Text-suffixed path appears in service setting and execution argument
A numbered `.txt` path was written to a service’s `ServiceDll` setting and appeared in a service-hosted process launch consistent with DLL execution. The overlap identifies an execution-related role for the path, but the records do not prove the file’s contents, successful execution or a continuous installation sequence.
A process named Remote Data.exe was launched by a Windows service host with a numbered .txt file as its argument. The process metadata identified its original filename as RUNDLL32.EXE, while a separate registry event pointed the “Remote Data” service’s ServiceDll setting at the same text-suffixed path. The question is not simply whether the filename looks suspicious: what role was this apparent document playing in service-related execution?
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read