home

mscoree.dll

Microsoft .NET Framework

Microsoft Corporation

Publisher:
Microsoft Corporation  (signed and verified)

Product:
Microsoft® .NET Framework

Description:
Microsoft .NET Runtime Execution Engine

 
Part of the Windows Operating System

Version:
4.0.40305.0 (Main.040305-0000)

MD5:
a08c010d859f8eb42bdd7e1d55b8ca27

SHA-1:
120d2f9208937f6cac9528813b5b470ba89ace3b

SHA-256:
f86eafbf7aa41d8425156c07398edc3bd42f1690bd3e15d27aef2eda86549f15

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
4/18/2024 11:57:58 PM UTC  (a few moments ago)

File size:
434.3 KB (444,752 bytes)

Product version:
4.0.40305.0

Copyright:
© Microsoft Corporation. All rights reserved.

Original file name:
mscoree.dll

File type:
Dynamic link library (Win64 DLL)

Language:
English (United States)

Common path:
C:\Windows\System32\mscoree.dll

Digital Signature
Signed by:
Microsoft Corporation

Authority:
Microsoft Corporation

Valid from:
12/7/2009 5:40:29 PM

Valid to:
3/7/2011 5:40:29 PM

Subject:
CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
6101CF3E00000000000F

Registration
CLSIDs:
{010911E2-F61C-479B-B08C-43E6D1299EFE}, {047a9a40-657e-11d3-8d5b-00104b35e7ef}, {07C0A9A9-6308-4C15-B818-225D4F3FBF48}, {1A056BDB-8B45-462f-8D85-CAC6BDCD2A31}, {1B76DD18-2CB4-41A4-BD69-5FB8287F7814}, {1D2680C9-0E2A-469d-B787-065558BC7D43}

ProgIDs:
ComPlusDebug.CorpubPublish.1, Microsoft.MediaCenter.GlidHost.GLIDLoader, Microsoft.MediaCenter.GlidHost.ScanConfig, Microsoft.MediaCenter.Internal.LaunchMediaCenter, CLRMetaData.CorMetaDataDispenserRuntime.2, VsaVbRT.7.1, IRService.IRServiceManager, service

COM registered:
Yes

File PE Metadata
Compilation timestamp:
3/4/2010 10:05:11 PM

OS version:
5.0

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
9.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
12288:dnld65l/E9xFAeWSan0c2TpEZU1nMT5a9c4/s:dld6XERBcn0c2TaZU1nMT5a9c4U

Entry address:
0x1134

Entry point:
48, 89, 5C, 24, 08, 48, 89, 74, 24, 10, 57, 48, 83, EC, 20, 49, 8B, F8, 8B, DA, 48, 8B, F1, 83, FA, 01, 0F, 84, 3B, 56, 00, 00, 4C, 8B, C7, 8B, D3, 48, 8B, CE, 48, 8B, 5C, 24, 30, 48, 8B, 74, 24, 38, 48, 83, C4, 20, 5F, EB, 03, 90, 90, 90, 48, 89, 5C, 24, 08, 48, 89, 74, 24, 10, 48, 89, 7C, 24, 18, 41, 54, 48, 83, EC, 30, 49, 8B, F0, 8B, DA, 4C, 8B, E1, B8, 01, 00, 00, 00, 85, D2, 0F, 84, DE, AF, 00, 00, 83, FA, 01, 74, 05, 83, FA, 02, 75, 29, 4C, 8B, 0D, 35, 81, 04, 00, 4D, 85, C9, 0F, 85, 58, 02, 01, 00...
 
[+]

Entropy:
6.1969

Code size:
280.5 KB (287,232 bytes)

Internet Explorer Bar
Display name:
HKEY_LOCAL_MACHINE

CLSID:
{09F5D5A0-7D28-49E2-B238-A9353829CF64}

CLSID name:
Web Recorder

Registry hive:
HKEY_LOCAL_MACHINE

Registry path:
SOFTWARE\Microsoft\Internet Explorer\Explorer Bars


herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.