Should I block it?

No, this file is 100% safe to run.

Additional versions

4.6.3.24650	19.20%
4.6.3.24650	1.25%
4.6.2.22610	61.35%
4.6.2.22610	13.47%
4.6.1.10263	0.25%
4.6.0.1523	4.49%

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

PE file structure

Show functions

Import table

advapi32.dll

RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegCreateKeyExW, RegOpenKeyExW, RegQueryValueExW, RegSetValueExW, RegQueryInfoKeyW, AddAce, InitializeAcl, GetAclInformation, GetSecurityDescriptorControl, MakeAbsoluteSD, GetSecurityDescriptorSacl, GetSecurityDescriptorDacl, GetSecurityDescriptorGroup, GetSecurityDescriptorOwner, InitializeSecurityDescriptor, OpenProcessToken, OpenThreadToken, SetServiceStatus, DeregisterEventSource, ReportEventW, RegisterEventSourceW, CloseServiceHandle, OpenServiceW, OpenSCManagerW, RegEnumKeyExW, GetLengthSid, IsValidSid, CopySid, SetSecurityDescriptorOwner, SetSecurityDescriptorGroup, SetSecurityDescriptorDacl, CreateServiceW, DeleteService, ControlService, GetSidSubAuthority, InitializeSid, GetSidLengthRequired, GetTokenInformation, RegisterServiceCtrlHandlerExW, StartServiceCtrlDispatcherW, RegOpenKeyExA, LookupAccountSidW, LookupPrivilegeNameW, AdjustTokenPrivileges, LookupPrivilegeValueW, LogonUserW, CreateProcessAsUserW, DuplicateToken, EqualSid, CheckTokenMembership, RegOpenKeyW, MakeSelfRelativeSD, GetSecurityDescriptorLength, ConvertSidToStringSidW, RegQueryValueExA

comctl32.dll

GetMUILanguage

faultrep.dll

ReportFault

kernel32.dll

GetCurrentProcessId, InterlockedExchange, IsWow64Process, GetNativeSystemInfo, OpenProcess, HeapSetInformation, GetProcessHeap, GetCommandLineW, FindResourceW, LoadResource, SizeofResource, MultiByteToWideChar, FreeLibrary, InterlockedDecrement, LocalFree, Sleep, ReleaseMutex, GetVersionExW, CompareFileTime, DeleteFileW, FindFirstFileW, FindNextFileW, FindClose, CreateFileW, GetTempPathW, CreateFileMappingW, MapViewOfFile, UnmapViewOfFile, CreateMutexW, GetUserDefaultLCID, GetLocalTime, InterlockedIncrement, WaitForSingleObject, GetExitCodeProcess, CreateProcessW, GetModuleFileNameW, GetCurrentThread, GetCurrentProcess, GetCurrentThreadId, lstrcmpiW, GetModuleHandleW, GetProcAddress, CloseHandle, LoadLibraryExW, CreateThread, CreateEventW, SetEvent, LoadLibraryW, CreateRemoteThread, WriteProcessMemory, DuplicateHandle, VirtualFreeEx, VirtualAllocEx, OutputDebugStringW, IsDebuggerPresent, UnhandledExceptionFilter, TerminateProcess, GetSystemTimeAsFileTime, GetTickCount, QueryPerformanceCounter, SetUnhandledExceptionFilter, GetStartupInfoW, InterlockedCompareExchange, HeapSize, HeapReAlloc, HeapFree, HeapAlloc, HeapDestroy, DeleteCriticalSection, InitializeCriticalSection, LeaveCriticalSection, EnterCriticalSection, GetLastError, RaiseException, lstrlenW

msvcp90.dll

DllMain

msvcr90.dll

DllMain

ole32.dll

CoInitializeSecurity, StringFromGUID2, CoTaskMemFree, CoTaskMemRealloc, CoUninitialize, CoInitializeEx, CoTaskMemAlloc, CoCreateInstance

