This is expected behaviour. When you install an MSI package, Windows caches a copy of the installer in
"%windir%\installer" (a hidden system folder) and renames it using a random hex name. You can delve into the Windows registry to divine the mapping between original installer and the cached version, but if you'd like extra assurance it is probably easier (and more definitive) to compare the two
Aside from the filename, the cached
.msi file should be the same as the original
.msi: you could compare details like file size, signing information, and checksums. In your screenshot, the verified publisher is "MongoDB, Inc".
You can confirm the install behaviour using:
msiexec.exe /i <path_to_MSI> /lfvmous output.txt
MSI (s) (14:A8) [14:00:05:398]: Original package ==> C:\Users\User\Desktop\mongodb-win32-x86_64-2008plus-ssl-3.4.13-signed.msi
MSI (s) (14:A8) [14:00:05:398]: Package we're running from ==> C:\WINDOWS\Installer\2c8ddfd2.msi
For some related information, see: Where the MSI file is copied after the installation?.