Process

ubiquitoussigned

mscorsvw.exe

Microsoft CorporationFirst seen 2026-06-09

File identity

File details
File type
PE32+ executable
Magic
PE32+ executable (GUI)
Architecture
x6457.1%x8642.9%
Original name
mscorsvw.exe
Internal name
mscorsvw.exe
Product
Microsoft® .NET Framework
Signing information
Status
Signed
Signature rate
100%
Publisher
Microsoft Corporation
Signer
Microsoft Dynamic Code Publisher
Issuer
Microsoft Windows Code Signing PCA 2024
Thumbprint
369f052c24fcdbcdffddf1daa0a7ed2ae3950047
File version1
  • 4.8.9221.0 built by: NET481REL1LAST_25H2100%
File size2
  • 136.40 KB57.1%
  • 125.40 KB42.9%

Execution context

File paths2
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe67.7%
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe32.3%
User context1
  • SYSTEM100%
Integrity level1
  • System100%
Instances1
  • 1100%
Session1
  • Session 0100%
Token privileges16
  • SeChangeNotifyPrivilege100%
  • SeTimeZonePrivilege100%
  • SeDelegateSessionUserImpersonatePrivilege100%
  • SeDebugPrivilege100%
  • SeLockMemoryPrivilege100%

Analysis

About this process

No analyst write-up yet.

Security notes

No analyst write-up yet.

Anomaly signals

None defined yet.

Telemetry

OS prevalence1
  • Windows 11 (26200)100%
Observation timeline
First seen
2026-06-09
Last seen
2026-06-09
Machines
1
Executions
161
Edit this page on GitHub