CmdID

CmdID / Files

mscorsvw.exe

.NET Runtime Optimization Service file version info

Program on Windows 6 known copies with hashes 5 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real mscorsvw.exe?

file version info and known copies
Installed inC:\Windows\Microsoft.NET\Framework64\v4.0.30319\
C:\Windows\Microsoft.NET\Framework\v4.0.30319\
Signed byMicrosoft Windows
ProductMicrosoft .NET Framework, Microsoft Corporation
Description.NET Runtime Optimization Service

6 known copies

4.8.4341.0 built by: NET48REL1LAST_C · C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe · signed by Microsoft Windows

286cda2760e25ca64356f82a7420da8f4b8a3edcb2b7bfbb75d74b0571995ca7

4.8.4341.0 built by: NET48REL1LAST_C · C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe · signed by Microsoft Windows

c5be32520ff3a1a6acdf66b30a9a068f20f946f2e1091c6f85d6e9f09fba1624

4.8.4320.0 built by: NET48REL1LAST_C · C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe · signed by Microsoft Dynamic Code Publisher

3e5099f573601926e59862fba2495974688e72677c73f10e4c99e26a76cdcf37

4.8.4320.0 built by: NET48REL1LAST_C · C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe · signed by Microsoft Dynamic Code Publisher

da1087ba2641efd77d85e5838aeb6c333e80caa9f24c889fd2de2e0b58f8d1a5

4.8.4084.0 built by: NET48REL1 · C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe · signed by Microsoft Windows

1974ba6039355e657e78c97b5ac21e83087e43aac9fb40df5f0bc567d822a4a1

4.8.4084.0 built by: NET48REL1 · C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe · signed by Microsoft Windows

7d8d8696acd1815316174fba563f2e2ad0be3b5e9c6a28e237f9131a41067169

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name mscorsvw.exe
lowPotential Executable Run Itself As Sacrificial Processfrack113

Sigma names mscorsvw.exe in 5 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.