File scan report
Verdict Suspicious
Is Screen
Validly signed ScreenConnect remote-access client installer, preconfigured to connect to one specific relay server and flagged by 14 of the 63 antivirus engines that checked it…
Read the whole reasonShow less
Why Suspicious? 14 antivirus engines flag it and a sandbox test run rated it as risky.
Moderate evidence · More than one sign points to a problem, but nothing confirms it is harmful.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't install it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already installed it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
14 of 63 flagged
- Flagged 14
- No detection 49
- No result 12
- Code signing ConnectWise, LLC
- Test run Completed
- First seen 26d ago
Chapter 02
Why we think so
5 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This installer sets up a ScreenConnect remote-access client that links the computer to a specific operator's relay server. Most of the 14 detections out of 75 engines label it remote-administration or risky software rather than a named malware family. It is only safe to run if you personally requested support from someone you trust, because whoever controls that server can take control of the PC.
The file carries a valid signature from ConnectWise, LLC, and the engine labels mostly describe the ScreenConnect remote-access product itself. Kaspersky calls it not-a-virus RemoteAdmin, Fortinet calls it Riskware, and two further engines use backdoor or trojan labels. In the sandbox runs, the installer ran ordinary installer custom actions and connected to an instance-specific relay host, which means the client is bound to a particular operator. The file was submitted by only two sources, which matches a one-off client build handed to a single person. That pattern fits a legitimate support session, but it is also how remote-access scams gain control of victims' PCs. Earlier ScreenConnect client builds with this signer received the same cautious assessment.
What We Detected
14 of the 63 antivirus engines that checked it flagged this Windows Installer, including five major antivirus engines. Kaspersky, Fortinet and Trellix label it ConnectWise remote-administration or risky software, while DrWeb and Microsoft use backdoor or trojan labels. The installer carries a valid signature from ConnectWise, LLC.
Threat Behavior
In the sandbox runs, the installer launched standard Windows Installer custom actions and contacted a ScreenConnect relay server assigned to one specific operator instance. The combined sandbox verdict was malicious, with a greyware tag. No injection into other processes was recorded. Once installed, the client gives whoever runs that relay server remote control of the computer.
What To Do Now
Run this installer only if you deliberately started a support session with an organisation you know and trust. If someone sent it to you unprompted, for example a caller claiming to be from your bank, tech support or a delivery company, do not run it. If it is already installed, uninstall ScreenConnect Client, disconnect from the internet, and change your passwords from another device. Keep your antivirus enabled throughout.
Where this verdict could be wrong2 caveats
- DrWeb ('BackDoor.RA.364') and Microsoft ('Trojan:Win32/Leonem!rfn') use backdoor/trojan labels, and the combined sandbox label includes an evasion tag, which would fit an attacker-deployed client.
- The file carries a valid signature from the product's own publisher, and the observed installer activity contains nothing beyond what a remote-support client normally does.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Valid code signature from ConnectWise, LLC, matching the product the file identifies as
- Most engine labels describe a remote-administration tool rather than a named malware family
- Observed installer activity was ordinary, with no injection into other processes recorded
- Installs a remote-access client that gives an outside operator control of the computer
- Preconfigured to connect to one specific operator's relay server
- Flagged by 14 of the 63 antivirus engines that checked it, including backdoor and trojan labels from DrWeb and Microsoft
- The combined sandbox verdict was malicious, with an evasion tag
- Rarely submitted (two sources), typical of a one-off client build sent to a single person
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 4 isolated tests; 2 test environments rated what it did as risky.
Test run summary
Capture complete- 4isolated sandbox runs
- 11sandbox rule tags
- 5spawned processes
- 3network contacts
- 27filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Hid files or windows on the test computer.
Note: Deleted files or logs during the test run (installers often clean up after themselves).
Note: Read basic details of the test computer, such as its Windows version.
Note: Connected to 3 servers during the test run.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as spreading through USB drives; nothing confirms it.
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 7: FileSeen in the test run
ScreenConnect.ClientSetup.msi
c3e39852d76129e69410953391ff828689bf6a0840782db1fe1c730ad0ccce72
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 7: ProcessSeen in the test run
msiexec.exe
"C:\Windows\system32\msiexec.exe" /I "C:\Users\<USER>\Desktop\ScreenConnect.ClientSetup.msi" /qb ACCEPTEULA=1 LicenseAccepted=1
Test run - Evidence 3 of 7: ProcessSeen in the test run
msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\ScreenConnect.ClientSetup.msi"
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 7: Written fileSeen in the test run
opa12.dat
C:\PROGRA~2\MICROS~1\OFFICE\DATA\opa12.dat
Test run - Evidence 5 of 7: Written fileSeen in the test run
~DF020139FDAD87CF59.TMP
C:\Users\ADMINI~1\AppData\Local\Temp\~DF020139FDAD87CF59.TMP
Test run - +1 more recorded observation
- 2
Network
Hosts contacted
- Evidence 6 of 7: Contacted hostSeen in the test run
instance-xxwmfx-relay.screenconnect.com
Contacted during the test run.
Test run - Evidence 7 of 7: Contacted hostSeen in the test run
check.screenconnect.com
Contacted during the test run.
Test run - +1 more recorded observation
7 facts from the test run. See the full activity list.
Includes the sandbox verdicts, 11 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
14 of the 63 antivirus engines that checked it flag it; signed by ConnectWise, LLC.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 14
- DrWeb (major engine)BackDoor.RA.364
- Fortinet (major engine)Riskware/ConnectWise
- Kaspersky (major engine)not-a-virus:HEUR:RemoteAdmin.Win32.ConnectWise.gen
- Microsoft (major engine)Trojan:Win32/Leonem!rfn
- TrellixENS (major engine)ConnectWise
- alibabacloudBackdoor[rat]:Win/ConnectWise.gyf
- GoogleDetected
- huorongHackTool/ConnectWiseControl.j
File fingerprint
- Last analyzed
- Oct 21, 2026, 2:55 PM UTC
- SHA-256
c3e39852d76129e69410953391ff828689bf6a0840782db1fe1c730ad0ccce72- SHA-1
1a99cd9323506bbd55ee052d06f3d1dd3d2b7df9- MD5
4a4463c2d8ec3944a2a24759ea93d843
About this file
ScreenConnect.ClientSetup.msi is a Windows Installer file of 10.2 MB.
- Type and size
- Windows Installer · 10.2 MB
- Signer
- ConnectWise, LLCValid code signature.
- First seen
- Sep 29, 2026On VirusTotal.
- Submitted by
- 2 distinct sourcesRarely seen: few people have submitted this exact file.
First scanned Updated
Includes every engine result (75), 2 matched signature rules and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is ScreenConnect.ClientSetup.msi safe, or is it malware?
What is ScreenConnect.ClientSetup.msi?
How many antivirus engines detected ScreenConnect.ClientSetup.msi?
I already downloaded and installed ScreenConnect.ClientSetup.msi — what should I do?
Is ScreenConnect.ClientSetup.msi digitally signed?
What is the SHA-256 hash of ScreenConnect.ClientSetup.msi?
How up to date is this analysis of ScreenConnect.ClientSetup.msi?
Community
Member reviews and reports for this exact file hash.