Should I block it?

No, this file is 100% safe to run.

Additional versions

5.0.9600.16384 (winblue_rtm.130821-1623)	3.68%
5.0.9600.16384 (winblue_rtm.130821-1623)	0.25%
5.0.9431.0 (winmain_bluemp.130615-1214)	0.20%
5.0.9431.0 (winmain_bluemp.130615-1214)	0.04%
5.0.9200.16384 (win8_rtm.120725-1247)	2.25%
5.0.9200.16384 (win8_rtm.120725-1247)	13.41%
5.0.8400.0 (winmain_win8rc.120518-1423)	0.08%
5.0.8400.0 (winmain_win8rc.120518-1423)	0.08%
5.0.8250.0 (winmain_win8beta.120217-1520)	0.04%
5.0.8102.0 (winmain_win8m3.110823-1455)	0.08%
5.0.7600.16385 (win7_rtm.090713-1255)	5.03%
5.0.7600.16385 (win7_rtm.090713-1255)	35.73%
5.0.7600.16385 (win7_rtm.090713-1255)	17.42%
5.0.7600.16385 (win7_rtm.090713-1255)	3.27%
5.0.7600.16385 (win7_rtm.090713-1255)	0.04%
5.0.7264.0 (win7_rtm.090622-1900)	0.04%
4.5.6002.18005 (lh_sp2rtm.090410-1830)	0.65%
4.5.6002.18005 (lh_sp2rtm.090410-1830)	0.12%
4.5.6001.22159 (vistasp1_ldr.080415-1732)	4.62%
4.5.6001.22159 (vistasp1_ldr.080415-1732)	0.04%
4.5.6001.22159 (vistasp1_ldr.080415-1732)	0.04%
4.5.6001.22159 (vistasp1_ldr.080415-1732)	0.12%
4.5.6001.22159 (vistasp1_ldr.080415-1732)	0.08%
4.5.6001.22159 (vistasp1_ldr.080415-1732)	0.12%
4.5.6001.22159 (vistasp1_ldr.080415-1732)	0.04%
View more
4.5.6001.22159 (vistasp1_ldr.080415-1732)	0.04%
4.5.6001.22159 (vistasp1_ldr.080415-1732)	0.04%
3.1.4001.5512	8.01%
3.1.4001.5512	0.12%
3.1.4001.5512	0.33%
3.1.4001.5512	0.08%
3.1.4001.5512	0.08%
3.1.4001.5512	0.04%
3.1.4001.5512	0.20%
3.1.4001.5512	0.04%
3.1.4001.5512	0.33%
3.1.4001.5512	0.08%
3.1.4001.5512	0.04%
3.1.4001.5512	0.20%
3.1.4001.5512	0.04%
3.1.4001.5512	0.04%
3.1.4001.5512	0.12%
3.1.4001.5512	0.04%
3.1.4001.5512	0.04%
3.1.4001.5512	0.04%
3.1.4001.5512	0.04%
3.1.4001.5512	0.04%
3.1.4001.5512	0.04%
3.1.4001.3311	0.04%
3.1.4001.3244	0.04%
3.1.4000.3959	0.08%
5 other versions

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

setup.exe (Windows Installer by Microsoft Corporation)

PE file structure

Show functions

Import table

advapi32.dll

RegOpenKeyExW, RegCreateKeyExW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, OpenThreadToken, FreeSid, GetLengthSid, AllocateAndInitializeSid, DeregisterEventSource, ReportEventW, RegisterEventSourceW, MakeSelfRelativeSD, GetSecurityDescriptorLength, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, GetAce, AddAccessAllowedAce, InitializeAcl, RegCloseKey, RegSetValueExW, RegDeleteKeyW, RegQueryValueExW, RegDeleteValueW, RegEnumKeyW, CloseServiceHandle, CreateServiceW, OpenSCManagerW, SetThreadToken, DeleteService, QueryServiceStatus, ControlService, OpenServiceW, RegEnumKeyExW, SetServiceStatus, RegisterServiceCtrlHandlerW, EqualSid, GetSecurityDescriptorOwner, RegGetKeySecurity, MakeAbsoluteSD, GetTokenInformation, RevertToSelf, StartServiceCtrlDispatcherW, TraceMessage

