RMM

Controlio

Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware.

Tool overview

Category
RMM
Research authors
CERT Cwatch Almond
Created
2026-03-20
Last modified
2026-03-20
Privileges
user
Free / availability
Yes
Verification required
No
Supported platforms
WindowsmacOS

Capabilities

Reporting and analyticsRemote MonitoringClipboard SynchronizationConnection Management

Executables & installation paths

Filename
wesvc.exe
OriginalFileName
Not recorded
Description
uploads the recorded data & logs.
Product
Controlio

Installation paths

C:\ProgramData\{E0E95C6C-F194-4846-928D-E5538022226D}\
weCliboardListener.exe
bbl.exe
weprtct.exe
wemonc.exe
wesvc.exe
libeay32.dll
ssleay32.dll
wec_launcher_[a-Z0-9]*_.exe
wec_launcher_[a-Z0-9]*_.pkg
weInstSvc.exe

FORENSIC EVIDENCE

Disk artifacts

File
weClipboardListener.exe
Description
Controlio binary
OS
Windows
File
bbl.exe
Description
Controlio binary
OS
Windows
File
weprtct.exe
Description
Controlio binary
OS
Windows
File
wemonc.exe
Description
Controlio binary
OS
Windows
File
wesvc.exe
Description
Controlio binary
OS
Windows
File
libeay32.dll
Description
Controlio binary
OS
Windows
File
ssleay32.dll
Description
Controlio binary
OS
Windows
File
wec_launcher_[a-Z0-9]*_.exe
Description
Controlio windows installer
OS
Windows
Example
  • MD5: 2e6f6b62b16904eee7b2de51951f22a8
  • SHA1: 49dcf901491e60079289732c7291a38f18ed4918
  • SHA256: 4ad77ebb2fa42dacd375061ec86ea35bb2d003ce057b764a0faff948d8063cc5
File
wec_launcher_[a-Z0-9]*_.pkg
Description
Controlio macos installer
OS
Mac
Example
  • MD5: df66eb79c15937bfe2cdf8774901778e
  • SHA1: a1f765235010343dd9b25c50de7f6b04e4dd01b5
  • SHA256: 1591df6f0575fa903481b31122f8be5a2ead8ff75800c57e6324c9ccc1969e0f
File
weInstSvc.exe
Description
Controlio binary
OS
Windows
Example
  • MD5: b290abc61e20d8de07f009348c2c3e2f
  • SHA1: 3b0412a27fc2f9277c0fb484d3ff7382b0da6e32
  • SHA256: 2cae3bfd61025f45810c787cfad9b6287882494fa9317ec6725ac65390be254a
File
C:\ProgramData\{E0E95C6C-F194-4846-928D-E5538022226D}\
Description
Controlio binary
OS
Windows

FORENSIC EVIDENCE

Other artifacts

Type
Service
Value
weSvcService

References