While it can also be malware's doing, it can be a simple bug. In other cases, users are facing an issue with the process, as it prevents them from opening regular files, such as pictures or video clips. Besides, information tracking by recording keystrokes or taking screenshots is likely as well. It can be hijacked, replaced, or corrupted by malware, which can render the computer vulnerable to other severe infections and also compromise its operation by slowing down and crashing installed software. Nevertheless, TrustedInstaller, or TrustedInstaller.exe, is often abused by cybercriminals due to its functionality. For that reason, users cannot delete or modify certain files, even with Administrator's rights. It runs under Windows Module Installer service, which is responsible for protecting unauthorized changes being made to. TrustedInstaller is a legitimate Windows process and is a part of Windows Resource Protection (WRP) technology. However, malware can corrupt, damage, or replace the file.

TrustedInstaller is a built-in user account that regulates permissions. What is TrustedInstaller? TrustedInstaller is original Windows process, but is often abused by malware

How to disable windows installer