VACSVIEWER-64 2.1.3
by R&D-TeamNotSigned
Sources: observed in the EchoTrail lab on Windows 11 on October 29, 2026.
The install
- Installer
- vacsviewer_64_v213b33.exe
- Installer type
- inno
- Installed through
- a type-detected silent switch
- Install directory
- C:\Program Files\RDTeam
- Launched
- VACSVIEWER_64.exe
- Windows
- Windows 11
- Date
- October 29, 2026
- Executables dropped
- 6
installer sha256 d116a5355f640be55c5adda1af968364498507deb59e474abf378b47ad24acdd
The lab used VACSVIEWER-64 for 2 minutes, changed a setting, ran its update check, then rebooted and watched what came back.
On screen
Frames from the lab session, cropped to VACSVIEWER-64's own windows.





What it dropped
Executables
- vacsviewer_64.exeNotSignedran during the lab sessionC:\Program Files\RDTeam\VACSVIEWER_64\VACSVIEWER_64.exesha256 3d7c7aa9cd7846a6afca8649d09567b6e4ce3a5f28754494824e48cfe85f03f1
- vacsimport_devices_64.dllC:\Program Files\RDTeam\VACSVIEWER_64\VacsImport_Devices_64.dll
- vacsimport_ballons_64.dllC:\Program Files\RDTeam\VACSVIEWER_64\VacsImport_Ballons_64.dll
- vacsimport_pulse_64.dllC:\Program Files\RDTeam\VACSVIEWER_64\VacsImport_Pulse_64.dll
- vacsimport_soundcheck_64.dllC:\Program Files\RDTeam\VACSVIEWER_64\VacsImport_SoundCheck_64.dll
- C:\Program Files\RDTeam\VACSVIEWER_64\unins000.exe
What it talked to
Destinations
- 217.160.0.170:80asked by vacsviewer_64.exe
DNS
- www.randteam.deasked by vacsviewer_64.exe