Should I block it?

No, this file is 100% safe to run.

Additional versions

6.3.9600.16384 (winblue_rtm.130821-1623)	4.94%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.16%
6.2.9200.16384 (win8_rtm.120725-1247)	15.38%
6.2.8400.0 (winmain_win8rc.120518-1423)	0.16%
6.1.7601.17514 (win7sp1_rtm.101119-1850)	44.53%
6.1.7601.17514 (win7sp1_rtm.101119-1850)	15.47%
6.1.7600.16385 (win7_rtm.090713-1255)	4.13%
6.1.7600.16385 (win7_rtm.090713-1255)	0.08%
6.1.7600.16385 (win7_rtm.090713-1255)	3.32%
6.0.6002.18005 (lh_sp2rtm.090410-1830)	1.86%
6.0.6002.18005 (lh_sp2rtm.090410-1830)	8.58%
6.0.6001.18094 (vistasp1_gdr.080618-1506)	0.73%
6.0.6000.16705 (vista_gdr.080618-1506)	0.65%

PE file structure

Show functions

Import table

advapi32.dll

RegisterServiceCtrlHandlerExW, RegCreateKeyExW, RegSetValueExW, RegDeleteValueW, RegEnumKeyExW, RegDeleteKeyW, RegOpenKeyExW, EventWrite, SetServiceStatus, EventRegister, EventUnregister, UnregisterTraceGuids, RegisterTraceGuidsW, GetTraceLoggerHandle, GetTraceEnableLevel, GetTraceEnableFlags, RegOpenKeyW, RegQueryValueExW, RegCloseKey, AllocateAndInitializeSid, FreeSid, InitializeSecurityDescriptor, SetSecurityDescriptorOwner, SetSecurityDescriptorGroup, GetLengthSid, InitializeAcl, AddAccessAllowedAce, AddAccessDeniedAce, GetAce, SetSecurityDescriptorDacl, GetSecurityDescriptorLength, MakeSelfRelativeSD, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, TraceMessage

authz.dll

AuthzAccessCheck, AuthziInitializeAuditParams, AuthziFreeAuditEventType, AuthziInitializeAuditEvent, AuthziLogAuditEvent, AuthzFreeAuditEvent, AuthziInitializeAuditEventType

crypt32.dll

CertStrToNameW

firewallapi.dll

FWChangeNotificationDestroy, FwIsRemoteManagementEnabled, FWChangeNotificationCreate

fwpuclnt.dll

IPsecGetStatistics0, FwpmEngineClose0, IkeextGetConfigParameters0, IkeextSetConfigParameters0, FwpmEngineOpen0, IkeextGetStatistics0, IkeextSaDestroyEnumHandle0, FwpmFreeMemory0, IkeextSaEnum0, IkeextSaCreateEnumHandle0, IPsecSaDestroyEnumHandle0, IPsecSaEnum0, IPsecSaCreateEnumHandle0, IkeextSaDeleteById0, FwpmIPsecTunnelAdd0, IPsecSaContextDeleteById0, IPsecSaContextEnum0, IPsecSaContextCreateEnumHandle0, FwpmTransactionAbort0, FwpmProviderAdd0, FwpmTransactionBegin0, FwpmTransactionCommit0, FwpmProviderContextAdd0, FwpmProviderContextDeleteByKey0, FwpmFilterAdd0, FwpmFilterDeleteByKey0, FwpmIPsecTunnelDeleteByKey0

fwremotesvr.dll

FwRpcAPIsInitialize, FwRpcAPIsShutdown

iphlpapi.dll

NhGetInterfaceNameFromGuid, GetAdaptersAddresses

kernel32.dll

SetHandleInformation, CreateEventW, InitializeCriticalSectionAndSpinCount, GetModuleHandleW, GetCurrentProcess, GetLastError, CloseHandle, FormatMessageW, LocalFree, LeaveCriticalSection, EnterCriticalSection, ResetEvent, SetEvent, GetTickCount, InterlockedExchange, Sleep, WaitForMultipleObjects, QueryPerformanceCounter, DeleteCriticalSection, GetProcAddress, FreeLibrary, InterlockedCompareExchange, DelayLoadFailureHook, InterlockedIncrement, HeapAlloc, GetProcessHeap, HeapFree, InterlockedDecrement, WideCharToMultiByte, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, LoadLibraryA

msvcrt.dll

DllMain

rpcrt4.dll

UuidCreate, RpcRevertToSelf, RpcImpersonateClient, UuidIsNil, RpcServerInqDefaultPrincNameW, RpcServerRegisterAuthInfoW, RpcServerUseProtseqW, RpcServerRegisterIfEx, RpcServerInqBindings, NdrServerCall2, RpcGetAuthorizationContextForClient, RpcFreeAuthorizationContext, RpcStringFreeW, RpcBindingInqAuthClientW, RpcEpRegisterW, RpcServerUnregisterIfEx, RpcStringBindingParseW, RpcBindingToStringBindingW, I_RpcBindingIsClientLocal, RpcBindingVectorFree, RpcEpUnregister

userenv.dll

GetGPOListW, RefreshPolicy, FreeGPOListW

ws2_32.dll

WSASocketW, WSACreateEvent, WSAIoctl, WSAEventSelect, WSAResetEvent, WSACloseEvent

ipsecsvc.dll

Windows IPsec SPD Server DLL by Microsoft

Remove ipsecsvc.dll

Version:	6.0.6002.18005 (lh_sp2rtm.090410-1830)
MD5:	d0494460421a03cd5225cca0059aa146
SHA1:	5c524d5a7557b7ce2f3b98844340a5a222481527
SHA256:	fc30e90522c63f2a66d89381705712d2cdf07b2e029df40c2debb2353e763e90

This is a Windows system installed file with Windows File Protection (WFP) enabled.

Overview

ipsecsvc.dll is loaded as dynamic link library that runs in the context of a process. The assembly utilizes the .NET run-time framework (which is required to be installed on the PC). .

Details

File name:	ipsecsvc.dll
Publisher:	Microsoft Corporation
Product name:	Windows IPsec SPD Server DLL
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\ipsecsvc.dll
File version:	6.0.6002.18005 (lh_sp2rtm.090410-1830)
Product version:	6.0.6002.18005
Size:	355.5 KB (364,032 bytes)
Digital DNA
PE subsystem:	Windows Console
File packed:	No
Code language:	Microsoft Visual C# / Basic .NET
.NET CLR:	Yes
.NET NGENed:	No