Same-hash executable ran as svchost.exe and gained a logon launch setting

A file recorded as C:\121972984215590\svchost.exe had the same SHA-256 as the executable under examination, appeared beneath that sample in a sandbox process tree, and was named in a registry setting for launch at logon. The combination changes the meaning of the familiar filename: this was not simply a reference to a Windows service host, but the examined executable’s content operating under that name. The same analysis also recorded an HTTP request to 185.215.113.10.