File scan report
Verdict Suspicious
Is Screen
Validly signed ScreenConnect remote-access client installer, preconfigured to connect to one specific relay server and flagged by 14 of the 63 antivirus engines that checked it…
Read the whole reasonShow less
Why Suspicious? 14 antivirus engines flag it and a sandbox test run rated it as risky.
Moderate evidence · More than one sign points to a problem, but nothing confirms it is harmful.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't install it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already installed it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
14 of 63 flagged
- Flagged 14
- No detection 49
- No result 12
- Code signing ConnectWise, LLC
- Test run Completed
- First seen 26d ago
Chapter 02
Why we think so
5 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This installer sets up a ScreenConnect remote-access client that links the computer to a specific operator's relay server. Most of the 14 detections out of 75 engines label it remote-administration or risky software rather than a named malware family. It is only safe to run if you personally requested support from someone you trust, because whoever controls that server can take control of the PC.
The file carries a valid signature from ConnectWise, LLC, and the engine labels mostly describe the ScreenConnect remote-access product itself. Kaspersky calls it not-a-virus RemoteAdmin, Fortinet calls it Riskware, and two further engines use backdoor or trojan labels. In the sandbox runs, the installer ran ordinary installer custom actions and connected to an instance-specific relay host, which means the client is bound to a particular operator. The file was submitted by only two sources, which matches a one-off client build handed to a single person. That pattern fits a legitimate support session, but it is also how remote-access scams gain control of victims' PCs. Earlier ScreenConnect client builds with this signer received the same cautious assessment.
What We Detected
14 of the 63 antivirus engines that checked it flagged this Windows Installer, including five major antivirus engines. Kaspersky, Fortinet and Trellix label it ConnectWise remote-administration or risky software, while DrWeb and Microsoft use backdoor or trojan labels. The installer carries a valid signature from ConnectWise, LLC.
Threat Behavior
In the sandbox runs, the installer launched standard Windows Installer custom actions and contacted a ScreenConnect relay server assigned to one specific operator instance. The combined sandbox verdict was malicious, with a greyware tag. No injection into other processes was recorded. Once installed, the client gives whoever runs that relay server remote control of the computer.
What To Do Now
Run this installer only if you deliberately started a support session with an organisation you know and trust. If someone sent it to you unprompted, for example a caller claiming to be from your bank, tech support or a delivery company, do not run it. If it is already installed, uninstall ScreenConnect Client, disconnect from the internet, and change your passwords from another device. Keep your antivirus enabled throughout.
Where this verdict could be wrong2 caveats
- DrWeb ('BackDoor.RA.364') and Microsoft ('Trojan:Win32/Leonem!rfn') use backdoor/trojan labels, and the combined sandbox label includes an evasion tag, which would fit an attacker-deployed client.
- The file carries a valid signature from the product's own publisher, and the observed installer activity contains nothing beyond what a remote-support client normally does.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Valid code signature from ConnectWise, LLC, matching the product the file identifies as
- Most engine labels describe a remote-administration tool rather than a named malware family
- Observed installer activity was ordinary, with no injection into other processes recorded
- Installs a remote-access client that gives an outside operator control of the computer
- Preconfigured to connect to one specific operator's relay server
- Flagged by 14 of the 63 antivirus engines that checked it, including backdoor and trojan labels from DrWeb and Microsoft
- The combined sandbox verdict was malicious, with an evasion tag
- Rarely submitted (two sources), typical of a one-off client build sent to a single person
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 4 isolated tests; 2 test environments rated what it did as risky.
Test run summary
Capture complete- 4isolated sandbox runs
- 11sandbox rule tags
- 5spawned processes
- 3network contacts
- 27filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Hid files or windows on the test computer.
Note: Deleted files or logs during the test run (installers often clean up after themselves).
Note: Read basic details of the test computer, such as its Windows version.
Note: Connected to 3 servers during the test run.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as spreading through USB drives; nothing confirms it.
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 7: FileSeen in the test run
ScreenConnect.ClientSetup.msi
c3e39852d76129e69410953391ff828689bf6a0840782db1fe1c730ad0ccce72
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 7: ProcessSeen in the test run
msiexec.exe
"C:\Windows\system32\msiexec.exe" /I "C:\Users\<USER>\Desktop\ScreenConnect.ClientSetup.msi" /qb ACCEPTEULA=1 LicenseAccepted=1
Test run - Evidence 3 of 7: ProcessSeen in the test run
msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\ScreenConnect.ClientSetup.msi"
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 7: Written fileSeen in the test run
opa12.dat
C:\PROGRA~2\MICROS~1\OFFICE\DATA\opa12.dat
Test run - Evidence 5 of 7: Written fileSeen in the test run
~DF020139FDAD87CF59.TMP
C:\Users\ADMINI~1\AppData\Local\Temp\~DF020139FDAD87CF59.TMP
Test run - +1 more recorded observation
- 2
Network
Hosts contacted
- Evidence 6 of 7: Contacted hostSeen in the test run
instance-xxwmfx-relay.screenconnect.com
Contacted during the test run.
