{
  "Name": "Pcvisit",
  "Category": "RMM",
  "Description": "Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2025-12-14",
  "Details": {
    "Website": "https://www.pcvisit.de/",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "pcvisit.exe",
      "pcvisit_client.exe",
      "pcvisit-easysupport.exe",
      "pcvisit_service_client.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "*.pcvisit.de",
          "pcvisit.de"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/pcvisit_network_sigma.yml",
      "Description": "Detects potential network activity of Pcvisit RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/pcvisit_processes_sigma.yml",
      "Description": "Detects potential processes activity of Pcvisit RMM tool"
    }
  ],
  "References": [
    "https://www.pcvisit.de/"
  ],
  "Acknowledgement": [],
  "CodeSigning": {
    "search_names": [
      "pcvisit-easysupport.exe",
      "pcvisit.exe",
      "pcvisit_client.exe",
      "pcvisit_service_client.exe"
    ],
    "company_names": [],
    "signer_names": [
      "Adobe Systems Incorporated",
      "Martin Prikryl",
      "pcvisit software ag"
    ],
    "certificates": [
      {
        "signer_name": "Adobe Systems Incorporated",
        "certificate_thumbprint": "N/A",
        "tbs_sha256": "",
        "tbs_sha1": "7EF13196EC47F2AB7072D93A679AE21C13C764EB"
      },
      {
        "signer_name": "pcvisit software ag",
        "certificate_thumbprint": "N/A",
        "tbs_sha256": "",
        "tbs_sha1": "85E765462871AC9D332C18A9B833A862E2811C83"
      },
      {
        "signer_name": "Martin Prikryl",
        "issuer": "CN=COMODO Code Signing CA 2",
        "certificate_thumbprint": "ED06995F21BEC16EDF3112F91E121926C7782BB4",
        "tbs_sha256": "5CDFA7F5F971770D3C1DC097CAD683A24D38A832B87DC56FD67834F9EA5EFCF2",
        "tbs_sha1": "D2F63F6BE83E61B9E64E25752802F7F06F8B5BE5",
        "valid_from": "2011-09-21T00:00:00+00:00",
        "valid_to": "2014-09-20T23:59:59+00:00",
        "certificate_der_base64": "MIIFITCCBAmgAwIBAgIRAOZqfSBqWcLz1wT8Wnqxy4cwDQYJKoZIhvcNAQEFBQAwezELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxITAfBgNVBAMTGENPTU9ETyBDb2RlIFNpZ25pbmcgQ0EgMjAeFw0xMTA5MjEwMDAwMDBaFw0xNDA5MjAyMzU5NTlaMIGPMQswCQYDVQQGEwJDWjEPMA0GA1UEEQwGMTIwIDAwMQ8wDQYDVQQIDAZQcmFndWUxETAPBgNVBAcMCFByYWd1ZSAyMRkwFwYDVQQJDBBMb25keW5za2EgMjE3LzMzMRcwFQYDVQQKDA5NYXJ0aW4gUHJpa3J5bDEXMBUGA1UEAwwOTWFydGluIFByaWtyeWwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCussTW+t2obGP1zx2DhDWMRTb+pTniJ61dDbCIt6wesxFCQipCwI5cY+D66mJGOHBK8C/QL9ua2t/ufOs5yXwaizZcxRa5B608GZBdQFDZ4BFHkYUQHp93zJfNVsQjmRILJOj9n/a8p7O+7ftjQiD+reU+hFRfnKpklc5SEreEaOz8W6gGoEGLPP08SQpmMbFenP5uH3GPlNd2ooTL2itnQWKTkaiDk9+OYFp+kGKQoBmuHJQWUtdzoFsaZA8EEud72arYkPVndkk977J4/kO02cPIp8SAl1QAgFgtPc4TH18wc8QNi0XOj0QMhOgWD4AxBBYijx1YDXKlQsvaCTs/AgMBAAGjggGJMIIBhTAfBgNVHSMEGDAWgBQexbEsfYfaAmh8JbwMB4Q/ts/e8TAdBgNVHQ4EFgQUefpxehBGjv+Zk08UMxeixlojTbwwDgYDVR0PAQH/BAQDAgeAMAwGA1UdEwEB/wQCMAAwEwYDVR0lBAwwCgYIKwYBBQUHAwMwEQYJYIZIAYb4QgEBBAQDAgQQMEYGA1UdIAQ/MD0wOwYMKwYBBAGyMQECAQMCMCswKQYIKwYBBQUHAgEWHWh0dHBzOi8vc2VjdXJlLmNvbW9kby5uZXQvQ1BTMEEGA1UdHwQ6MDgwNqA0oDKGMGh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0NPTU9ET0NvZGVTaWduaW5nQ0EyLmNybDByBggrBgEFBQcBAQRmMGQwPAYIKwYBBQUHMAKGMGh0dHA6Ly9jcnQuY29tb2RvY2EuY29tL0NPTU9ET0NvZGVTaWduaW5nQ0EyLmNydDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuY29tb2RvY2EuY29tMA0GCSqGSIb3DQEBBQUAA4IBAQCqK7XXoyAnWpFNEpdZwj1kBRempuDDaMEf8CcDlnhZYUij0uU4mudpA/bQWJsrbE/J8Y+YE6gfDRsqgH32rivQWN7Oz1xLbb3T5rUqj4qePjkGA0qJorP2SyQ+28Ck8mR7YG2cKHsboliZtUBHkUXmeHBMcujfr8KMyq2NC+CA105hfoRYHbR+9L+y4lcor48vGVArycIV1FVt/1ILR4M9IFp1GXGYYLt4hggsSN2PLg/KTwD9Ai+w1HPaIAoworh1/1H5IlZUJilbsvZ6oApgRPbm2d/PWbAefgOHCFM+H46iJ5d3OaWTuJmb4XuZCJ81fMDzU1Nl5pJ7ZjRaOuHl"
      },
      {
        "signer_name": "pcvisit software ag",
        "issuer": "CN=Thawte Code Signing CA - G2",
        "certificate_thumbprint": "A2183200DC3C802E5699B3068BE452CE2A0D689B",
        "tbs_sha256": "458ABB4B93C3B182FFF61AB4EE3877574461BAB7C168B2E8E2850E39C5F4A4AC",
        "tbs_sha1": "85E765462871AC9D332C18A9B833A862E2811C83",
        "valid_from": "2012-07-11T00:00:00+00:00",
        "valid_to": "2014-07-11T23:59:59+00:00",
        "certificate_der_base64": "MIIEFzCCAv+gAwIBAgIQOzYOvN8sEvEadacupQycrjANBgkqhkiG9w0BAQUFADBKMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMVGhhd3RlLCBJbmMuMSQwIgYDVQQDExtUaGF3dGUgQ29kZSBTaWduaW5nIENBIC0gRzIwHhcNMTIwNzExMDAwMDAwWhcNMTQwNzExMjM1OTU5WjBtMQswCQYDVQQGEwJERTEQMA4GA1UECBMHU2FjaHNlbjEQMA4GA1UEBxMHRHJlc2RlbjEcMBoGA1UEChQTcGN2aXNpdCBzb2Z0d2FyZSBhZzEcMBoGA1UEAxQTcGN2aXNpdCBzb2Z0d2FyZSBhZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJwaTPqJWn37/VAIJeEjqEyqwNrznB9ybSJHSjefZ3d28fJCRErmJmGgAdEVXz4HD3PrmhONxjgafh8RP793b/7HOe7Yvk3dvjD4CHYRvZlwHWn/25LL4n7xuIPrQtwpIJ2pGNBviv9mfAYXNwD+hNMIzLsaGiBwOufquZbGcGwfydXCihWpARvcOpJ/SlmkwpVCHwtsn6do/sMZ09bcWF+JN6HZ3cDdQtu2ld5WJ7k9EBLGzlmpBhrC5CcQgW6xd3fPIAdpC+4TBpsfmbuqJyVmxkxXHhMkHO8JJ6ooF0GWxQctv6jk2WY+ouFPfn63qWQTKt3+GGj0jwhRrKeo2rsCAwEAAaOB1TCB0jAMBgNVHRMBAf8EAjAAMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9jcy1nMi1jcmwudGhhd3RlLmNvbS9UaGF3dGVDU0cyLmNybDAfBgNVHSUEGDAWBggrBgEFBQcDAwYKKwYBBAGCNwIBFjAdBgNVHQQEFjAUMA4wDAYKKwYBBAGCNwIBFgMCB4AwMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC50aGF3dGUuY29tMBEGCWCGSAGG+EIBAQQEAwIEEDANBgkqhkiG9w0BAQUFAAOCAQEAdMIbFUmobGxOyB1ieABowLsJh9GK/sjo2yADgDgVZr5vvQzWAjHHAKd1MNmAUi71Ov3Euaza9huekaZrD5JVxLw5I4EXXNXCtOpu8Kaez7vSTHcvoW2+X/NWUq5Gdxzq9DdAjjT/jnWmcj9NalSXkhaNWLMIDZFPfAgx1xdnSeLNy7GB28MFIpI5f6OZfwnRbHFm3GkRXBSp4+8oPDP0SPF5xFAxccHc+dkcaGC5Sw4OLqXtQ9BWzMZ6Rhwm3dzGCmKreyw7tLFOvW+p9PvWAp8IByd84IvD0uMS9+4LYveSco9CN5VBex/ry89L/paFlTy5QpZMNaWUOMiBz5DH+Q=="
      },
      {
        "signer_name": "Adobe Systems Incorporated",
        "issuer": "CN=VeriSign Class 3 Code Signing 2010 CA",
        "certificate_thumbprint": "FDF01DD3F37C66AC4C779D92623C77814A07FE4C",
        "tbs_sha256": "6F11994EC8673B1FDBFB8A08F0AA78F13FC2BE6890F6F5E386FE9FCAE64D2CA4",
        "tbs_sha1": "7EF13196EC47F2AB7072D93A679AE21C13C764EB",
        "valid_from": "2010-12-15T00:00:00+00:00",
        "valid_to": "2012-12-14T23:59:59+00:00",
        "certificate_der_base64": "MIIFFjCCA/6gAwIBAgIQFeWsCkhwY3GOOdpSMBoEiDANBgkqhkiG9w0BAQUFADCBtDELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykxMDEuMCwGA1UEAxMlVmVyaVNpZ24gQ2xhc3MgMyBDb2RlIFNpZ25pbmcgMjAxMCBDQTAeFw0xMDEyMTUwMDAwMDBaFw0xMjEyMTQyMzU5NTlaMIHdMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTERMA8GA1UEBxMIU2FuIEpvc2UxIzAhBgNVBAoUGkFkb2JlIFN5c3RlbXMgSW5jb3Jwb3JhdGVkMRwwGgYDVQQLFBNJbmZvcm1hdGlvbiBTeXN0ZW1zMT4wPAYDVQQLEzVEaWdpdGFsIElEIENsYXNzIDMgLSBNaWNyb3NvZnQgU29mdHdhcmUgVmFsaWRhdGlvbiB2MjEjMCEGA1UEAxQaQWRvYmUgU3lzdGVtcyBJbmNvcnBvcmF0ZWQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOOsWw50PLi3ulRVRS2iVzHvqrb1ALTqXh+fjRAr9UGy8aQw40Pi+A/rEL2fy9Y1GlYsxtXRE2s6XqJGkouXeqhdjZMl5cNFVrfAD7KsD4KuVBXORLYrKlqND3L7p4BM1mkqNvSO6Lwkp7WbmT+weEoxYzX6Qh/WYUuX5/ZMXcFpAgMBAAGjggF7MIIBdzAJBgNVHRMEAjAAMA4GA1UdDwEB/wQEAwIHgDBABgNVHR8EOTA3MDWgM6Axhi9odHRwOi8vY3NjMy0yMDEwLWNybC52ZXJpc2lnbi5jb20vQ1NDMy0yMDEwLmNybDBEBgNVHSAEPTA7MDkGC2CGSAGG+EUBBxcDMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9ycGEwEwYDVR0lBAwwCgYIKwYBBQUHAwMwcQYIKwYBBQUHAQEEZTBjMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC52ZXJpc2lnbi5jb20wOwYIKwYBBQUHMAKGL2h0dHA6Ly9jc2MzLTIwMTAtYWlhLnZlcmlzaWduLmNvbS9DU0MzLTIwMTAuY2VyMB8GA1UdIwQYMBaAFM+Zqep7JvRLyY6P1/AFJu/j0qedMBEGCWCGSAGG+EIBAQQEAwIEEDAWBgorBgEEAYI3AgEbBAgwBgEBAAEB/zANBgkqhkiG9w0BAQUFAAOCAQEAquu3mUtIU0XYXxhaOsniYeUzFWU+FbgcZn6ixHRXqwx/PC3iRfsl25VqyUgQ287ZKnEe/NsezeHsN5aBz5u7MkYRF1BY8z/GISgJC4ip1IL9rF8Y0QDqLGQJK8IeTobVH4/1lBNqi1RoNCdkDHFaR6K8z5iP9CZM8XgwRNkv8JXEQBA0iMM5I5yicFtbfhX2pYyC5MRGSMADI+qF6WaEQXv6qdyK+fzoCzXN6tPUHBvfq65ABqn92mh5iAywIUgz4liR4jTRNoJYp4ADyxSDUiAfdoohIrj/xGP6wIhZtBXygx6yX3rY0MCNr3lia2dbYGCarw8bACigl9b7ShHetA=="
