Quiet MSI dropping DLL and spawning ScreenConnect Service

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•6

Detects silent MSI installations that drop specific DLLs (autorun.dll or vcredist_x64.dll) and subsequently spawn a ScreenConnect client service within a 5-minute window. This behavior is indicative of potential persistence or remote access tool deployment.