ngen.exe

  • File Path: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
  • Description: Microsoft Common Language Runtime native compiler
  • Comments: Flavor=Retail

Hashes

Type Hash
MD5 D253C39347487B5AB5928C6D31317E80
SHA1 1C8F02265CF6FE480BCD4D504F9E4D2A5A2F66CB
SHA256 7C151D31D31F61BD4794C57C3FB527F910A99BA81F84951F15CF4D58B2D63C24
SHA384 B5BAFD04D404492F97BCA65F177CE9CBB91C498F7498153BAA2E93700F67C2E790BB5F94E89CE60D89450FB304EBAA69
SHA512 025FB3A132B6B2B51948859F45EC37C76865E6379117E41F0DE7C1AB20AD158D2E6293943F639D0EC6EC6FEA981BCCEECD86B877A5511323B5AEC5B596EF209D
SSDEEP 3072:NabxrVrYEo7+ElRYS87HLXV2xoupmXPRFWvOHEpFMativW:NstVrYE/gRYSUHLXV29pmXPv/Epxt0W
IMP 5ABC114B8FD18C7E03AD3244A6DA0BC3
PESHA1 333EDD3BB7BF0891EFF86E655E1716C024FAC03C
PE256 79AEA6D7E54301FC97FAD10370127058BC33C98F1C0CA6CBE8753996B86B2D7F

Runtime Data

Usage (stdout):

Microsoft (R) CLR Native Image Generator - Version 4.8.4084.0
Copyright (c) Microsoft Corporation.  All rights reserved.

Error: Unrecognized option --help
WARNING: This syntax is deprecated or you mis-typed your command.  Run "ngen /?" to display a list of the currently supported parameters.

Usage: ngen <action> [args] [/nologo] [/silent] [/verbose]
       ngen /? or /help

    /nologo    - Prevents displaying of logo
    /silent    - Prevents displaying of success messages
    /verbose   - Displays verbose output for debugging

Actions:
    ngen install <assembly name> [scenarios] [config] [/queue[:[1|2|3]]
        Generate native images for an assembly and its dependencies
        and install them in the Native Images Cache
        If /queue is specified compilation job is queued up.  If a priority 
        is not specified, the default priority used is 3.
    ngen uninstall <assembly name> [scenarios] [config]
        Delete the native images of an assembly and its dependencies from
        the Native Images Cache.
    ngen update [/queue]
        Update native images that have become invalid
        If /queue is specified compilation jobs are queued up.
    ngen display [assembly name]
        Display the ngen state
    ngen executeQueuedItems [1|2|3]
        Executes queued compilation jobs.
        If priority is not specified all queued compilation jobs are done.
        If priority is specified compilation jobs with greater or equal
        priority than the specified are done. (Short form: eqi)
    ngen queue [pause|continue|status]
        Allows the user to pause and continue the NGen Service, and to
        query its status.
    ngen createPDB <path to native image> <directory to store PDB>
                    [/lines  [<search path for managed PDB>] ]
        Generates a native PDB file for a native image that was previously
        generated by NGen.  The generated PDB file includes names of methods
        and ranges of IP offsets that map to those methods.
        If /lines is specified, then additional information is written to the
        PDB to map ranges of IP offsets to source file line numbers.  /lines
        requires access to the managed PDB generated by the language compiler.
        <search path for managed PDB> may optionally be specified to help NGen
        find the managed PDB

Scenarios:
    /Debug          - Generate images that can be used under a debugger
    /Profile        - Generate images that can be used under a profiler
    /NoDependencies - Generate the minimal number of native images
                      required by this scenario

Config:
    /ExeConfig:<path to exe> - Use the configuration of the specified
                 executable assembly
    /AppBase:<path to appbase directory> - Use the specified directory as
                 the appbase

Loaded Modules:

Path
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\SYSTEM32\ntdll.dll

Signature

  • Status: Signature verified.
  • Serial: 330000023241FB59996DCC4DFF000000000232
  • Thumbprint: FF82BC38E1DA5E596DF374C53E3617F7EDA36B06
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: ngen.exe
  • Product Name: Microsoft .NET Framework
  • Company Name: Microsoft Corporation
  • File Version: 4.8.4084.0 built by: NET48REL1
  • Product Version: 4.8.4084.0
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/76
  • VirusTotal Link: https://www.virustotal.com/gui/file/7c151d31d31f61bd4794c57c3fb527f910a99ba81f84951f15cf4d58b2d63c24/detection

Possible Misuse

The following table contains possible examples of ngen.exe being misused. While ngen.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_proc_wrong_parent.yml - '\ngen.exe' DRL 1.0
sigma proc_creation_win_susp_svchost.yml - '\ngen.exe' DRL 1.0
malware-ioc misp_invisimole.json "value": "%WINDIR%\\system32\\drivers\\NGEN Framework\\NGEN.exe", © ESET 2014-2018
malware-ioc invisimole C:\Windows\system32\drivers\NGEN Framework\NGEN.exe © ESET 2014-2018
malware-ioc invisimole "Application"="C:\Windows\system32\drivers\NGEN Framework\NGEN.exe" © ESET 2014-2018
malware-ioc win_apt_invisimole_speedfan_chain.yml - '\Windows\system32\drivers\NGEN Framework\NGEN.exe' © ESET 2014-2018
malware-ioc win_apt_invisimole_speedfan_chain.yml - '\NGEN.exe' © ESET 2014-2018
malware-ioc win_apt_invisimole_speedfan_chain.yml Details\|endswith: '\drivers\NGEN Framework\NGEN.exe' © ESET 2014-2018

MIT License. Copyright (c) 2020-2021 Strontic.