kernel32.dll

lstrlenW, lstrcmpiW, CloseHandle, InterlockedExchange, GetCurrentProcess, GetLastError, GetCurrentThread, Sleep, GetVersionExW, GetEnvironmentVariableW, InitializeCriticalSection, DeleteCriticalSection, GetProcAddress, LoadLibraryW, MultiByteToWideChar, WideCharToMultiByte, SetLastError, GlobalAlloc, GlobalFree, FreeLibrary, UnhandledExceptionFilter, GetVersion, GetModuleHandleW, WaitForSingleObject, CreateProcessW, GetModuleFileNameW, InterlockedDecrement, InterlockedIncrement, lstrcmpW, FormatMessageW, GetSystemDefaultLangID, LoadLibraryExW, SetCurrentDirectoryW, OutputDebugStringW, WriteFile, GetLocaleInfoW, GetACP, LeaveCriticalSection, EnterCriticalSection, OpenProcess, CreateEventW, OpenEventW, CompareStringW, GetFileType, GetStdHandle, GetCommandLineW, ExitProcess, SetEvent, SetConsoleCtrlHandler, CreateThread, GetSystemDirectoryW, GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, GetTickCount, QueryPerformanceCounter, GetModuleHandleA, TerminateProcess, SetUnhandledExceptionFilter, GetStartupInfoA, InterlockedCompareExchange, GetModuleHandleExW, DelayLoadFailureHook, LoadLibraryExA, CancelWaitableTimer

msvcrt.dll

DllMain

ntdll.dll

RtlNtStatusToDosError, RtlUnwind, NtQueryInformationProcess

ole32.dll

CoInitialize, CoRevokeClassObject, CoRegisterClassObject, StgOpenStorage, CoUninitialize

rpcrt4.dll

RpcRaiseException, RpcEpUnregister, RpcBindingVectorFree, RpcServerUnregisterIf, RpcServerUseProtseqW, RpcServerInqBindings, RpcServerRegisterIfEx, RpcEpRegisterW, NdrServerCall2

user32.dll

MsgWaitForMultipleObjects, IsCharAlphaNumericW, GetMessageW, PeekMessageW, DispatchMessageW, TranslateMessage, PostQuitMessage, PostThreadMessageW

msiexec.exe

Windows Installer - Unicode by Microsoft

Remove msiexec.exe

Version:	4.5.6002.18005 (lh_sp2rtm.090410-1830)
MD5:	c559672f31abe6ba7277dd73c4502238
SHA1:	92e3ecbbaf611b9a967f802732c25e27d462f5ab
SHA256:	dce701a4b6a824f5b71cc9be150a87d07b2b581cb06e5ad91cc5757c67386975

This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is msiexec.exe?

Microsoft Windows Installer is an installation and configuration service provided with Windows. The installer service enables customers to provide better corporate deployment and provides a standard format for component management. The installer also enables the advertisement of applications and features according to the operating system.

Overview

msiexec.exe runs as a service under the name Windows Installer -ohjelma (msiserver) with extensive SYSTEM privileges (full administrator access). It is installed in Internet Explorer as a Browser Helper Object (BHO) which has full acess to the web browser's behaviors and content. It is installed with a couple of know programs including Club Sentry Software published by Club Sentry Software, Club Sentry Software from Club Sentry Software and Club Sentry Software by Club Sentry Software. and is compiled as a 32 bit program.

Details

File name:	msiexec.exe
Publisher:	Microsoft Corporation
Product name:	Windows Installer - Unicode
Description:	Windows® installer
Typical file path:	C:\Windows\System32\msiexec.exe
Original name:	msiexec.exe.mui
File version:	4.5.6002.18005 (lh_sp2rtm.090410-1830)
Product version:	4.5.6002.18005
Size:	71.5 KB (73,216 bytes)
Digital DNA
PE subsystem:	Windows GUI
Entropy:	5.753598
File packed:	No
Code language:	Microsoft Visual C++
.NET CLR:	No

More details

Programs

The following programs will install this file

Club Sentry Software

6% remove

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

msiserver
'msiserver' (Windows Installer)

