System.Runtime.dll

  • File Path: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\.NETFramework\v4.8\Facades\System.Runtime.dll
  • Description: System.Runtime
  • Comments: System.Runtime

Hashes

Type Hash
MD5 F1BE933D254554AF4B481366918D1F8D
SHA1 1BAA5E2E12D8BE1FEE50C5593287E2FEB18A38F0
SHA256 C148C05486ACF41A14C2BE0DB3A8B53E780B0592F80C902E40D7EE8160BF06A5
SHA384 A7E4DBDAA5C64CAD82BF36505514015DB1CC4450231AACC488D168225E3B570952FD3D54BA4E652ECF016793EFEAFB66
SHA512 E1CC26F66076DD23593BB5C78D34A1472270D48AB2E85355774874B00076B9123B53BE179DC8191501B4357DD834139807A71AB9AC8E2BF0E17453450A2137EE
SSDEEP 384:1sm6AjixuZtMWC6g/Q5WyXW3sfQpBj0HRN7jIQHRN7cGw6lx2jo9:1HlwCLdqWjI8Z4s
IMP DAE02F32A21E03CE65412F6E56942DAA
PESHA1 DD5975F9DB8C096420FBFDC632E06F88DC9EB3E7
PE256 C57512211A6FEEF2DE9657D5B4FA988A7D1B8C253A9A2004C440ABD223141328

Signature

  • Status: Signature verified.
  • Serial: 33000001519E8D8F4071A30E41000000000151
  • Thumbprint: 62009AAABDAE749FD47D19150958329BF6FF4B34
  • Issuer: CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: System.Runtime.dll
  • Product Name: Microsoft .NET Framework
  • Company Name: Microsoft Corporation
  • File Version: 4.8.4084.0
  • Product Version: 4.8.4084.0
  • Language: Language Neutral
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/76
  • VirusTotal Link: https://www.virustotal.com/gui/file/c148c05486acf41a14c2be0db3a8b53e780b0592f80c902e40d7ee8160bf06a5/detection

File Similarity (ssdeep match)

File Score
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\1033\flogvwrc.dll 43
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\1033\gacutlrc.dll 40
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\1033\IlDasmrc.dll 38
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\1033\pevrfyrc.dll 52
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\1033\snrc.dll 36
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\1033\TrackerUI.dll 36
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\x64\1033\flogvwrc.dll 41
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\x64\1033\gacutlrc.dll 32
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\x64\1033\IlDasmrc.dll 46
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\x64\1033\pevrfyrc.dll 43
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\x64\1033\snrc.dll 33
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\x64\1033\TrackerUI.dll 38
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Accessibility.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\CustomMarshalers.dll 30
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\Microsoft.Win32.Primitives.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.AppContext.dll 41
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Collections.Concurrent.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Collections.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Collections.NonGeneric.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Collections.Specialized.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.ComponentModel.Annotations.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.ComponentModel.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.ComponentModel.EventBasedAsync.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.ComponentModel.Primitives.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.ComponentModel.TypeConverter.dll 36
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Console.dll 54
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Data.Common.dll 40
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Diagnostics.Contracts.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Diagnostics.Debug.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Diagnostics.FileVersionInfo.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Diagnostics.Process.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Diagnostics.StackTrace.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Diagnostics.TextWriterTraceListener.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Diagnostics.Tools.dll 41
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Diagnostics.TraceSource.dll 52
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Drawing.Primitives.dll 52
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Dynamic.Runtime.dll 40
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Globalization.Calendars.dll 41
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Globalization.dll 38
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Globalization.Extensions.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.IO.Compression.ZipFile.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.IO.dll 41
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.IO.FileSystem.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.IO.FileSystem.DriveInfo.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.IO.FileSystem.Primitives.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.IO.FileSystem.Watcher.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.IO.IsolatedStorage.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.IO.MemoryMappedFiles.dll 50
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.IO.Pipes.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.IO.UnmanagedMemoryStream.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Linq.dll 50
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Linq.Expressions.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Linq.Parallel.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Linq.Queryable.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Net.Http.Rtc.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Net.NameResolution.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Net.NetworkInformation.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Net.Ping.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Net.Primitives.dll 54
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Net.Requests.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Net.Security.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Net.Sockets.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Net.WebHeaderCollection.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Net.WebSockets.Client.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Net.WebSockets.dll 55
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.ObjectModel.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Reflection.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Reflection.Emit.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Reflection.Emit.ILGeneration.dll 40
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Reflection.Emit.Lightweight.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Reflection.Extensions.dll 50
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Reflection.Primitives.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Resources.Reader.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Resources.ResourceManager.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Resources.Writer.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Runtime.CompilerServices.VisualC.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Runtime.Extensions.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Runtime.Handles.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Runtime.InteropServices.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Runtime.InteropServices.RuntimeInformation.dll 41
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Runtime.InteropServices.WindowsRuntime.dll 41
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Runtime.Numerics.dll 58
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Runtime.Serialization.Formatters.dll 52
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Runtime.Serialization.Json.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Runtime.Serialization.Primitives.dll 50
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Runtime.Serialization.Xml.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Security.Claims.dll 41
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Security.Cryptography.Algorithms.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Security.Cryptography.Csp.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Security.Cryptography.Encoding.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Security.Cryptography.Primitives.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Security.Cryptography.X509Certificates.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Security.Principal.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Security.SecureString.dll 41
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.ServiceModel.Duplex.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.ServiceModel.Http.dll 50
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.ServiceModel.NetTcp.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.ServiceModel.Primitives.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.ServiceModel.Security.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Text.Encoding.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Text.Encoding.Extensions.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Text.RegularExpressions.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Threading.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Threading.Overlapped.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Threading.Tasks.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Threading.Tasks.Parallel.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Threading.Thread.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Threading.ThreadPool.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Threading.Timer.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.ValueTuple.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Xml.ReaderWriter.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Xml.XDocument.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Xml.XmlDocument.dll 52
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Xml.XmlSerializer.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Xml.XPath.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Xml.XPath.XDocument.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\ISymWrapper.dll 30
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Microsoft.Activities.Build.dll 40
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\sysglobl.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Activities.DurableInstancing.dll 32
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.AddIn.Contract.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.ComponentModel.Composition.Registration.dll 36
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Data.DataSetExtensions.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Data.Services.Design.dll 41
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Diagnostics.Tracing.dll 40
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.IO.Compression.dll 41
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.IO.Compression.FileSystem.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Management.Instrumentation.dll 40
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Net.Http.WebRequest.dll 40
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Numerics.dll 29
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Reflection.Context.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Transactions.dll 27
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Web.Abstractions.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Web.RegularExpressions.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Web.Routing.dll 40
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Windows.dll 41
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Windows.Input.Manipulations.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Windows.Presentation.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Xml.Serialization.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\UIAutomationClientsideProviders.dll 55
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\UIAutomationProvider.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\XamlBuildTask.dll 25
C:\Program Files (x86)\Windows Kits\10\Redist\10.0.19041.0\ucrt\DLLs\x64\api-ms-win-crt-multibyte-l1-1-0.dll 27
C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe 50
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe 38
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe 50
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe 38
C:\Windows\system32\aspnet_counters.dll 38
C:\Windows\system32\downlevel\API-MS-Win-security-lsapolicy-l1-1-0.dll 30
C:\Windows\system32\msvcr100_clr0400.dll 47
C:\Windows\SysWOW64\aspnet_counters.dll 38
C:\Windows\SysWOW64\msvcr100_clr0400.dll 46

