AppVShNotify.exe

  • File Path: C:\WINDOWS\system32\AppVShNotify.exe
  • Description: Microsoft Application Virtualization Client Shell Notifier

Hashes

Type Hash
MD5 83F264D80A8113766EB45871EBCEA9DF
SHA1 87E9784B3DC7EF59D8D75D3A4DE9BF8FB3318343
SHA256 6A036F053D295A2119D5296896B190D5ED9330AAF5D78A866CD38DD23B856C28
SHA384 6D2A445512AE418BD1964CFCFD7BC88D2B586B041EE9CF090AAA4D2615097065D6388551ED973A8EB49E093EFBE3486D
SHA512 7F57D0770934FEBD92F1144E4169CF376462D269A95C0715A1E0B490C8C2A6248A21B603A1B5443F019589EA0D51B7205DFF73704D4F69673613DCDCE54389B4
SSDEEP 6144:3cPCQ8bo6pbmvHQvhHueWGNU6ITLvZw3UG:TZ4HQmGNUbT9w3
IMP 752ABE0FE25B8EC7004A240BF0919186
PESHA1 03DE90AF49CD8C7182950ED47704E327C550FBFB
PE256 56AE138DB6685AB618DF694F5DD4AD3243197E9E4CADD110FFDE9B723546F3DB

Runtime Data

Child Processes:

csrss.exe winlogon.exe

Open Handles:

Path Type
(RW-) C:\Windows\System32 File
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section

Loaded Modules:

Path
C:\WINDOWS\System32\ADVAPI32.dll
C:\WINDOWS\system32\AppVShNotify.exe
C:\WINDOWS\System32\KERNEL32.DLL
C:\WINDOWS\System32\KERNELBASE.dll
C:\WINDOWS\System32\msvcrt.dll
C:\WINDOWS\SYSTEM32\ntdll.dll
C:\WINDOWS\System32\RPCRT4.dll
C:\WINDOWS\System32\sechost.dll
C:\WINDOWS\System32\USER32.dll
C:\WINDOWS\System32\win32u.dll

Signature

  • Status: Signature verified.
  • Serial: 33000002ED2C45E4C145CF48440000000002ED
  • Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: AppVShNotify.exe
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.22000.282 (WinBuild.160101.0800)
  • Product Version: 10.0.22000.282
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/72
  • VirusTotal Link: https://www.virustotal.com/gui/file/6a036f053d295a2119d5296896b190d5ed9330aaf5d78a866cd38dd23b856c28/detection

File Similarity (ssdeep match)

File Score
C:\WINDOWS\system32\AppVDllSurrogate.exe 32
C:\WINDOWS\system32\AppVDllSurrogate.exe 33
C:\Windows\system32\AppVDllSurrogate.exe 36
C:\Windows\system32\AppVFileSystemMetadata.dll 35
C:\Windows\system32\AppVManifest.dll 25
C:\Windows\system32\AppVNice.exe 40
C:\Windows\system32\AppVNice.exe 44
C:\WINDOWS\system32\AppVNice.exe 38
C:\Windows\system32\AppVNice.exe 36
C:\WINDOWS\system32\AppVNice.exe 49
C:\Windows\system32\AppVScripting.dll 38
C:\Windows\system32\AppVShNotify.exe 33
C:\Windows\system32\AppVShNotify.exe 32
C:\Windows\system32\AppVShNotify.exe 41
C:\WINDOWS\system32\AppVShNotify.exe 33
C:\Windows\system32\AppVShNotify.exe 44
C:\Windows\system32\AppVStreamingUX.dll 36
C:\Windows\system32\AppVStreamMap.dll 36
C:\Windows\system32\mavinject.exe 36
C:\Windows\system32\mavinject.exe 33
C:\WINDOWS\system32\mavinject.exe 36
C:\Windows\system32\mavinject.exe 38
C:\WINDOWS\system32\mavinject.exe 38
C:\Windows\system32\mavinject.exe 33

MIT License. Copyright (c) 2020-2021 Strontic.