File scan report
Verdict Suspicious
Is Screen
Signed ConnectWise remote-admin installer flagged by three major antivirus engines with no prior signer history.
Read the whole reasonShow less
Why Suspicious? 11 antivirus engines flag it; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
Verify the installer came from ConnectWise’s official channel; if the source is trusted, the file is expected remote-admin software; otherwise exercise caution.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
11 of 71 flagged
- Flagged 11
- No detection 60
- No result 4
- Code signing ConnectWise, LLC
- Test run Completed
- First seen 1mo ago
Chapter 02
Why we think so
3 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Three major antivirus engines label the file as remote-admin software and the sample is with no signer history.
The file carries a verified ConnectWise signature yet lacks any historical samples from that signer. Three major antivirus engines converge on a remote-admin family label. However, the single sandbox run returned no malicious verdict, contacted-no complete contacted-host reputation result was available, and the direct-IP rule notes that legitimate installers can exhibit the same traffic pattern. The combination of strong major consensus on a dual-use tool with zero prior reputation places the sample in mixed-signal territory.
What We Detected
11 of the 71 antivirus engines that checked it flagged the sample; three major antivirus engines (DrWeb, ESET-NOD32, Kaspersky) agreed on a remote-admin family. The binary is signed by ConnectWise and verified, but the signer has no recorded history in our database. Sandbox execution wrote several MSI-related files and contacted five external IPs, none of which appear in our malicious-host cache.
Threat Behavior
The observed MITRE technique T1562.001 (impair defenses) is consistent with remote-administration tooling that must disable security prompts. No persistence mechanisms, registry modifications, or dropped malicious files it created were recorded. The direct-IP behaviour rule matched, but the rule itself notes that legitimate installers can produce the same traffic.
What To Do Now
If this installer was obtained directly from the vendor’s official site, treat it as expected remote-admin software. Otherwise, verify the download source and keep security software enabled. Re-scan after any vendor update to confirm the signature remains valid.
Where this verdict could be wrong1 caveat
- This signer has no saved history — no historical samples for ConnectWise signer to confirm clean track record.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- verified ConnectWise signature
- sandbox returned no malicious verdict
- no malicious files it created or contacted hosts
- rare and with zero prior signer history
- major remote-admin consensus
- direct-IP traffic without domain resolution
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 11sandbox rule tags
- 3spawned processes
- 5network contacts
- 19filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Checked whether it was running on a test computer.
Moderate concern: Hid files or windows on the test computer.
Note: Talked to servers over the internet during the test run.
Note: Read basic details of the test computer, such as its Windows version.
Note: Looked through folders on the test computer (most installers do this).
Note: Loaded extra code modules while running.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 7: FileSeen in the test run
ScreenConnect.ClientSetup.exe
96f9de130643657d058edabb0f8765a7b9ad4e753cf9bc4718a2f2dcf9a28d30
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 7: ProcessSeen in the test run
msiexec.exe
C:\Windows\System32\msiexec.exe /i C:\Users\<USER>\AppData\Local\Temp\ScreenConnect\26.5.3.9691\f497cb742b3fd927\ScreenConnect.ClientSetup.msi SC_EXE_PATH=C:\Users\<USER>\Downloads\ScreenConnect.ClientSetup.exe
Test run - Evidence 3 of 7: ProcessSeen in the test run
ScreenConnect.ClientSetup.exe
"C:\Users\user\Desktop\ScreenConnect.ClientSetup.exe"
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 7: Written fileSeen in the test run
ScreenConnect.ClientSetup.msi
C:\Users\<USER>\AppData\Local\Temp\ScreenConnect\26.5.3.9691\f497cb742b3fd927\ScreenConnect.ClientSetup.msi
Test run - Evidence 5 of 7: Written fileSeen in the test run
ScreenConnect.InstallerActions.dll
C:\Users\<USER>\AppData\Local\Temp\MSIC583.tmp-\ScreenConnect.InstallerActions.dll
Test run - +1 more recorded observation
- 2
Network
Hosts contacted
- Evidence 6 of 7: Contacted hostSeen in the test run
34.193.20.205
Contacted during the test run.
Test run - Evidence 7 of 7: Contacted hostSeen in the test run
3.167.69.110
Contacted during the test run.
Test run - +1 more recorded observation
7 facts from the test run. See the full activity list.
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
11MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1112
- T1129· Loads modules
- T1497· Sandbox evasion
- T1497.001· Sandbox evasion
- T1562.001· Disables security
- T1564.002· Hides artifacts
Observed activity
Processes started
3Programs the file ran, with their command lines.
msiexec.exeC:\Windows\System32\msiexec.exe /i C:\Users\<USER>\AppData\Local\Temp\ScreenConnect\26.5.3.9691\f497cb742b3fd927\ScreenConnect.ClientSetup.msi SC_EXE_PATH=C:\Users\<USER>\Downloads\ScreenConnect.ClientSetup.exeScreenConnect.ClientSetup.exe"C:\Users\user\Desktop\ScreenConnect.ClientSetup.exe"msiexec.exeC:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\26.5.3.9691\f497cb742b3fd927\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\user\Desktop\ScreenConnect.ClientSetup.exe"
Network contacts
55 hosts, listed as 4 addresses, 1 link. Links show the host and path only.
