mscoree.dll: the genuine .NET Framework loader, or a planted copy?

What mscoree.dll does, and why a copy outside Windows is a warning sign

Programs written for .NET Framework do not contain ordinary machine code alone. When you start one, Windows sees that its .exe is a .NET program and passes it to mscoree.dll. The file reads which .NET Framework version the program was built for, loads the matching runtime from C:\Windows\Microsoft.NET, and from then on the program runs inside that runtime. Because one small loader serves every installed .NET Framework version, it sits in the Windows folders and not in each runtime folder.

On Windows 10 and Windows 11, mscoree.dll is part of Windows itself and is updated with Windows. On Windows XP, Vista and 7 it arrived with .NET Framework installers, which is why old copies numbered 1.x, 2.x and 4.x still turn up in program folders and on download sites. None of those belongs on a modern PC.

The file name is also useful to attackers. HijackLibs, a public list of DLL names that legitimate programs can be made to load from the wrong folder, records mscoree.dll for three Microsoft programs: aitstatic.exe and PresentationHost.exe from System32, and AppLaunch.exe from the .NET Framework folder. Copy one of those programs to another folder, put a file called mscoree.dll beside it, and the program loads that file instead of Windows' copy. The attacker's code then runs inside a program that carries a valid Microsoft signature.

So the question is not whether mscoree.dll is a virus, but which copy you are looking at. The two in System32 and SysWOW64 are Microsoft's. A copy beside a Microsoft .NET program outside C:\Windows, or in a user folder, is whatever the person who put it there made it to be.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to tell Windows' mscoree.dll from a planted copy

A DLL does not show up in Task Manager as a process, so use the folder, the file properties, PowerShell or Process Explorer.

1. Where the file is. List every copy with the command below. C:\Windows\System32 and C:\Windows\SysWOW64 are Windows' copies, and files inside C:\Windows\WinSxS are Windows' stored originals. Every other path needs a closer look, and a copy with AppLaunch.exe, PresentationHost.exe or aitstatic.exe beside it outside C:\Windows is the documented abuse pattern.

   Get-ChildItem C:\ -Recurse -Filter mscoree.dll -ErrorAction SilentlyContinue | Where-Object FullName -notlike 'C:\Windows\WinSxS*' | Select-Object FullName, Length, @{n='Description';e={$_.VersionInfo.FileDescription}}

2. The Description field and the size. Right-click the file, Properties, Details. The genuine file says Microsoft .NET Runtime Execution Engine, with Microsoft Corporation as the company and a Windows version number such as 10.0.26100. Its size matches a Windows release in the facts table. A planted copy can borrow these fields, so this check only rules files out, it never proves a file genuine.
3. The digital signature. Windows signs mscoree.dll through a catalog, not inside the file, so Properties often shows no Digital Signatures tab even for the genuine copy. PowerShell reads catalog signatures too. Valid with a Microsoft signer means genuine; NotSigned or another signer on a copy outside the Windows folders means it is not Windows' file.

   Get-AuthenticodeSignature 'C:\path\to\mscoree.dll' | Format-List Status, SignatureType, SignerCertificate

4. What is next to it. Open the folder that holds the suspicious copy. A Microsoft .NET program there, such as AppLaunch.exe, together with extra files of unclear purpose (a second mscoree.dll.mui, an encrypted data file, a random-named .dat), matches how loaders have been delivered. Note the folder and the file dates before you delete anything.
5. Which copy a program really loaded. Open Process Explorer from Microsoft Sysinternals, choose Find, Find Handle or DLL, type mscoree.dll and press Search. Every .NET program lists it. A path under System32 or SysWOW64 is normal; any other path means that process loaded a copy that Windows did not provide.
6. Compare the hash with Microsoft's builds. Use the checker on this page: it computes the SHA-256 in your browser and compares it with the 31 known Microsoft builds. A copy outside the Windows folders that matches is a genuine but misplaced file; one that does not match is a third-party file.

A match to a Microsoft build proves the file is Microsoft's, but not that its place is harmless: a genuine copy can be used to set up a trap for a planted one. A file that does not match is not automatically malicious, since old .NET Framework copies from download sites do not match either. What decides is where it sits and what sits beside it.

Warning signs and what they mean

How attackers have used the name mscoree.dll

One published report names a malicious mscoree.dll. The genuine Microsoft file was not changed: the attackers shipped their own DLL under this name for a Microsoft program to load.

MITRE ATT&CK lists this as Hijack Execution Flow: DLL Side-Loading (T1574.002). On a home PC the useful test is the folder, the program beside the file and the signer, not the name: a malicious mscoree.dll keeps the genuine file name.

Programs that have been made to load a fake mscoree.dll

Each program below is genuine and signed, and security researchers have documented that it can be made to load a planted mscoree.dll. Usually the attacker copies the program into another folder and puts a fake mscoree.dll next to it: Windows looks in the program's own folder first. A mscoree.dll next to one of these programs, outside the folders below, is the copy to check.

Where the genuine mscoree.dll belongs: C:\Windows\System32C:\Windows\SysWOW64

The genuine mscoree.dll is signed by: Microsoft Windows, a Windows catalog signature (Properties shows no Digital Signatures tab; check it with Get-AuthenticodeSignature)

Source: the HijackLibs entry for mscoree.dll, 5 public reports.

Everyday questions about mscoree.dll

mscoree.dll versions by Windows release

The newest build indexed for each release, and the update that delivered it. 31 Microsoft builds in total are known.

Known versions of mscoree.dll

A public DLL catalogue lists 16 versions of mscoree.dll, from 1.0.3705.0 to 10.0.14393.0, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix mscoree.dll errors on uGetFix

Questions people ask