Test run - Evidence 7 of 7: Contacted hostSeen in the test run
check.screenconnect.com
Contacted during the test run.
Test run - +1 more recorded observation
7 facts from the test run. See the full activity list.
What this file did when executed
This file was detonated in 4 sandboxes; 1 returned "malicious".
Sandbox verdicts
2- VT: MALWARE, EVADERmalicious
- VT: GREYWAREsuspicious
Techniques observed in the sandbox
11MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1036
- T1055· Process injection
- T1070.006· Covers its tracks
- T1082· System recon
- T1091· USB spreading
- T1106
- T1112
- T1120
- T1218.011
- T1562.001· Disables security
- T1564.002· Hides artifacts
Observed activity
Processes started
5Programs the file ran, with their command lines.
msiexec.exe"C:\Windows\system32\msiexec.exe" /I "C:\Users\<USER>\Desktop\ScreenConnect.ClientSetup.msi" /qb ACCEPTEULA=1 LicenseAccepted=1msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\ScreenConnect.ClientSetup.msi"msiexec.exeC:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 80A5DA0F3B9ECD9F2AA47E70B53D13AB Crundll32.exeC:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI3006.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7176406 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArgumentsrundll32.exeC:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSIBFA0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7266875 10 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
Network contacts
33 hosts, listed as 2 domains, 1 address, 1 link. Links show the host and path only.
- Domain
instance-xxwmfx-relay.screenconnect.com - Domain
check.screenconnect.com - IP address
15.204.43.247 - URL
https://check.screenconnect.com/InstallerOriginInfo.axd
Files
25Files the file created, changed or deleted.
- Written
C:\PROGRA~2\MICROS~1\OFFICE\DATA\opa12.dat - Written
C:\Users\ADMINI~1\AppData\Local\Temp\~DF020139FDAD87CF59.TMP - Written
C:\Users\ADMINI~1\AppData\Local\Temp\~DF0B4A552D8A0F0728.TMP - Written
C:\Users\ADMINI~1\AppData\Local\Temp\~DF883C277946751E0B.TMP - Written
C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD0000.doc - Written
C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD0001.doc
Show all 25 entries for files
- Written
C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{5392B43D-09E8-484B-822C-F41910E16B84}.tmp - Written
C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{74995C0D-893F-4DA0-8004-44F9E52C3895}.tmp - Written
C:\Users\Administrator\AppData\Roaming\Microsoft\Templates\~$Normal.dotm - Written
C:\analyse\~$90869616.9415302_ce120b7a-deda-4a05-8a2d-c5041d42d780 - Written
C:\ProgramData - Written
C:\ProgramData\Microsoft\Windows\Templates - Written
C:\Users\user\AppData\Local\Temp\MSI3006.tmp - Written
C:\Users\user\AppData\Local\Temp\MSI3006.tmp- - Written
C:\Users\user\AppData\Local\Temp\MSI3006.tmp-\CustomAction.config - Deleted
C:\Users\user\AppData\Local\Temp\MSI3006.tmp - Deleted
C:\Users\user\AppData\Local\Temp\MSI3006.tmp-\CustomAction.config - Deleted
C:\Users\user\AppData\Local\Temp\MSI3006.tmp-\Microsoft.Deployment.Compression.Cab.dll - Deleted
C:\Users\user\AppData\Local\Temp\MSI3006.tmp-\Microsoft.Deployment.Compression.dll - Deleted
C:\Users\user\AppData\Local\Temp\MSI3006.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll - Deleted
C:\Users\user\AppData\Local\Temp\MSI3006.tmp-\Microsoft.Deployment.WindowsInstaller.dll - Deleted
C:\Users\user\AppData\Local\Temp\MSI3006.tmp-\ScreenConnect.Core.dll - Deleted
C:\Users\user\AppData\Local\Temp\MSI3006.tmp-\ScreenConnect.InstallerActions.dll - Deleted
C:\Users\user\AppData\Local\Temp\MSI3006.tmp-\ScreenConnect.Windows.dll - Deleted
C:\Users\user\AppData\Local\Temp\MSI3006.tmp-\ScreenConnect.WindowsInstaller.dll
Registry and auto-start
15Settings the file changed, including ways to start again after a restart.
- Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob - Set
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\EncodedCtl - Set
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\LastSyncTime - Set
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob - Set
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob - Set
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob
Show all 15 entries for registry and auto-start
- Set
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54\Blob - Set
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob - Set
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\Certificates\55A6723ECBF2ECCDC3237470199D2ABE11E381D1\Blob - Set
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\Certificates\590D2D7D884F402E617EA562321765CF17D894E9\Blob - Set
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob - Set
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A\Blob - Set
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob - Set
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\Certificates\75E0ABB6138512271C04F85FDDDE38E4B7242EFE\Blob - Set
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\Certificates\8782C6C304353BCFD29692D2593E7D44D934FF11\Blob
Mutexes
2Named locks a program uses so only one copy runs; malware families often reuse them.
