---
id: "dotnet_mvid"
kind: "datatype"
status: "draft"
is_pii: false
categories: ["software", "identifiers"]
langs: ["common"]
quality: 68
url: "https://registry.apicrafter.io/datatype/dotnet_mvid"
---

# .NET module version ID (MVID) (`dotnet_mvid`)

> **Draft.** Draft records have not been reviewed yet and may be incomplete or wrong; do not treat them as authoritative for legal or compliance decisions.

GUID that the compiler writes into the metadata of every .NET module (the Module table, stored in the GUID heap) so that two versions of the same module can be told apart. The compiler generates a new MVID for each build, and System.Reflection.Module.ModuleVersionId returns it. Malware analysts use it, with the TypeLib ID, to link samples that come from the same build; VirusTotal reports it as dot_net_guids.mvid. The text form is a standard UUID.

- Parent datatype: `uuid`
- Personal data (PII): no
- Categories: Software development (software), Universal unique identifiers (identifiers)
- Countries: global
- Languages: Common to most languages (common)
- Classification: identifier

## Detection

Regular expression (Python `re`):

```
^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$
```

## Examples

- `c7c0f129-4c73-461f-a638-94f3901fae90` — MVID of a .NET trojan sample (liuyue.exe) in its VirusTotal report
- `c7c0f1294c73461fa63894f3901fae90` (invalid example) — GUID digits without hyphens

## Sources

- doc: <https://learn.microsoft.com/en-us/dotnet/api/system.reflection.module.moduleversionid>
- other: <https://virustotal.readme.io/reference/file-object-dot-net-guids>

## Quality

Score 68/100. Missing: second example, mapping (Wikidata, Schema.org, ...), translation, detector coverage.

JSON: <https://registry.apicrafter.io/api/v1/datatypes/dotnet_mvid.json> · Edit: <https://github.com/apicrafter/metacrafter-registry/edit/main/data/datatypes/any/software/dotnet_mvid.yaml>