Scheduled tasks

The job '{AD1C092E-8BF9-4322-8B6D-869115BC67D2}' runs on registration in the path '\{AD1C092E-8BF9-4322-8B6D-869115BC67D2}'
The job '{EFAD775F-CDF7-4932-BC9F-7C11500B0E27}' runs on registration in the path '\{EFAD775F-CDF7-4932-BC9F-7C11500B0E27}'
The task '{AF16EC4C-C7D3-4650-BE4D-593A0E554F4A}' runs on registration in the path '\{AF16EC4C-C7D3-4650-BE4D-593A0E554F4A}'
The task '{2A68DB8E-C884-4452-862A-37F7C7E8C162}' runs on registration in the path '\{2A68DB8E-C884-4452-862A-37F7C7E8C162}'
The task '{47FC463B-9928-45D3-823C-B4D5F78A7363}' runs on registration in the path '\{47FC463B-9928-45D3-823C-B4D5F78A7363}'
The task '{FB16A2A3-DB26-4127-9711-C5E0BF071B10}' runs on registration in the path '\{FB16A2A3-DB26-4127-9711-C5E0BF071B10}'
The job '{E29801CF-E188-4C12-9343-76AFA0F16BEB}' runs on registration in the path '\{E29801CF-E188-4C12-9343-76AFA0F16BEB}'
The job '{1869EC6C-EE7B-4B66-B13A-A2FF8E7EBDD0}' runs on registration in the path '\{1869EC6C-EE7B-4B66-B13A-A2FF8E7EBDD0}'
The job '{AF8E4C1B-E35B-4C57-9A64-1CB2C21CFA46}' runs on registration in the path '\{AF8E4C1B-E35B-4C57-9A64-1CB2C21CFA46}'
The job '{C02B77F7-A5CC-4BBE-90BF-75B82251A853}' runs on registration in the path '\{C02B77F7-A5CC-4BBE-90BF-75B82251A853}'
The job '{161E942A-7077-4225-AAE1-3727163FBBBF}' runs on registration in the path '\{161E942A-7077-4225-AAE1-3727163FBBBF}'
The task '{603A289F-660C-4649-8820-58FD6E7AA78F}' runs on registration in the path '\{603A289F-660C-4649-8820-58FD6E7AA78F}'
Entry path '\{8C9E5B76-E78A-411A-B939-C6A034267770}'
Entry path '\{7F6FE1B4-CD5C-4EB3-BA3C-FA05AEE67CB6}'
Entry path '\{0E478F47-D66E-4DE5-8BE0-876334CD9EBD}'
Entry path '\{E673B621-598C-4A26-8A81-2A485793D284}'
Entry path '\{C19210A5-228E-4FEA-8C35-D871B9C4FB5F}'
Entry path '\{9A26DFD9-8384-4F4C-B4E8-58F5A8829AFB}'
Entry path '\{5AA35628-621C-4869-8C3F-FDDA0E1007B1}'
Entry path '\{36EF27E1-070B-4449-BB00-BFD5F2EC510B}'
Entry path '\{1DCAC8D1-9B4D-4FF8-ABA2-CFD2CD44EEB3}'
Entry path '\{E7F58D98-807C-426A-8F92-2766A35F2221}'

Internet Explorer Browser Helper Object

Located in the registry at 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects'

BHO CLSID: {127AD70F-B2B7-4f6a-ACD9-C7B1FE48C8C0}

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.12782047%	0.028634%
Kernel CPU:	0.05387140%	0.013761%
User CPU:	0.07394906%	0.014873%
Kernel CPU time:	3,086 ms/min	100,923,805ms/min
CPU cycles:	14,750,334/sec	17,470,203/sec
Memory
Private memory:	6.78 MB	21.59 MB
Private (maximum):	16.28 MB
Private (minimum):	11.63 MB
Non-paged memory:	6.78 MB	21.59 MB
Virtual memory:	74.54 MB	140.96 MB
Virtual memory (peak):	85.6 MB	169.69 MB
Working set:	13.34 MB	18.61 MB
Working set (peak):	17.27 MB	37.95 MB
Page faults:	15,300/min	2,039/min
I/O
I/O read transfer:	593.26 KB/sec	1.02 MB/min
I/O read operations:	111/sec	343/min
I/O write transfer:	1.24 MB/sec	274.99 KB/min
I/O write operations:	1,593/sec	227/min
I/O other transfer:	328.11 KB/sec	448.09 KB/min
I/O other operations:	13,306/sec	1,671/min
Resource allocations
Threads:	4	12
Handles:	158	600

Process properties

Integrety level:	System
Platform:	32-bit
Command line:	C:\Windows\System32\msiexec /v
Owner:	SYSTEM
Windows Service
Service name:	msiserver
Display name:	Windows Installer -ohjelma
Description:	“Lisää, muokkaa tai poistaa Windows Installer- tai APPX-pakettina (.msi, .msp ja *.appx) tarjottuja sovelluksia. Jos tämä palvelu poistetaan käytöstä, siitä suoraan riippuvaiset palvelut eivät käynnisty.”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads