Should I block it?

No, this file is 100% safe to run.

Additional versions

2001.12.9330.0 (winmain_win8rc.120518-1423)	0.08%
2001.12.9330.0 (winmain_win8rc.120518-1423)	0.08%
2001.12.9180.0 (winmain_win8beta.120217-1520)	0.04%
2001.12.9032.0 (winmain_win8m3.110823-1455)	0.08%
2001.12.8530.16385 (win7_rtm.090713-1255)	20.77%
2001.12.8530.16385 (win7_rtm.090713-1255)	36.77%
2001.12.8530.16385 (win7_rtm.090713-1255)	0.04%
2001.12.6930.16386 (vista_rtm.061101-2205)	5.58%
2001.12.6930.16386 (vista_rtm.061101-2205)	1.22%
2001.12.6930.16386 (vista_rtm.061101-2205)	0.37%
2001.12.4720.4340 (srv03_sp2_gdr.080723-1210)	0.04%
2001.12.4720.4340 (srv03_sp2_gdr.080723-1210)	0.04%
2001.12.4720.3959 (srv03_sp2_rtm.070216-1710)	0.04%
2001.12.4414.700	10.22%
2001.12.4414.700	0.33%
2001.12.4414.700	0.29%
2001.12.4414.700	0.41%
2001.12.4414.700	0.12%
2001.12.4414.700	0.45%
2001.12.4414.700	0.04%
2001.12.4414.700	0.08%
2001.12.4414.700	0.04%
2001.12.4414.700	0.04%
2001.12.4414.700	0.04%
2001.12.4414.700	0.04%
View more
2001.12.4414.700	0.04%
2001.12.4414.700	0.33%
2001.12.4414.700	0.04%
2001.12.4414.700	0.12%
2001.12.4414.700	0.04%
2001.12.4414.700	0.16%
2001.12.4414.700	0.24%
2001.12.4414.700	0.04%
2001.12.4414.700	0.24%
2001.12.4414.700	0.08%
2001.12.4414.700	0.04%
2001.12.4414.700	0.04%
2001.12.4414.700	0.08%
2001.12.4414.700	0.04%
2001.12.4414.700	0.08%
2001.12.4414.700	0.04%
2001.12.4414.700	0.08%
2001.12.4414.700	0.04%
2001.12.4414.700	0.04%
2001.12.4414.700	0.04%
2001.12.4414.700	0.04%
2001.12.4414.700	0.04%
2001.12.4414.700	0.04%
2001.12.4414.258	2.12%
2001.12.4414.258	0.04%
2001.12.4414.258	0.08%
13 other versions

Relationships

services.exe (Services and Controller app by Microsoft)

PE file structure

Show functions

Import table

advapi32.dll

RegSetValueExW, RegQueryValueExW, OpenProcessToken, GetTokenInformation, RegisterEventSourceW, ReportEventW, DeregisterEventSource, RegCloseKey, RegOpenKeyExA, RegQueryValueExA, RegOpenKeyExW

api-ms-win-core-com-l1-1-0.dll

CoInitializeEx, CoUninitialize, CoCreateInstance, StringFromGUID2, CoGetObjectContext

api-ms-win-core-debug-l1-1-1.dll

IsDebuggerPresent, DebugBreak, OutputDebugStringW

api-ms-win-core-delayload-l1-1-1.dll

DelayLoadFailureHook, ResolveDelayLoadedAPI

api-ms-win-core-errorhandling-l1-1-1.dll

GetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter

api-ms-win-core-file-l1-2-0.dll

DeleteFileW, SetFileAttributesW, FindNextFileW, GetFullPathNameW, FindFirstFileW, CreateFileW, CreateDirectoryW, FindClose

api-ms-win-core-handle-l1-1-0.dll

CloseHandle

api-ms-win-core-heap-obsolete-l1-1-0.dll

LocalAlloc, LocalFree

api-ms-win-core-interlocked-l1-2-0.dll

InterlockedCompareExchange, InterlockedExchange

api-ms-win-core-libraryloader-l1-1-1.dll

FreeLibrary, LoadStringW, GetModuleFileNameW, LockResource, GetModuleHandleA, FindResourceExW, GetProcAddress, GetModuleHandleW, LoadLibraryExW, LoadResource

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW

api-ms-win-core-processenvironment-l1-2-0.dll

GetCommandLineW, ExpandEnvironmentStringsW

api-ms-win-core-processthreads-l1-1-1.dll

GetCurrentThread, TlsFree, TlsGetValue, CreateProcessW, TlsAlloc, GetStartupInfoW, TerminateProcess, GetCurrentProcess, GetExitCodeProcess, GetCurrentThreadId, OpenProcessToken, GetThreadContext, GetCurrentProcessId

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter

api-ms-win-core-psapi-l1-1-0.dll

QueryFullProcessImageNameW

api-ms-win-core-registry-l1-1-0.dll

RegSetValueExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA, RegOpenKeyExW, RegCloseKey

api-ms-win-core-synch-l1-2-0.dll

LeaveCriticalSection, CreateEventA, InitializeCriticalSectionAndSpinCount, ResetEvent, WaitForSingleObjectEx, SetEvent, DeleteCriticalSection, EnterCriticalSection, WaitForSingleObject, Sleep

api-ms-win-core-sysinfo-l1-2-0.dll

GetTickCount, GetLocalTime, GetSystemWindowsDirectoryA, GetSystemTimeAsFileTime

api-ms-win-core-version-l1-1-0.dll

VerQueryValueW

api-ms-win-security-base-l1-2-0.dll

GetTokenInformation

kernel32.dll

GetCommandLineW, UnregisterWait, TlsFree, TlsAlloc, TlsGetValue, LocalAlloc, LocalFree, IsDebuggerPresent, GetCurrentThread, GetThreadContext, DebugBreak, ExpandEnvironmentStringsW, CreateDirectoryW, CreateProcessW, GetExitCodeProcess, FindFirstFileW, FindNextFileW, SetFileAttributesW, DeleteFileW, FindClose, GetModuleHandleW, FindResourceW, LoadResource, LockResource, FormatMessageW, GetModuleFileNameW, LoadLibraryExW, DeleteCriticalSection, WaitForSingleObject, LeaveCriticalSection, EnterCriticalSection, InterlockedExchange, Sleep, InterlockedCompareExchange, GetStartupInfoW, SetUnhandledExceptionFilter, GetModuleHandleA, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, CreateEventA, CloseHandle, WaitForSingleObjectEx, SetEvent, ResetEvent, FreeLibrary, CreateFileW, GetProcAddress, LoadLibraryA, GetFullPathNameW, GetLastError, QueryFullProcessImageNameW, GetLocalTime, QueueUserWorkItem, OutputDebugStringW, GetSystemWindowsDirectoryA, InitializeCriticalSectionAndSpinCount, UnregisterWaitEx

msvcrt.dll

DllMain

ntdll.dll

RtlCaptureContext, RtlReportException

ole32.dll

CoGetObjectContext, StringFromGUID2, CoInitializeEx, CoCreateInstance, CoUninitialize

user32.dll

EndDialog, SetDlgItemTextW, CloseWindowStation, CloseDesktop, GetProcessWindowStation, GetThreadDesktop, OpenWindowStationW, DialogBoxParamW, OpenDesktopW, SetThreadDesktop, GetDesktopWindow, GetWindowRect, GetClientRect, MapWindowPoints, SetWindowPos, LoadStringW, SetProcessWindowStation

version.dll

VerQueryValueW

msdtc.exe

Microsoft Distributed Transaction Coordinator Service by Microsoft

Remove msdtc.exe

Version:	2001.12.8530.16385 (win7_rtm.090713-1255)
MD5:	e1bce74a3bd9902b72599c0192a07e27
SHA1:	012ae8943e8428dcbbdb6dbb3542e0524debf411
SHA256:	5162eb623fe64e9dfeac6ca2410efa1314e62ec13207ffbfed2d61aa887603c4

This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is msdtc.exe?

The Distributed Transaction Coordinator (MSDTC) service is a component of modern versions of Microsoft Windows that is responsible for coordinating transactions that span multiple resource managers, such as databases, message queues, and file systems.

Overview

msdtc.exe runs as a service under the name Coordenador de transações distribuídas (MSDTC) with minimal NETWORK SERVICE privileges on the local PC and acts as the computer on the network. This version is designed to run on Windows 7 and is compiled as a 32 bit program.

Details

File name:	msdtc.exe
Publisher:	Microsoft Corporation
Product name:	Microsoft Distributed Transaction Coordinator Service
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\msdtc.exe
Original name:	MSDTC.EXE.MUI
File version:	2001.12.8530.16385 (win7_rtm.090713-1255)
Product version:	6.1.7600.16385
Size:	131 KB (134,144 bytes)
Digital DNA
PE subsystem:	Windows GUI
Entropy:	6.060933
File packed:	No
Code language:	Microsoft Visual C++
.NET CLR:	No

More details

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'MSDTC' (Coordenador de transações distribuídas)
MSDTC
'MSDTC' (Distributed Transaction Coordinator)

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00209134%	0.028634%
Kernel CPU:	0.00160635%	0.013761%
User CPU:	0.00048499%	0.014873%
Kernel CPU time:	180 ms/min	100,923,805ms/min
CPU cycles:	27,498/sec	17,470,203/sec
Memory
Private memory:	2.81 MB	21.59 MB
Private (maximum):	4.83 MB
Private (minimum):	3.2 MB
Non-paged memory:	2.81 MB	21.59 MB
Virtual memory:	42.97 MB	140.96 MB
Virtual memory (peak):	43.66 MB	169.69 MB
Working set:	3.36 MB	18.61 MB
Working set (peak):	6.55 MB	37.95 MB
Page faults:	3,460/min	2,039/min
I/O
I/O read transfer:	60 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	674 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	2 Bytes/sec	448.09 KB/min
I/O other operations:	1/sec	1,671/min
Resource allocations
Threads:	12	12
Handles:	160	600

Process properties

Integrety level:	System
Platform:	32-bit
Command line:	C:\Windows\System32\msdtc.exe
Owner:	NETWORK SERVICE
Windows Service
Service name:	MSDTC
Display name:	Coordenador de transações distribuídas
Description:	“Coordena as transações que incluem vários gerenciadores de recursos, como bancos de dados, filas de mensagens e sistemas de arquivos. Se esse serviço for interrompido, essas transações falharão. Se o serviço for desabilitado, os serviços que dependerem explicitamente dele não serão inicializados.”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads