File name:

ScreenConnect.ClientSetup.exe

Full analysis: https://app.any.run/tasks/51d154e1-b451-4d6c-8973-edfbaa15f0c3
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: May 20, 2026, 05:24:56
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
screenconnect
tool
rmm-tool
remote
connectwise
rat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

41F40B49436CE3B008F79BDC5A0E9857

SHA1:

E71430C9A8F3967463E88D35E22DBEAF2C61C429

SHA256:

7DC07219E9DD20AAD0C0A0C3F8D00A69AF1C5633D1797D1B46B77B500F12AD3F

SSDEEP:

98304:Gf7ww/5lQYHJOytH9awXB0DXe3S+5OmxlGwP3AW5JTGG0DR/WVCv4FogS+IWuZYn:CtDAZpx9hYjDpx9hY+px9hYZpx9hYB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • SCREENCONNECT has been detected

      • rundll32.exe (PID: 7116)
      • rundll32.exe (PID: 1776)
      • rundll32.exe (PID: 5716)
      • msiexec.exe (PID: 2812)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • rundll32.exe (PID: 7116)
      • rundll32.exe (PID: 1776)
      • rundll32.exe (PID: 5716)

    • Executes as Windows Service

      • VSSVC.exe (PID: 1108)
      • ScreenConnect.ClientService.exe (PID: 7204)

    • SCREENCONNECT mutex has been found

      • ScreenConnect.ClientService.exe (PID: 7204)

    • Screenconnect has been detected

      • ScreenConnect.ClientService.exe (PID: 7204)
      • ScreenConnect.ClientService.exe (PID: 7204)

    • Creates or modifies Windows services

      • ScreenConnect.ClientService.exe (PID: 7204)

    • Detects ScreenConnect RAT (YARA)

      • ScreenConnect.ClientService.exe (PID: 7204)
      • ScreenConnect.WindowsClient.exe (PID: 6260)

  • INFO

    • The sample compiled with english language support

      • ScreenConnect.ClientSetup.exe (PID: 4564)

    • Create files in a temporary directory

      • ScreenConnect.ClientSetup.exe (PID: 4564)
      • rundll32.exe (PID: 7116)
      • rundll32.exe (PID: 1776)
      • rundll32.exe (PID: 5716)

    • Reads the machine GUID from the registry

      • ScreenConnect.ClientSetup.exe (PID: 4564)
      • ScreenConnect.ClientService.exe (PID: 7204)
      • ScreenConnect.WindowsClient.exe (PID: 6260)

    • Process checks computer location settings

      • ScreenConnect.ClientSetup.exe (PID: 4564)

    • Checks supported languages

      • ScreenConnect.ClientSetup.exe (PID: 4564)
      • msiexec.exe (PID: 2812)
      • msiexec.exe (PID: 6112)
      • msiexec.exe (PID: 7408)
      • msiexec.exe (PID: 4624)
      • ScreenConnect.ClientService.exe (PID: 7204)
      • ScreenConnect.WindowsClient.exe (PID: 6260)

    • Reads security settings of Internet Explorer

      • ScreenConnect.ClientSetup.exe (PID: 4564)
      • msiexec.exe (PID: 2204)
      • ScreenConnect.ClientService.exe (PID: 7204)
      • ScreenConnect.WindowsClient.exe (PID: 6260)

    • Reads the computer name

      • ScreenConnect.ClientSetup.exe (PID: 4564)
      • msiexec.exe (PID: 2812)
      • msiexec.exe (PID: 6112)
      • msiexec.exe (PID: 4624)
      • msiexec.exe (PID: 7408)
      • ScreenConnect.ClientService.exe (PID: 7204)
      • ScreenConnect.WindowsClient.exe (PID: 6260)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 2204)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2204)
      • msiexec.exe (PID: 2812)

    • Disables trace logs

      • rundll32.exe (PID: 1776)

    • CONNECTWISE has been detected

      • msiexec.exe (PID: 2204)
      • ScreenConnect.ClientService.exe (PID: 7204)
      • ScreenConnect.WindowsClient.exe (PID: 6260)

    • Manages system restore points

      • SrTasks.exe (PID: 2220)

    • SCREENCONNECT has been detected

      • ScreenConnect.ClientService.exe (PID: 7204)
      • ScreenConnect.ClientService.exe (PID: 7204)

    • There is functionality for taking screenshot (YARA)

      • ScreenConnect.ClientService.exe (PID: 7204)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:11:18 20:10:20+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.33
CodeSize: 45568
InitializedDataSize: 12726272
UninitializedDataSize: -
EntryPoint: 0x14ad
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 26.2.4.9600
ProductVersionNumber: 26.2.4.9600
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Unknown (0)
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileVersion: 26.2.4.9600
ProductVersion: 26.2.4.9600
ProductName: ScreenConnect
CompanyName: ScreenConnect Software
FileDescription: ScreenConnect Client Setup
InternalName: ScreenConnect.ClientSetup.exe
OriginalFileName: ScreenConnect.ClientSetup.exe
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
15
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start screenconnect.clientsetup.exe msiexec.exe #SCREENCONNECT msiexec.exe msiexec.exe no specs #SCREENCONNECT rundll32.exe #SCREENCONNECT rundll32.exe #SCREENCONNECT rundll32.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe no specs #SCREENCONNECT screenconnect.clientservice.exe #SCREENCONNECT screenconnect.windowsclient.exe no specs screenconnect.clientsetup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1108C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1776rundll32.exe "C:\Users\admin\AppData\Local\Temp\MSI19ED.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_924156 11 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotwC:\Windows\SysWOW64\rundll32.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2204"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\ScreenConnect\26.2.4.9600\a5bbf29fe2cf3587\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\admin\Desktop\ScreenConnect.ClientSetup.exe"C:\Windows\SysWOW64\msiexec.exe
ScreenConnect.ClientSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2220C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:15C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2812C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4056\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4564"C:\Users\admin\Desktop\ScreenConnect.ClientSetup.exe" C:\Users\admin\Desktop\ScreenConnect.ClientSetup.exe
explorer.exe
User:
admin
Company:
ScreenConnect Software
Integrity Level:
HIGH
Description:
ScreenConnect Client Setup
Exit code:
0
Version:
26.2.4.9600
Modules
Images
c:\users\admin\desktop\screenconnect.clientsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
4624C:\Windows\syswow64\MsiExec.exe -Embedding 9DE655DF31135B96A796E66FF43885CBC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5716rundll32.exe "C:\Users\admin\AppData\Local\Temp\MSI1EE0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_925437 18 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileNameC:\Windows\SysWOW64\rundll32.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6112C:\Windows\syswow64\MsiExec.exe -Embedding 21D07226C8FCD4D6053232A150554D32 CC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
15 059
Read events
14 886
Write events
164
Delete events
9