rpcrt4.dll

RpcStringBindingComposeW, RpcStringFreeW, RpcBindingFromStringBindingW, RpcBindingFree, RpcMgmtStopServerListening, RpcMgmtWaitServerListen, RpcServerUnregisterIf, RpcServerRegisterIf2, RpcBindingSetAuthInfoExW, RpcServerRegisterAuthInfoW, RpcImpersonateClient, RpcRevertToSelf, RpcServerUseProtseqEpW, RpcBindingInqAuthClientW, NdrClientCall2, NdrServerCall2, RpcServerListen

shell32.dll

SHGetSpecialFolderPathW

user32.dll

WaitForInputIdle, LoadStringW, CharNextW, CharUpperW, MessageBoxW, DispatchMessageW, TranslateMessage, GetMessageW, PostThreadMessageW

userenv.dll

UnloadUserProfile

sftvsa.exe

Microsoft Application Virtualization by Microsoft Corporation (Signed)

Remove sftvsa.exe

Version:	4.6.0.1523
MD5:	b94c3c4dca2093243c76ca218ede2a97
SHA1:	b1299a5683aea293b9ad30f30298f0c1fa081316
SHA256:	4d376f825aeefd8f1bce48180471c75bda655b2d8be6e4205e327d14d797dbf2

What is sftvsa.exe?

Microsoft Application Virtualization Virtual Service Agent for Microsoft Application Virtualization (MS App-V) platform allows applications to be deployed in real-time to any client from a virtual application server. It removes the need for local installation of the applications. Instead, only the App-V client needs to be installed on the client machines. All application data is permanently stored on the virtual application server.

Overview

sftvsa.exe runs as a service under the name sftvsa (sftvsa) with extensive SYSTEM privileges (full administrator access). This is typically installed with the program Microsoft Application Virtualization Desktop Client published by Microsoft Corporation. The file is digitally signed by Microsoft Corporation.

Details

File name:	sftvsa.exe
Publisher:	Microsoft Corporation
Product name:	Microsoft Application Virtualization
Description:	Microsoft Application Virtualization Virtual Service Agent
Typical file path:	C:\Program Files\microsoft application virtualization client\sftvsa.exe
File version:	4.6.0.1523
Size:	204.85 KB (209,768 bytes)
Certificate
Issued to:	Microsoft Corporation
Authority (CA):	Microsoft Corporation
Effective date:	Monday, December 7, 2009
Expiration date:	Monday, March 7, 2011
Digital DNA
PE subsystem:	Windows GUI
Entropy:	6.364202
File packed:	No
Code language:	Microsoft Visual C++ 9.0
.NET CLR:	No

More details

Programs

The following program will install this file

Microsoft Application Virtualization Desktop Client

Microsoft Corporation

1% remove

“Microsoft Application Virtualization (App-V) can make applications available to end user computers without having to install the applications directly on those computers. This is made possible through a process known as sequencing the application , which enables each application to run in its own self-contained virtual environment on the client computer. The sequenced applications are isolated from each other. This eliminates applicatio...”

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

sftvsa
'sftvsa' (Application Virtualization Service Agent)

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00005438%	0.028634%
Kernel CPU:	0.00001820%	0.013761%
User CPU:	0.00003618%	0.014873%
Kernel CPU time:	17,346 ms/min	100,923,805ms/min
CPU cycles:	1,327/sec	17,470,203/sec
Memory
Private memory:	1.77 MB	21.59 MB
Private (maximum):	5.41 MB
Private (minimum):	4.2 MB
Non-paged memory:	1.77 MB	21.59 MB
Virtual memory:	42.31 MB	140.96 MB
Virtual memory (peak):	43.31 MB	169.69 MB
Working set:	4.22 MB	18.61 MB
Working set (peak):	5.43 MB	37.95 MB
Page faults:	4,404/min	2,039/min
I/O
I/O read transfer:	0 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O other transfer:	2 Bytes/sec	448.09 KB/min
I/O other operations:	1/sec	1,671/min
Resource allocations
Threads:	4	12
Handles:	106	600

Process properties

Integrety level:	System
Platform:	64-bit
Command line:	"C:\Program Files\microsoft application virtualization client\sftvsa.exe"
Owner:	SYSTEM
Windows Service
Service name:	sftvsa
Display name:	sftvsa
Description:	“Monitors global service events and launches virtual services.”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads