home

mscorsvw.exe

Microsoft .NET Framework

Microsoft Corporation

The .NET Runtime Optimization Service is distributed with version 4.0 of the .NET Framework This assembly is part of version 4.0 of the .NET Framework and was updated as a general distribution release (GDR) delivered via Windows Update. It runs as a separate (within the context of its own process) windows Service named “Microsoft .NET Framework NGEN v4.0.30319_X86”.
Publisher:
Microsoft Corporation  (signed and verified)

Product:
Microsoft® .NET Framework

Description:
.NET Runtime Optimization Service

Version:
4.0.30319.34209 built by: FX452RTMGDR

MD5:
7795902d1b026e0297ffb8c24897dc3c

SHA-1:
8e9a58dc491a9e81753838b9df05a3135ee3aee9

SHA-256:
533c9115b518882aa48403c27e7942c5eb5d1ce044ca7b5c93e8a2c5bef3ba11

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
4/19/2024 8:21:30 PM UTC  (today)

File size:
101.2 KB (103,608 bytes)

Product version:
4.0.30319.34209

Copyright:
© Microsoft Corporation. All rights reserved.

Original file name:
mscorsvw.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe

Digital Signature
Signed by:
Microsoft Corporation

Authority:
Microsoft Corporation

Valid from:
3/20/2013 9:05:36 AM

Valid to:
6/20/2014 8:05:36 AM

Subject:
CN=Microsoft Dynamic Code Publisher, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
33000000BCFC339E48FC01F8A40001000000BC

File PE Metadata
Compilation timestamp:
4/12/2014 11:18:55 AM

OS version:
6.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
768:fgiP0mTdEPI0k23O/FUBlo4k4K/z9SPPvpuIScD97tIKK++bCBwS0UWrhyric6pu:3LRE9q/2BgJSXvDNDj/McUrsrxN

Entry address:
0x2703

Entry point:
E8, F8, E8, FF, FF, 6A, 14, 68, 28, 28, 40, 00, E8, F2, FA, FF, FF, 33, F6, 89, 75, E4, 89, 75, E0, FF, 15, B4, 51, 41, 00, 0F, B7, D8, 89, 75, FC, 64, A1, 18, 00, 00, 00, 8B, 50, 04, 8B, FE, BE, E8, 40, 41, 00, 8B, CA, 33, C0, F0, 0F, B1, 0E, 85, C0, 0F, 85, 3A, 15, 00, 00, 33, F6, 46, 39, 35, EC, 40, 41, 00, 0F, 84, 3D, 15, 00, 00, 83, 3D, EC, 40, 41, 00, 00, 0F, 85, EA, 00, 00, 00, 89, 35, EC, 40, 41, 00, 68, 24, 28, 40, 00, 68, 10, 28, 40, 00, E8, C3, E8, FF, FF, 59, 59, 85, C0, 0F, 85, 1E, 15, 00, 00...
 
[+]

Entropy:
4.7217

Code size:
73 KB (74,752 bytes)

Service
Display name:
Microsoft .NET Framework NGEN v4.0.30319_X86

Service name:
clr_optimization_v4.0.30319_32

Description:
Microsoft .NET Framework NGEN

Type:
Win32OwnProcess


herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.