Mystify.scr
by Microsoft
Operating System
Summary
Windows Mystify screensaver - animated Mystify line pattern screensaver.
Mystify.scr is the 897th most commonly executed Windows program in EchoTrail's dataset, observed 2,804 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by winlogon.exe.
897th
most commonly executed Windows program
2,804
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Windows\System32100%
Top Hashes (SHA256)
- 4650c5d07d73b5ffd6389d06f3a9a9980b11f2aef3d44d73f6ed23b5b2eebed339.28%
- 0fa5d37d8e80d836bab9f0693fb98b53441364c3b9284d8c2f56bfdaa5b2bcd717.05%
- dd8cda0a222a54b6dbe1a3f465017aa15471f2f5946d0e15d75c5de4d42ab47216.49%
- 55203f7478d1d999e35d6f9e027b925b21a337bdef81c1c8ac2849d1bed5508a15.48%
- 943d9f9fa361749970170c07644d3a628cd41733f74ae109c74842f61a4273e18.4%
- c3b5ed4d7d2c0e9f8118672204d700a9ac6da8902ff6a754ba88b8f6287ce7d33.26%
- c25a1523f9d11d58631cf210b580e67456452a88f341171431b7ee83cf63e0b80.04%
Process Ancestry
Top Grandparents
- smss.exe97.62%
- LogonUI.exe1.27%
- svchost.exe0.95%
- RuntimeBroker.exe0.16%
Top Parents
- winlogon.exe99.93%
- rundll32.exe0.07%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about Mystify.scr
Rocky answers questions about Mystify.scr grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.