Possible Misuse

The following table contains possible examples of System.Runtime.dll being misused. While System.Runtime.dll is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
atomic-red-team T1204.002.md [System.Runtime.Interopservices.Marshal]::ReleaseComObject($xlBook) | Out-Null MIT License. © 2018 Red Canary
atomic-red-team T1204.002.md [System.Runtime.Interopservices.Marshal]::ReleaseComObject($xlApp) | Out-Null MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md Copy-Item -Path “$([System.Runtime.InteropServices.RuntimeEnvironment]::GetRuntimeDirectory())InstallUtil.exe” -Destination “$Env:windir\System32\Tasks\notepad.exe” MIT License. © 2018 Red Canary
signature-base gen_empire.yar $x1 = “$DllMain = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DllMainPtr, $DllMainDelegate)” fullword ascii CC BY-NC 4.0
signature-base gen_metasploit_payloads.yar $s3 = “[System.Runtime.InteropServices.DllImport("kernel32")]” fullword ascii CC BY-NC 4.0
signature-base gen_metasploit_payloads.yar $s3 = “GetMethod(‘GetProcAddress’).Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object” ascii CC BY-NC 4.0
signature-base gen_powershell_empire.yar $s2 = “[System.Runtime.InteropServices.Marshal]::StructureToPtr($CmdLineAArgsPtr, $GetCommandLineAAddrTemp, $false)” fullword ascii CC BY-NC 4.0
signature-base gen_powershell_toolkit.yar $s1 = “[IntPtr]$DllAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [Type][IntPtr])” fullword ascii CC BY-NC 4.0
signature-base gen_powershell_toolkit.yar $s7 = “[System.Runtime.InteropServices.Marshal]::FreeHGlobal($TokenPrivilegesMem)” fullword ascii CC BY-NC 4.0
signature-base gen_powershell_toolkit.yar $s8 = “[System.Runtime.InteropServices.Marshal]::StructureToPtr($CurrAddr, $FinalAddr, $false) | Out-Null” fullword ascii CC BY-NC 4.0
signature-base gen_powershell_toolkit.yar $s11 = “[IntPtr]$ProcAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [Type][IntPtr])” fullword ascii CC BY-NC 4.0

MIT License. Copyright (c) 2020 Strontic.