Different filenames hide one executable in launcher process tree
A sandbox process tree links a launcher to a temporary `conhost.exe` and an AppData `svchost.exe` with identical content. Another `svchost.exe` has a different hash, making filenames an unreliable guide to the components; a Run value targets the AppData executable, though later logon execution is not shown.
A program recorded as 0CA02BB80457.exe produced a file named conhost.exe in a Windows Error Reporting temporary directory. The sandbox’s process tree placed that file beneath the original program—and placed an AppData svchost.exe beneath conhost.exe. Were these separate components, or the same executable operating under different names? The hashes change the interpretation.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read