      },
      {
        "signer_name": "pcvisit software ag",
        "certificate_thumbprint": "0C371BE84975964A87BF480676D3CEEBFC88CD60",
        "certificate_der_base64": "MIIG0zCCBLugAwIBAgIQCpdzgUj4YjGltRIsud/y7zANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTI0MDcwMTAwMDAwMFoXDTI3MDYzMDIzNTk1OVowWzELMAkGA1UEBhMCREUxEDAOBgNVBAcTB0RyZXNkZW4xHDAaBgNVBAoTE3BjdmlzaXQgc29mdHdhcmUgYWcxHDAaBgNVBAMTE3BjdmlzaXQgc29mdHdhcmUgYWcwggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQDrpE0WaSiWbRdhuN6GYLpZH0Eb/L/M/mqaqdODzKecidtvtoustcygusAHAUMH3N4t876FimpfWgGu/wsSdRcRMxB7OwlgS1dtyo6GnturZXDdqbwHKOomEUeG+IxUlZCKZTPFEflz6c1j7wAa1UlzmsVe5UiaQdaUU8WOX/DTK+rHGERaCtmoe/KFSS1ninUA1jjiXNxe6gLTAyT+EcPtWHcXsF2H4aCyQb95zBVGhWrCZ2Hz/QaqIwFnhixOUxAoWm6OMOc90I7annvSkdxMlFNe7lKSfLnGeFaseZ1nhT5DyUUv6qzvB+hg2TDYV24eehO8q93FYBNKyK2/CLm3x+sVFWduboGNL8aD9ZWKTCP6MhAS+MwtSQM6m3yah7fcjGEfPJr5+iPmbN9Nnnl+fGeEmXAx43Yq7ablAK4g4XEta1bOAgERS/eFfyduzmzRMz8IKmqVDB5qbIpZVu/IvIFw8b4YBu39DfPXPBapoSD4E8AUmbSxtvztaF05VR0CAwEAAaOCAgMwggH/MB8GA1UdIwQYMBaAFGg34Ou2O/hfEYb7/mF7CIhl9E5CMB0GA1UdDgQWBBRGIE/KV1k0HAMXeWnTKf/hQSZkUDA+BgNVHSAENzA1MDMGBmeBDAEEATApMCcGCCsGAQUFBwIBFhtodHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMDMIG1BgNVHR8Ega0wgaowU6BRoE+GTWh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3JsMFOgUaBPhk1odHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNybDCBlAYIKwYBBQUHAQEEgYcwgYQwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBcBggrBgEFBQcwAoZQaHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcnQwCQYDVR0TBAIwADANBgkqhkiG9w0BAQsFAAOCAgEAvRusr7U/ZesCiOzDyT/WfC3fF4TkxKQ4p/6J5aS1YIZzC1nPtPqfirYK99r3H4VHL5XTJAn+W94hDl4YCmiwDVeVe52LQT3acUHC8I/pw+uULYKj1lBNGUqhn2BwEQWef/tAe88GNrYTDsLK1XCixjnj22KF6zyj4hGcZNhJaHeJ7uOAmR4tubDM3DGFFbNh/Af3GeOanBv54hZLyB5J2dOVylS8Fpvk4HpdZ16FO3lc3pK892XXRWdodRuVpy6QnxC1p4+TXnFitQ+mRi3ngkMF14sNacVqXoH4RYPx5O2eGjJ0cLL2uj1G1dQIfN8vqRMGOs1wg2dCXWcvhO6ZLGz6EILtuYnHjqc+9ITbVbEF2t1z0MhHlFGgJf5/r1grx4ePmYBisbLqHaotd2pkDNMOaZHRjh2foAkXYFSgWsqyS6rzxklt2Vw+WZcjrXGIjtUfguZ3OQ3BZ1OSVC6/BS+5KGqB7Bbz0b+RRTO9FXHmbt6z3ergntrTXt1QbbNBs4OXE4tkMNNjzsi1yD9XtENrx6OdejTiBtNi6nlHoaUSY1xiXfJmz2veceKFqhqHYCEi8zWjGFylAk8fDuwvIvkRss5WKt6vC9QEc3w6B/LOhD8LQSOZJm/mG9nwHI6U024E255NmBRoz3b9Bx4lVh1QNNPWFYqL8FVS7Z7ajAY=",
        "src_file_sha256": "57fa4781f5817841c56b058c0b244318bc18aaa3c842ee3d74294de2441f1da1",
        "src_file_path": "downloaded_files/pcvisit/57fa4781f5817841c56b058c0b244318bc18aaa3c842ee3d74294de2441f1da1",
        "src_file_company": "pcvisit Software AG"
      }
    ]
  }
}