AppVShNotify.exe
Summary
Microsoft Application Virtualization (App-V) Shell Notification - integrates App-V virtual applications with the Windows shell for seamless user experience.
AppVShNotify.exe is the 663rd most commonly executed Windows program in EchoTrail's dataset, observed 6,285 times across enterprise environments. It typically runs from C:\Program Files\Common Files\microsoft shared\ClickToRun and it is most often launched by OfficeClickToRun.exe.
Behavior
Top Paths
- C:\Program Files\Common Files\microsoft shared\ClickToRun99.94%
- C:\Program Files\Microsoft Office 15\ClientX640.06%
Top Hashes (SHA256)
- a753bdd229ca56c67de3bcfdf78e1815cace9acdf313263f4b736c95be97f35c14.75%
- 5f3ac320f6262749c10b0ab4c8f17f228573bd2d19ba598efdc2defe1397ec8712.92%
- 6d54694077faf07473196da7b7f1c6981c8ad6a462fcea4777a80cfc6bc5769e11.07%
- 81222b186641305d60733259d2b8aaec9943b2de47dbe9c3e1760d6cbf2fd5a58.77%
- 1d150c0e7ffb8ba3eef7f3b7e5f1cf00eda542c19734f7160fa79c3210fe2de57.18%
- f2e074572ad726f47f63ca6bbfaf2511f859736b2081d2285fa19506e17400067.12%
- 398e9d34c9d462ad456a265c44a61706c3d8704687fddc366187e192ad8617415.17%
- 4273c1d046a0fd9bbf953ecb3d34b9224869f993545bd24f38d9925f0c39701b4.74%
- 38fa342b475c22d77c7f08282f8abde14d22380561d17c5c3a353e5ca277adb94.37%
- 32e4aa4ebd2b9ee9dc35d3f6247e06e700af6ec668252ed9aeb43fbd365308454.29%
Process Ancestry
Top Grandparents
- services.exe99.96%
- LTSVC.exe0.04%
Top Parents
- OfficeClickToRun.exe99.98%
- Defrag.exe0.02%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does AppVShNotify.exe normally do?
Runs in App-V environments to handle shell extension notifications for virtualized applications.
When is AppVShNotify.exe suspicious?
Running in environments that do not use App-V. Spawning unexpected child processes. Loading DLLs from non-standard paths.
How do attackers abuse AppVShNotify.exe?
Can be used as a signed binary proxy for execution. Loads DLLs from specific paths that can be hijacked. Only relevant in non-App-V environments where execution is inherently suspicious.
Detection guidance
Alert on execution in environments not using App-V. Monitor DLL loads.
False positive notes
Normal in App-V environments.
MITRE ATT&CK techniques
Related Processes
Ask Rocky about AppVShNotify.exe
Rocky answers questions about AppVShNotify.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.