.NET module version ID (MVID)
ID dotnet_mvid
DatatypeNot PIIidentifierDraft
This record is a draft: it has not been reviewed yet and may be incomplete or wrong. Do not rely on it for compliance decisions. Help improve it (see CONTRIBUTING.md).
GUID that the compiler writes into the metadata of every .NET module (the Module table, stored in the GUID heap) so that two versions of the same module can be told apart. The compiler generates a new MVID for each build, and System.Reflection.Module.ModuleVersionId returns it. Malware analysts use it, with the TypeLib ID, to link samples that come from the same build; VirusTotal reports it as dot_net_guids.mvid. The text form is a standard UUID.
- Parent datatype
- Universally unique identifier (UUID)
uuid - Categories
- Software development, Universal unique identifiers
- Countries
- Global (not tied to a country)
- Languages
- Common to most languages
- Quality
- 68/100 · missing: second example, mapping (Wikidata, Schema.org, ...), translation, detector coverage
- Metacrafter rules
- no detection rule yet
- Supported by tools
- no tool record lists this type yet
Regular expression
^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$Python re syntax.
Examples
| Value | Description |
|---|---|
| c7c0f129-4c73-461f-a638-94f3901fae90 | MVID of a .NET trojan sample (liuyue.exe) in its VirusTotal report |
| c7c0f1294c73461fa63894f3901fae90 invalid | GUID digits without hyphens |
Sources
- doc: https://learn.microsoft.com/en-us/dotnet/api/system.reflection.module.moduleversionid
- other: https://virustotal.readme.io/reference/file-object-dot-net-guids
Use this record
- Page URL:
https://registry.apicrafter.io/datatype/dotnet_mvid - JSON: API v1 · legacy shape (used by metacrafter) · Markdown (for LLMs)
- Improve it: edit
data/datatypes/any/software/dotnet_mvid.yamlon GitHub