home

mscorsvw.exe

Microsoft .NET Framework

Microsoft Corporation

The .NET Runtime Optimization Service is distributed with version 4.0 of the .NET Framework This assembly is part of version 4.0 of the .NET Framework . It runs as a separate (within the context of its own process) windows Service named “Microsoft .NET Framework NGEN v4.0.30319_X64”.
Publisher:
Microsoft Corporation  (signed and verified)

Product:
Microsoft® .NET Framework

Description:
.NET Runtime Optimization Service

Version:
4.0.30319.17929 built by: FX45RTMREL

MD5:
86329c35ff23cfef0fb6c0023ba06bce

SHA-1:
e3529cca09dd0e6c1d44a5bbe310074b6d53bd94

SHA-256:
d915ce7ad564f97a1c3b047d5248b7ef67addc59687fbc90f1776c21daa0d3fd

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
4/25/2024 3:21:51 AM UTC  (today)

File size:
121 KB (123,856 bytes)

Product version:
4.0.30319.17929

Copyright:
© Microsoft Corporation. All rights reserved.

Original file name:
mscorsvw.exe

File type:
Executable application (Win64 EXE)

Language:
English (United States)

Common path:
C:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe

Digital Signature
Signed by:
Microsoft Corporation

Authority:
Microsoft Corporation

Valid from:
1/23/2012 6:17:22 PM

Valid to:
4/23/2013 7:17:22 PM

Subject:
CN=Microsoft Dynamic Code Publisher, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
6105573300010000006E

File PE Metadata
Compilation timestamp:
7/9/2012 12:00:58 AM

OS version:
6.0

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
3072:768LxosfaaK1x5JTiwOhkOzOgrMlejPzX16:BxGDxJTiwEOcrI

Entry address:
0x2420

Entry point:
48, 83, EC, 28, E8, 1F, F8, FF, FF, 48, 83, C4, 28, EB, 01, 90, 48, 89, 5C, 24, 08, 48, 89, 74, 24, 10, 57, 48, 83, EC, 30, 83, 64, 24, 20, 00, E8, F7, F7, FF, FF, 0F, B7, F0, 65, 48, 8B, 0C, 25, 30, 00, 00, 00, 48, 8B, 51, 08, 33, DB, 33, C0, F0, 48, 0F, B1, 15, D2, 7D, 01, 00, 0F, 85, D8, 16, 00, 00, 8B, 05, CE, 7D, 01, 00, 83, F8, 01, 0F, 84, DD, 16, 00, 00, 8B, 05, BF, 7D, 01, 00, 85, C0, 0F, 85, E6, 16, 00, 00, C7, 05, AD, 7D, 01, 00, 01, 00, 00, 00, 48, 8D, 15, 36, E1, 00, 00, 48, 8D, 0D, 0F, E1, 00...
 
[+]

Entropy:
6.1710

Code size:
59.5 KB (60,928 bytes)

Service
Display name:
Microsoft .NET Framework NGEN v4.0.30319_X64

Service name:
clr_optimization_v4.0.30319_64

Description:
Microsoft .NET Framework NGEN

Type:
Win32OwnProcess


herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.