Library / LOLBin
syncappvpublishingserver.exe
Microsoft Application Virtualization Sync Utility · Microsoft Corporation
OriginalFilename
syncappvpublishingserver.exe
Casing changed across buildsSome builds lack OriginalFilename
Gotchas
- 5 observed builds carry no OriginalFilename at all.
- Casing differs across builds (
SyncAppvPublishingServer.exe,syncappvpublishingserver.exe). Case-sensitive comparisons (Elastic KQL on keyword fields,==in KQL/EQL) miss some builds.
Query snippets
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith: '\syncappvpublishingserver.exe'
- OriginalFileName: 'syncappvpublishingserver.exe'
condition: selectionprocess_creation logsource. Sigma string matching is case-insensitive.
| tstats summariesonly=false count values(Processes.original_file_name) as original_file_name
from datamodel=Endpoint.Processes
where (Processes.original_file_name="syncappvpublishingserver.exe" OR Processes.process_name="syncappvpublishingserver.exe")
by Processes.dest Processes.process_name Processes.process_path Processes.process
| rename Processes.* as *Endpoint.Processes data model. On raw Sysmon events the field is OriginalFileName.
DeviceProcessEvents
| where ProcessVersionInfoOriginalFileName in~ ("syncappvpublishingserver.exe")
or FileName =~ "syncappvpublishingserver.exe"Microsoft Defender XDR advanced hunting. in~ and =~ are case-insensitive.
process where event.type == "start" and
(process.pe.original_file_name in~ ("syncappvpublishingserver.exe") or
process.name : "syncappvpublishingserver.exe")ECS process.pe.original_file_name is a keyword field: in~ is case-insensitive, Kibana KQL is not.
['syncappvpublishingserver.exe'].includes(String(OriginalFileName || '').toLowerCase())Filter expression (JavaScript) for events carrying Sysmon's OriginalFileName field.
Values across builds
| OriginalFilename | Builds | Arch | File version | Windows releases | Source | Sysmon |
|---|---|---|---|---|---|---|
| syncappvpublishingserver.exe | 12 | x64 | 10.0.18362.1139 → 10.0.28000.1896 | Win10 1903 → Win11 26H1 (13) | Host scan, Winbindex | ✓ 1 |
| none | 5 | x64 | Win10 1607 → Win10 1809 (5) | Winbindex | ||
| SyncAppvPublishingServer.exe | 3 | x86 | 10.0.14393.2273 → 10.0.16299.15 | Win10 1607 → Win10 1709 (3) | Winbindex |
All 20 parsed builds · 1 Windows release groups not verifiable
| SHA256 | Version | Arch | OriginalFilename | Windows releases | Signature | Source | Sysmon |
|---|---|---|---|---|---|---|---|
| 8baa8b75a8bc… | 10.0.28000.1896 | x64 | syncappvpublishingserver.exe | Win11 26H1 | Winbindex | ||
| 29bfcb4b1470… | 10.0.26100.8115 | x64 | syncappvpublishingserver.exe | Win11 24H2 | Signed (Overlay) | Host scan, Winbindex | ✓ |
| c701a358e2ff… | 10.0.19041.4355 | x64 | syncappvpublishingserver.exe | Win10 21H2, Win10 22H2 | Signed (Overlay) | Winbindex | |
| b211804865c2… | x64 | none | Win10 1607 | Signed (Overlay) | Winbindex | ||
| 878eaa95b35c… | 10.0.26100.1882 | x64 | syncappvpublishingserver.exe | Win11 24H2, Win11 25H2 | Signed (Overlay) | Winbindex | |
| 42ed436242bc… | 10.0.22000.2713 | x64 | syncappvpublishingserver.exe | Win11 21H2 | Signed (Overlay) | Winbindex | |
| f10abe0aa316… | 10.0.22621.3527 | x64 | syncappvpublishingserver.exe | Win11 22H2 | Signed (Overlay) | Winbindex | |
| bcf02179ac47… | x64 | none | Win10 1809 | Signed (Overlay) | Winbindex | ||
| 2d36a80b63c8… | 10.0.22621.2215 | x64 | syncappvpublishingserver.exe | Win11 22H2, Win11 23H2 | Signed (Overlay) | Winbindex | |
| 313232c634a2… | 10.0.19041.1566 | x64 | syncappvpublishingserver.exe | Win10 20H2 … Win10 22H2 (3) | Signed (Overlay) | Winbindex | |
| 178ea4f53b41… | 10.0.18362.1440 | x64 | syncappvpublishingserver.exe | Win10 1909 | Signed (Overlay) | Winbindex | |
| 53a78d6c3d05… | 10.0.19041.1320 | x64 | syncappvpublishingserver.exe | Win10 2004, Win10 20H2 | Signed (Overlay) | Winbindex | |
| 81020628316f… | 10.0.19041.867 | x64 | syncappvpublishingserver.exe | Win10 2004 … Win10 21H2 (3) | Signed (Overlay) | Winbindex | |
| a0e02aa983e1… | x64 | none | Win10 1803 | Signed (Overlay) | Winbindex | ||
| 6394e0ae8feb… | x64 | none | Win10 1703 | Winbindex | |||
| 42be3e33c67c… | 10.0.18362.1139 | x64 | syncappvpublishingserver.exe | Win10 1903, Win10 1909 | Signed (Overlay) | Winbindex | |
| 3aff7c024717… | x64 | none | Win10 1709 | Signed (Overlay) | Winbindex | ||
| d0f6ec40596e… | 10.0.16299.15 | x86 | SyncAppvPublishingServer.exe | Win10 1709 | Signed (Overlay) | Winbindex | |
| 6499dfc4e187… | 10.0.15063.608 | x86 | SyncAppvPublishingServer.exe | Win10 1703 | Signed (Overlay) | Winbindex | |
| b01eba25e204… | 10.0.14393.2273 | x86 | SyncAppvPublishingServer.exe | Win10 1607 | Signed (Overlay) | Winbindex |
Winbindex builds link to the Microsoft symbol server copy that was hashed and parsed.