RMM
PDQ Connect
PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.
Tool overview
- Category
- RMM
- Research authors
- Not recorded
- Created
- 2024-08-02
- Last modified
- 2025-12-14
- Privileges
- Not recorded
- Free / availability
- Not recorded
- Verification required
- Not recorded
- Supported platforms
- Not recorded
Executables & installation paths
- Filename
- Not recorded
- OriginalFileName
- Not recorded
- Description
- Not recorded
Installation paths
pdq-connect*.exe
PDQConnectUpdater-*.msi
Code signing
- signer name
- PDQ.com Corporation
- certificate thumbprint
- 8AB2A176E3B80545CE2E15ED12D186B9EF53C108
- tbs sha256
- 4C3ADBB8A2662E65EC5C714632D015950295E0F8383D25FD125D1EA4994525B5
- tbs sha1
- Not recorded
- signer name
- PDQ.com Corporation
- certificate thumbprint
- E706901A2E7EB16DA4D420BF61BBC47BFBBF8CE6
- tbs sha256
- 6D661EF88C0FAA44D96DD73137EE50A09E9A1BA9180A8A850A6A6D708DA2004E
- tbs sha1
- Not recorded
- signer name
- PDQ.com Corporation
- issuer
- CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
- certificate thumbprint
- 7B4313B6CDB8176DFAAB4125E51651E2A813AB74
- tbs sha256
- 476A0D993DE124D3925AD602D11F294C1D374A3ACF50567A5928D269840993E4
- tbs sha1
- 7C423168C986239661A17B2199D0ADFF457188CA
- valid from
- 2025-08-07T00:00:00+00:00
- valid to
- 2028-09-21T23:59:59+00:00
search names
msi8c70.tmp
pdq-connect-agent.exe
pdq-connect.exe
pdqconnectupdater-.msi
pdqconnectupdater-setup.exe
company names
signer names
PDQ.com Corporation
File hashes
- authenticode
- file name
- pdqconnectupdater-setup.exe
- sha256
- DC91E1507E9DDD1FDB6089204745D1A5DC34B58AD1C8971B91D1F8DE91A9097F
- sha1
- CF2244E33899080106C9600EBFBB400DB956C0B2
- file name
- pdqconnectupdater-setup.exe
- sha256
- 8B589F83D7DDA927AF5A37EC16620C2818475A59B26BFDF8C385B6A01B9411A2
- sha1
- 66861A75A8F1C70B91B1A7D8067B88E218561963
- file name
- pdqconnectupdater-setup.exe
- sha256
- 3311BCD8BCFCEF75A8E28058ABEB468115EE2AA89E914A07DDF7F09C36205166
- sha1
- A201099C0708137F1904CA0C32AF369568FA3502
- file name
- pdq-connect-agent.exe
- sha256
- DAD414979334FA5F5BCD41AFA38AEC1CEB73AF35067233C16C6CEE468C57CBFE
- sha1
- B73678A32046FCC1CC7FDDF51D25EF362D14BDBC
- file name
- pdqconnectupdater-setup.exe
- sha256
- FA4B54628A7EB0D2E00121E7C9E99599D0C5D4753C3B7FC94D44DB0C5FA08652
- sha1
- 78EDE3F92667D17CF74B5968DD0CB5093DC97AF3
- file name
- MSI8C70.tmp
- sha256
- F795EA98AA00776AEC80D2B71E791BC0A46E973E9CFDF4C8DE29D3696CDDBA1B
- sha1
- 110B1C819D1967B94026C0E8E8ECCFAB7060E14F
- page
- file name
- pdqconnectupdater-setup.exe
- sha256
- B010BBBD1F47F82F875DFAD737728B2BD986E7948389A8EDF770CD20249D5B19
- sha1
- 69FEC87441B8D54397E018F9464A087F21EBC03D
- file name
- pdqconnectupdater-setup.exe
- sha256
- 0795852574BC4CFA156C5D687EEE420CEF4F085ADAD5F3CEDB234E0D320D98C9
- sha1
- F66BDF0363ADFC41A5F67250B66C9A9618E0BB88
FORENSIC EVIDENCE
Disk artifacts
- File
- C:\ProgramData\PDQ\PDQConnectAgent\PDQConnectAgent.db-journal
- Description
- Journal file that is part of the database system used by the PDQ Connect Agent to manage and store data related to its operations
- OS
- Windows
FORENSIC EVIDENCE
Network artifacts
- Description
- Known remote domains
- Domains
- app.pdq.com
- cfcdn.pdq.com
- pdqinstallers.*.r2.cloudflarestorage.com
- Ports
- Not recorded
Detections
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/pdq_connect_network_sigma.yml
- Description
- Detects potential network activity of PDQ Connect RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/pdq_connect_files_sigma.yml
- Description
- Detects potential files activity of PDQ Connect RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/pdq_connect_processes_sigma.yml
- Description
- Detects potential processes activity of PDQ Connect RMM tool