi.dll

NhGetInterfaceNameFromGuid, GetAdaptersAddresses

kernel32.dll

SetHandleInformation, CreateEventW, InitializeCriticalSectionAndSpinCount, GetModuleHandleW, GetCurrentProcess, GetLastError, CloseHandle, FormatMessageW, LocalFree, LeaveCriticalSection, EnterCriticalSection, ResetEvent, SetEvent, GetTickCount, InterlockedExchange, Sleep, WaitForMultipleObjects, QueryPerformanceCounter, DeleteCriticalSection, GetProcAddress, FreeLibrary, InterlockedCompareExchange, DelayLoadFailureHook, InterlockedIncrement, HeapAlloc, GetProcessHeap, HeapFree, InterlockedDecrement, WideCharToMultiByte, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, LoadLibraryA

msvcrt.dll

DllMain

rpcrt4.dll

UuidCreate, RpcRevertToSelf, RpcImpersonateClient, UuidIsNil, RpcServerInqDefaultPrincNameW, RpcServerRegisterAuthInfoW, RpcServerUseProtseqW, RpcServerRegisterIfEx, RpcServerInqBindings, NdrServerCall2, RpcGetAuthorizationContextForClient, RpcFreeAuthorizationContext, RpcStringFreeW, RpcBindingInqAuthClientW, RpcEpRegisterW, RpcServerUnregisterIfEx, RpcStringBindingParseW, RpcBindingToStringBindingW, I_RpcBindingIsClientLocal, RpcBindingVectorFree, RpcEpUnregister

userenv.dll

GetGPOListW, RefreshPolicy, FreeGPOListW

ws2_32.dll

WSASocketW, WSACreateEvent, WSAIoctl, WSAEventSelect, WSAResetEvent, WSACloseEvent

ipsecsvc.dll

Windows IPsec SPD Server DLL by Microsoft

Remove ipsecsvc.dll

Version:	6.0.6002.18005 (lh_sp2rtm.090410-1830)
MD5:	89a5560671c2d8b4a4b51f3e1aa069d8
SHA1:	0c777b5106b742b838dfb0aae66827bcf02137d4
SHA256:	07dee5d73dde09f954e2e13bb5603f0033829b6199c81a7c1709d94ab92b351e

This is a Windows system installed file with Windows File Protection (WFP) enabled.

Overview

ipsecsvc.dll is loaded as dynamic link library that runs in the context of a process. The assembly utilizes the .NET run-time framework (which is required to be installed on the PC). .

Details

File name:	ipsecsvc.dll
Publisher:	Microsoft Corporation
Product name:	Windows IPsec SPD Server DLL
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\ipsecsvc.dll
File version:	6.0.6002.18005 (lh_sp2rtm.090410-1830)
Product version:	6.0.6002.18005
Size:	521 KB (533,504 bytes)
Digital DNA
PE subsystem:	Windows Console
File packed:	No
Code language:	Microsoft Visual C# / Basic .NET
.NET CLR:	Yes
.NET NGENed:	No