- IP address
34.193.20.205 - IP address
3.167.69.110 - IP address
92.223.96.6 - IP address
23.11.32.159 - URL
http://crt.rootg2.amazontrust.com/rootg2.cer
Files
18Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\ScreenConnect\26.5.3.9691\f497cb742b3fd927\ScreenConnect.ClientSetup.msi - Written
C:\Users\<USER>\AppData\Local\Temp\MSIC583.tmp-\ScreenConnect.InstallerActions.dll - Written
C:\Users\<USER>\AppData\Local\Temp\MSIC583.tmp-\Microsoft.Deployment.WindowsInstaller.dll - Written
C:\Users\<USER>\AppData\Local\Temp\MSIC583.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll - Written
C:\Users\<USER>\AppData\Local\Temp\MSIC583.tmp-\ScreenConnect.Core.dll - Written
C:\Users\<USER>\AppData\Local\Temp\MSIC583.tmp-\ScreenConnect.Windows.dll
Show all 18 entries for files
- Written
C:\Users\<USER>\AppData\Local\Temp\MSIC583.tmp-\ScreenConnect.WindowsInstaller.dll - Written
C:\Users\<USER>\AppData\Local\Temp\MSIC583.tmp-\Microsoft.Deployment.Compression.dll - Written
C:\Users\<USER>\AppData\Local\Temp\MSIC583.tmp-\Microsoft.Deployment.Compression.Cab.dll - Written
C:\Users\<USER>\AppData\Local\Temp\MSIC9CA.tmp-\ScreenConnect.InstallerActions.dll - Written
C:\Users\<USER>\AppData\Local\Temp\MSIC9CA.tmp-\Microsoft.Deployment.WindowsInstaller.dll - Written
C:\Users\<USER>\AppData\Local\Temp\MSIC9CA.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll - Written
C:\Users\<USER>\AppData\Local\Temp\MSIC9CA.tmp-\ScreenConnect.Core.dll - Written
C:\Users\<USER>\AppData\Local\Temp\MSIC9CA.tmp-\ScreenConnect.Windows.dll - Written
C:\Users\<USER>\AppData\Local\Temp\MSIC9CA.tmp-\ScreenConnect.WindowsInstaller.dll - Deleted
C:\Users\<USER>\AppData\Local\Temp\MSIC583.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\MSIC9CA.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\MSICEAD.tmp
Mutexes
1Named locks a program uses so only one copy runs; malware families often reuse them.
\Sessions\1\BaseNamedObjects\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM host
8.8.8.8 - VM host
162.159.36.2
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache. 1 has no saved verdict and was not checked; that is missing coverage, not a finding.
- 9a390e26cca8c5be4572…df69e7Not checkedno saved verdict
Chapter 04
Technical details
11 of the 71 antivirus engines that checked it flag it; signed by ConnectWise, LLC.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 11
- DrWeb (major engine)Program.RemoteAdmin.975
- ESET-NOD32 (major engine)Win32/RemoteAdmin.ConnectWiseControl.Q potentially unsafe application
- Kaspersky (major engine)not-a-virus:HEUR:RemoteAdmin.Win32.ConnectWise.gen
- AhnLab-V3Unwanted/Win.ScreenConnect.C5923042
- GoogleDetected
- huorongHackTool/ConnectWiseControl.i
- JiangminTrojan.Agent.edgo
- VaristW32/ConnectWise.AB.gen!Eldorado
File fingerprint
- Last analyzed
- Oct 17, 2026, 1:23 PM UTC
- SHA-256
96f9de130643657d058edabb0f8765a7b9ad4e753cf9bc4718a2f2dcf9a28d30- SHA-1
5dbc5bb324326ef8d3af89ec386367658b239849- MD5
315119b16e8574c8c2261b8b3938a338
About this file
ScreenConnect.ClientSetup.exe is a Win32 EXE file of 12.8 MB.
- Type and size
- Win32 EXE · 12.8 MB
- Signer
- ConnectWise, LLCValid code signature.
- First seen
- Aug 29, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 7.66 of 8
First scanned Updated
Antivirus consensus
11 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines3flagged
- Tier-236 engines5flagged
- Low-trust17 engines3flagged
View all 75 engine results
- AhnLab-V3Malicious: Unwanted/Win.ScreenConnect.C5923042
- DrWebMalicious: Program.RemoteAdmin.975
- ESET-NOD32Malicious: Win32/RemoteAdmin.ConnectWiseControl.Q potentially unsafe application
- GoogleMalicious: Detected
- huorongMalicious: HackTool/ConnectWiseControl.i
- JiangminMalicious: Trojan.Agent.edgo
- KasperskyMalicious: not-a-virus:HEUR:RemoteAdmin.Win32.ConnectWise.gen
- VaristMalicious: W32/ConnectWise.AB.gen!Eldorado
- VBA32Malicious: BScope.Riskware.ConnectWise
- YandexMalicious: Riskware.RemoteAdmin!O4vT/8AeK2A
- ZillyaMalicious: Tool.Convagent.Win32.869
- AcronisClean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- ElasticClean
- EmsisoftClean
- F-SecureClean
- FortinetClean
- GDataClean
- GridinsoftClean
- IkarusClean
- K7AntiVirusClean
- K7GWClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Rarely uploaded, and first seen more than two weeks ago. Often niche legitimate software or internal tooling; not a strong malware signal on its own.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is ScreenConnect.ClientSetup.exe safe, or is it malware?
What is ScreenConnect.ClientSetup.exe?
How many antivirus engines detected ScreenConnect.ClientSetup.exe?
I already downloaded and ran ScreenConnect.ClientSetup.exe — what should I do?
Is ScreenConnect.ClientSetup.exe digitally signed?
What is the SHA-256 hash of ScreenConnect.ClientSetup.exe?
How up to date is this analysis of ScreenConnect.ClientSetup.exe?
Community
Member reviews and reports for this exact file hash.