UNCServer.exe
by Various
Endpoint Management
Summary
UNC Server - UNC path sharing server for network file access.
UNCServer.exe is the 856th most commonly executed Windows program in EchoTrail's dataset, observed 3,271 times across enterprise environments. It typically runs from C:\Program Files (x86)\Lenovo\System Update and it is most often launched by tvsu.exe.
856th
most commonly executed Windows program
3,271
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Program Files (x86)\Lenovo\System Update100%
Top Hashes (SHA256)
- b49ebdfaab26ec52c22c5f69722c1e90949cc4350e017003d90394676e8ee8e774.59%
- 4d3ded95cd00365656872a7ce41d30773c8163d8fc25ec7602ec4cb27ccf7c1011.43%
- fd8e911272b7753b9e9f759c88107fd1c03b1c5c75fc4189d1c00e587db0be7e5.26%
- 59324b3ccd83b33114cc8a0a235da723b29b9cd32a6463b03fdfa7f2706d280d4.92%
- 109809cf3393317b45ec3efc9ac8189b86582c808e6ed4677fa49ab9c4650d792.69%
- 229ab9ac0c292edf55a7bd77c9f62304151228b00376a307c9d2ba50847abc901.1%
Process Ancestry
Top Grandparents
- tvsuShim.exe96.39%
- explorer.exe1.41%
- SUService.exe0.95%
- cmd.exe0.61%
- runonce.exe0.61%
- RuntimeBroker.exe0.03%
Top Parents
- tvsu.exe99.05%
- UACSdk.exe0.95%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about UNCServer.exe
Rocky answers questions about UNCServer.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.