Should I block it?

No, this file is 100% safe to run.

Additional versions

4.6.3.24650	19.20%
4.6.3.24650	1.25%
4.6.2.22610	61.35%
4.6.2.22610	13.47%
4.6.1.10263	0.25%
4.6.0.1523	4.49%

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

PE file structure

Show functions

Import table

advapi32.dll

RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegCreateKeyExW, RegOpenKeyExW, RegQueryValueExW, RegSetValueExW, RegQueryInfoKeyW, AddAce, InitializeAcl, GetAclInformation, GetSecurityDescriptorControl, MakeAbsoluteSD, GetSecurityDescriptorSacl, GetSecurityDescriptorDacl, GetSecurityDescriptorGroup, GetSecurityDescriptorOwner, InitializeSecurityDescriptor, OpenProcessToken, OpenThreadToken, SetServiceStatus, DeregisterEventSource, ReportEventW, RegisterEventSourceW, CloseServiceHandle, OpenServiceW, OpenSCManagerW, RegEnumKeyExW, GetLengthSid, IsValidSid, CopySid, SetSecurityDescriptorOwner, SetSecurityDescriptorGroup, SetSecurityDescriptorDacl, CreateServiceW, DeleteService, ControlService, GetSidSubAuthority, InitializeSid, GetSidLengthRequired, GetTokenInformation, RegisterServiceCtrlHandlerExW, StartServiceCtrlDispatcherW, RegOpenKeyExA, LookupAccountSidW, LookupPrivilegeNameW, AdjustTokenPrivileges, LookupPrivilegeValueW, LogonUserW, CreateProcessAsUserW, DuplicateToken, EqualSid, CheckTokenMembership, RegOpenKeyW, MakeSelfRelativeSD, GetSecurityDescriptorLength, ConvertSidToStringSidW, RegQueryValueExA

comctl32.dll

GetMUILanguage

faultrep.dll

ReportFault

kernel32.dll

GetCurrentProcessId, InterlockedExchange, IsWow64Process, GetNativeSystemInfo, OpenProcess, HeapSetInformation, GetProcessHeap, GetCommandLineW, FindResourceW, LoadResource, SizeofResource, MultiByteToWideChar, FreeLibrary, InterlockedDecrement, LocalFree, Sleep, ReleaseMutex, GetVersionExW, CompareFileTime, DeleteFileW, FindFirstFileW, FindNextFileW, FindClose, CreateFileW, GetTempPathW, CreateFileMappingW, MapViewOfFile, UnmapViewOfFile, CreateMutexW, GetUserDefaultLCID, GetLocalTime, InterlockedIncrement, WaitForSingleObject, GetExitCodeProcess, CreateProcessW, GetModuleFileNameW, GetCurrentThread, GetCurrentProcess, GetCurrentThreadId, lstrcmpiW, GetModuleHandleW, GetProcAddress, CloseHandle, LoadLibraryExW, CreateThread, CreateEventW, SetEvent, LoadLibraryW, CreateRemoteThread, WriteProcessMemory, DuplicateHandle, VirtualFreeEx, VirtualAllocEx, OutputDebugStringW, IsDebuggerPresent, UnhandledExceptionFilter, TerminateProcess, GetSystemTimeAsFileTime, GetTickCount, QueryPerformanceCounter, SetUnhandledExceptionFilter, GetStartupInfoW, InterlockedCompareExchange, HeapSize, HeapReAlloc, HeapFree, HeapAlloc, HeapDestroy, DeleteCriticalSection, InitializeCriticalSection, LeaveCriticalSection, EnterCriticalSection, GetLastError, RaiseException, lstrlenW

msvcp90.dll

DllMain

msvcr90.dll

DllMain

ole32.dll

CoInitializeSecurity, StringFromGUID2, CoTaskMemFree, CoTaskMemRealloc, CoUninitialize, CoInitializeEx, CoTaskMemAlloc, CoCreateInstance

