Remcos RAT Screenshot Capture - time_/wnd_ Files Written to AppData

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the creation or writing of files within AppData directories matching specific naming patterns associated with Remcos RAT activity. Remcos typically generates files with a prefix of 'time_' or 'wnd_' followed by a timestamp string in these locations to store collected data or screenshots.