Modification events

(PID) Process:(1776) rundll32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rundll32_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1776) rundll32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rundll32_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1776) rundll32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rundll32_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1776) rundll32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rundll32_RASMANCS
Operation:writeName:FileTracingMask
Value:
(PID) Process:(1776) rundll32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rundll32_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(1776) rundll32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rundll32_RASMANCS
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(1776) rundll32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rundll32_RASMANCS
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(1776) rundll32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rundll32_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1776) rundll32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rundll32_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1776) rundll32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rundll32_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
39
Suspicious files
24
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
4564ScreenConnect.ClientSetup.exeC:\Users\admin\AppData\Local\Temp\ScreenConnect\26.2.4.9600\a5bbf29fe2cf3587\ScreenConnect.ClientSetup.msi —
MD5:—
SHA256:—
2204msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141binary
MD5:88318CFF911AB4032D3E950B1179F94A
SHA256:21CF058E3327B5AF3BC08239C6A0D31C3352D7ADD5BACD326FC5308BCB1C9502
2204msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141binary
MD5:747026950059B1525A365871B49B806A
SHA256:C29C4CD1071DEC5034C98103C50F7F4D9D607BCD8C10BC354D7EF0D3CCA8B169
2204msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111binary
MD5:3376C5C06634090BF3F827FEB10FF045
SHA256:D8BD6BB70EF13A67993CEFAA8B3C241EF585FB58A921F80E3277DE48DBDD6B57
7116rundll32.exeC:\Users\admin\AppData\Local\Temp\MSI18C3.tmp-\ScreenConnect.InstallerActions.dllexecutable
MD5:3730C34E8EB93AE2E121C0249529C16D
SHA256:936055C9CECBCE54167E3D865BED76119B8668D41E987F5C76E82A7C9CF1898C
7116rundll32.exeC:\Users\admin\AppData\Local\Temp\MSI18C3.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dllexecutable
MD5:A921A2B83B98F02D003D9139FA6BA3D8
SHA256:548C551F6EBC5D829158A1E9AD1948D301D7C921906C3D8D6B6D69925FC624A1
7116rundll32.exeC:\Users\admin\AppData\Local\Temp\MSI18C3.tmp-\Microsoft.Deployment.WindowsInstaller.dllexecutable
MD5:5EF88919012E4A3D8A1E2955DC8C8D81
SHA256:3E54286E348EBD3D70EAED8174CCA500455C3E098CDD1FCCB167BC43D93DB29D
2204msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI18C3.tmpexecutable
MD5:49FE5DDE947D8CDC65B5EA63DEC5E84C
SHA256:C99B56907EA67B189677AF45B8C4B81E5109E30F81AABF100997E9F2B681BA45
7116rundll32.exeC:\Users\admin\AppData\Local\Temp\MSI18C3.tmp-\Microsoft.Deployment.Compression.dllexecutable
MD5:4717BCC62EB45D12FFBED3A35BA20E25
SHA256:E04DE7988A2A39931831977FA22D2A4C39CF3F70211B77B618CAE9243170F1A7
7116rundll32.exeC:\Users\admin\AppData\Local\Temp\MSI18C3.tmp-\ScreenConnect.WindowsInstaller.dllexecutable
MD5:7FDEFC65532F63247E4A09EF04FB2F08
SHA256:663B4D48E4183306995E4A66D4D8222292884152A6DA85FE3800BB015B6C223B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
60
TCP/UDP connections
46
DNS requests
23
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2204
msiexec.exe
GET
200
23.11.40.157:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAHd28bpFj1AfZgKPq95hSg%3D
NL
binary
727 b
whitelisted
7804
slui.exe
POST
500
128.24.231.64:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
US
xml
512 b
whitelisted
7804
slui.exe
POST
500
128.24.231.64:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
US
xml
512 b
whitelisted
2204
msiexec.exe
GET
200
23.11.40.157:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
NL
binary
727 b
whitelisted
5276
MoUsoCoreWorker.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
4712
SIHClient.exe
GET
304
74.179.77.204:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
3448
svchost.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
1776
rundll32.exe
POST
—
35.169.83.249:443
https://check.screenconnect.com/InstallerOriginInfo.axd
US
—
—
unknown
7568
svchost.exe
POST
403
23.52.181.141:443
https://go.microsoft.com/fwlink/?LinkID=2257403&clcid=0x409
US
html
384 b
whitelisted
1776
rundll32.exe
POST
200
100.25.163.131:443
https://check.screenconnect.com/InstallerOriginInfo.axd
US
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
—
—
48.209.138.168:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
128.24.231.64:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
92.123.104.21:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
3448
svchost.exe
2.16.164.49:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
3448
svchost.exe
23.52.181.212:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
5276
MoUsoCoreWorker.exe
23.52.181.212:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
—
—
48.209.138.189:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5276
MoUsoCoreWorker.exe
48.209.138.189:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
activation-v2.sls.microsoft.com
  • 128.24.231.64
whitelisted
www.bing.com
  • 92.123.104.21
  • 92.123.104.50
  • 92.123.104.53
  • 92.123.104.52
  • 92.123.104.34
  • 92.123.104.19
  • 92.123.104.41
  • 92.123.104.29
  • 92.123.104.31
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.72
whitelisted
www.microsoft.com
  • 23.52.181.212
whitelisted
settings-win.data.microsoft.com
  • 48.209.138.189
  • 48.209.6.48
whitelisted
google.com
  • 142.250.154.101
  • 142.250.154.138
  • 142.250.154.113
  • 142.250.154.102
  • 142.250.154.100
  • 142.250.154.139
whitelisted
ocsp.digicert.com
  • 23.11.40.157
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
check.screenconnect.com
  • 35.169.83.249
  • 32.195.149.229
  • 100.25.163.131
whitelisted
go.microsoft.com
  • 23.52.181.141
whitelisted

Threats

PID
Process
Class
Message
2232
svchost.exe
Misc activity
ET REMOTE_ACCESS Observed DNS Query to Known ScreenConnect/ConnectWise Remote Desktop Service Domain
2232
svchost.exe
Misc activity
ET REMOTE_ACCESS Observed DNS Query to Known ScreenConnect/ConnectWise Remote Desktop Service Domain
—
—
Misc activity
ET REMOTE_ACCESS Observed DNS Query to Known ScreenConnect/ConnectWise Remote Desktop Service Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ScreenConnect.ClientSetup.exe