Global\_MSIExecute\BaseNamedObjects\Local\SM0:6948:304:WilStaging_02
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM process
msiexec.exeC:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 9 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 9d32032109ffc217b7dc…696bf8Not checkedno saved verdict
- e04de7988a2a39931831…70f1a7Not checkedno saved verdict
- 548c551f6ebc5d829158…c624a1Not checkedno saved verdict
- 3e54286e348ebd3d70ea…3db29dNot checkedno saved verdict
- 74f2d225b492eb77a565…bff3d7Not checkedno saved verdict
- 2022f13b1f562d3cbef3…99a356Not checkedno saved verdict
- 93f910f732855000861c…46c193Not checkedno saved verdict
- 361bbc692084841e4c8d…8de25bNot checkedno saved verdict
- 400ff5b9a44393398762…cf0b6eNot checkedno saved verdict
- 7027b69ab6ebc9f3f7d2…1b2b23Cleantrust 85known-software reference set · not scanned here
Chapter 04
Technical details
14 of the 63 antivirus engines that checked it flag it; signed by ConnectWise, LLC.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 14
- DrWeb (major engine)BackDoor.RA.364
- Fortinet (major engine)Riskware/ConnectWise
- Kaspersky (major engine)not-a-virus:HEUR:RemoteAdmin.Win32.ConnectWise.gen
- Microsoft (major engine)Trojan:Win32/Leonem!rfn
- TrellixENS (major engine)ConnectWise
- alibabacloudBackdoor[rat]:Win/ConnectWise.gyf
- GoogleDetected
- huorongHackTool/ConnectWiseControl.j
File fingerprint
- Last analyzed
- Oct 21, 2026, 2:55 PM UTC
- SHA-256
c3e39852d76129e69410953391ff828689bf6a0840782db1fe1c730ad0ccce72- SHA-1
1a99cd9323506bbd55ee052d06f3d1dd3d2b7df9- MD5
4a4463c2d8ec3944a2a24759ea93d843
About this file
ScreenConnect.ClientSetup.msi is a Windows Installer file of 10.2 MB.
- Type and size
- Windows Installer · 10.2 MB
- Signer
- ConnectWise, LLCValid code signature.
- First seen
- Sep 29, 2026On VirusTotal.
- Submitted by
- 2 distinct sourcesRarely seen: few people have submitted this exact file.
First scanned Updated
Antivirus consensus
14 of 63 engines flagged this file
12 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
The 14 detections come from 13 independent scan engines: several vendors license the same engine, so their results are one vote.
- Tier-118 engines5flagged
- Tier-233 engines6flagged
- Low-trust12 engines3flagged
View all 75 engine results
- alibabacloudMalicious: Backdoor[rat]:Win/ConnectWise.gyf
- DrWebMalicious: BackDoor.RA.364
- FortinetMalicious: Riskware/ConnectWise
- GoogleMalicious: Detected
- huorongMalicious: HackTool/ConnectWiseControl.j
- KasperskyMalicious: not-a-virus:HEUR:RemoteAdmin.Win32.ConnectWise.gen
- MicrosoftMalicious: Trojan:Win32/Leonem!rfn
- NANO-AntivirusMalicious: Riskware.Win32.RemoteAdmin.ljylbz
- RisingMalicious: Hacktool.ConnectWise!8.13A88 (CLOUD)
- SkyhighMalicious: ConnectWise
- TrellixENSMalicious: ConnectWise
- VaristMalicious: W32/ConnectWise.S.gen!Eldorado
- VBA32Malicious: Riskware.MSIL.ScreenConnect.Heur
- XcitiumMalicious: ApplicUnwnt@#2zaiqebwyafpj
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- GDataClean
- GridinsoftClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicroWorld-eScanClean
- PaloaltoNo result
- PandaClean
- SangforClean
- SentinelOneClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)Signed by "ConnectWise, LLC" — short generic company CN. Paired with 14 engine hit(s); possible stolen, fraudulent, or reseller-purchased code-signing certificate.
EvidenceConnectWise, LLC
How widely this file has been seen
Rarely uploaded, and first seen more than two weeks ago. Often niche legitimate software or internal tooling; not a strong malware signal on its own.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is ScreenConnect.ClientSetup.msi safe, or is it malware?
What is ScreenConnect.ClientSetup.msi?
How many antivirus engines detected ScreenConnect.ClientSetup.msi?
I already downloaded and installed ScreenConnect.ClientSetup.msi — what should I do?
Is ScreenConnect.ClientSetup.msi digitally signed?
What is the SHA-256 hash of ScreenConnect.ClientSetup.msi?
How up to date is this analysis of ScreenConnect.ClientSetup.msi?
Community
Member reviews and reports for this exact file hash.