{
  "id": "dotnet_mvid",
  "kind": "datatype",
  "status": "draft",
  "name": ".NET module version ID (MVID)",
  "doc": "GUID that the compiler writes into the metadata of every .NET module (the Module table, stored in the GUID heap) so that two versions of the same module can be told apart. The compiler generates a new MVID for each build, and System.Reflection.Module.ModuleVersionId returns it. Malware analysts use it, with the TypeLib ID, to link samples that come from the same build; VirusTotal reports it as dot_net_guids.mvid. The text form is a standard UUID.",
  "parent": "uuid",
  "is_pii": false,
  "categories": [
    "software",
    "identifiers"
  ],
  "langs": [
    "common"
  ],
  "classification": "identifier",
  "regexp": "^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$",
  "examples": [
    {
      "value": "c7c0f129-4c73-461f-a638-94f3901fae90",
      "description": "MVID of a .NET trojan sample (liuyue.exe) in its VirusTotal report",
      "valid": true
    },
    {
      "value": "c7c0f1294c73461fa63894f3901fae90",
      "description": "GUID digits without hyphens",
      "valid": false
    }
  ],
  "links": [
    {
      "type": "doc",
      "url": "https://learn.microsoft.com/en-us/dotnet/api/system.reflection.module.moduleversionid"
    },
    {
      "type": "other",
      "url": "https://virustotal.readme.io/reference/file-object-dot-net-guids"
    }
  ],
  "quality": {
    "score": 68,
    "missing": [
      "second example",
      "mapping (Wikidata, Schema.org, ...)",
      "translation",
      "detector coverage"
    ]
  },
  "source": {
    "path": "data/datatypes/any/software/dotnet_mvid.yaml",
    "url": "https://github.com/apicrafter/metacrafter-registry/blob/main/data/datatypes/any/software/dotnet_mvid.yaml",
    "edit_url": "https://github.com/apicrafter/metacrafter-registry/edit/main/data/datatypes/any/software/dotnet_mvid.yaml"
  },
  "urls": {
    "html": "https://registry.apicrafter.io/datatype/dotnet_mvid",
    "json": "https://registry.apicrafter.io/api/v1/datatypes/dotnet_mvid.json"
  }
}