rpcrt4.dll

RpcStringBindingComposeW, RpcStringFreeW, RpcBindingFromStringBindingW, RpcBindingFree, RpcMgmtStopServerListening, RpcMgmtWaitServerListen, RpcServerUnregisterIf, RpcServerRegisterIf2, RpcBindingSetAuthInfoExW, RpcServerRegisterAuthInfoW, RpcImpersonateClient, RpcRevertToSelf, RpcServerUseProtseqEpW, RpcBindingInqAuthClientW, NdrClientCall2, NdrServerCall2, RpcServerListen

shell32.dll

SHGetSpecialFolderPathW

user32.dll

WaitForInputIdle, LoadStringW, CharNextW, CharUpperW, MessageBoxW, DispatchMessageW, TranslateMessage, GetMessageW, PostThreadMessageW

userenv.dll

UnloadUserProfile

sftvsa.exe

Microsoft Application Virtualization by Microsoft Corporation (Signed)

Remove sftvsa.exe

Version:	4.6.2.22610
MD5:	a5812f0281ca5081bf696626f9bf324d
SHA1:	aebcbba7a549012b4ec8ec67da0b37e417e383e8
SHA256:	36aede39b425e1be769c6dcecdfd09f365851992b70e21b462a459e5211451cd

What is sftvsa.exe?

Microsoft Application Virtualization Virtual Service Agent for Microsoft Application Virtualization (MS App-V) platform allows applications to be deployed in real-time to any client from a virtual application server. It removes the need for local installation of the applications. Instead, only the App-V client needs to be installed on the client machines. All application data is permanently stored on the virtual application server.

Overview

sftvsa.exe runs as a service under the name sftvsa (sftvsa) with extensive SYSTEM privileges (full administrator access). The file is digitally signed by Microsoft Corporation.

Details

File name:	sftvsa.exe
Publisher:	Microsoft Corporation
Product name:	Microsoft Application Virtualization
Description:	Microsoft Application Virtualization Virtual Service Agent
Typical file path:	C:\Program Files\microsoft application virtualization client\sftvsa.exe
File version:	4.6.2.22610
Size:	214.35 KB (219,496 bytes)
Certificate
Issued to:	Microsoft Corporation
Authority (CA):	Microsoft Corporation
Effective date:	Monday, December 7, 2009
Expiration date:	Monday, March 7, 2011
Digital DNA
PE subsystem:	Windows GUI
Entropy:	6.364202
File packed:	No
Code language:	Microsoft Visual C++ 9.0
.NET CLR:	No

More details

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

sftvsa
'sftvsa' (Application Virtualization Service Agent)

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00026651%	0.028634%
Kernel CPU:	0.00017919%	0.013761%
User CPU:	0.00008732%	0.014873%
Kernel CPU time:	190,689 ms/min	100,923,805ms/min
CPU cycles:	6,865/sec	17,470,203/sec
Memory
Private memory:	1.25 MB	21.59 MB
Private (maximum):	3.44 MB
Private (minimum):	1.89 MB
Non-paged memory:	1.25 MB	21.59 MB
Virtual memory:	34.29 MB	140.96 MB
Virtual memory (peak):	34.92 MB	169.69 MB
Working set:	1.98 MB	18.61 MB
Working set (peak):	4.27 MB	37.95 MB
Page faults:	2,007/min	2,039/min
I/O
I/O read transfer:	0 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	0 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	5 Bytes/sec	448.09 KB/min
I/O other operations:	1/sec	1,671/min
Resource allocations
Threads:	4	12
Handles:	86	600
GUI GDI count:	4	103
GUI USER count:	2	49

Process properties

Integrety level:	System
Platform:	32-bit
Command line:	"C:\Program Files\microsoft application virtualization client\sftvsa.exe"
Owner:	SYSTEM
Windows Service
Service name:	sftvsa
Display name:	sftvsa
Description:	“Monitors global service events and launches virtual services.”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads