AppPatch svchost.exe execution is tied to a Winlogon launch setting
A hash-identified executable ran from the AppPatch directory, and a separate registry event added that path alongside userinit.exe in a logon-related setting. The records support a potential future launch point, but do not show that the setting later launched the file or establish a continuous installation sequence.
A process named svchost.exe ran from C:\Windows\AppPatch\svchost.exe, with another svchost.exe in a Downloads directory recorded as its parent. A separate registry event placed the AppPatch executable’s path alongside userinit.exe in a Winlogon setting. The combination raises a more consequential question than whether a filename looks suspicious: was this system-looking location also being made a future launch point?
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read