File name:

tranScreen.exe

Full analysis: https://app.any.run/tasks/f61731eb-4c40-47bc-8768-211250441ff8
Verdict: Malicious activity
Analysis date: April 25, 2025, 08:26:10
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

6DFEAC9500F6AF2359E2487044F8FAAF

SHA1:

E53365412860B2E4F67C8CA64E6376254F4448A7

SHA256:

CBC906DD7A5A564DD639772C359EE5F1C62AE45FB3D4ED21A2D8C163CC950338

SSDEEP:

98304:zOKfSQHcKwAkYkK+wV+mIkYkK+wV+m/f10BCnL6ePmzYWt9l52Xr+iHnn8keoO+m:f+tzw3FsOBfLS+JedMmE3yBgchNj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • tranScreen.exe (PID: 7340)
      • TranscreenSoftware.exe (PID: 7480)
      • InstallDeviceDriver.exe (PID: 7976)
      • devcon.exe (PID: 8132)
      • InstallDeviceDriver.exe (PID: 7236)
      • InstallDeviceDriver.exe (PID: 7316)
      • devcon.exe (PID: 2772)
      • devcon.exe (PID: 6512)

    • The process drops C-runtime libraries

      • tranScreen.exe (PID: 7340)

    • Process drops legitimate windows executable

      • tranScreen.exe (PID: 7340)
      • TranscreenSoftware.exe (PID: 7480)

    • Executable content was dropped or overwritten

      • tranScreen.exe (PID: 7340)
      • TranscreenSoftware.exe (PID: 7480)
      • devcon.exe (PID: 8132)
      • drvinst.exe (PID: 2236)
      • drvinst.exe (PID: 5124)
      • devcon.exe (PID: 2772)
      • devcon.exe (PID: 6512)
      • drvinst.exe (PID: 8060)
      • drvinst.exe (PID: 7988)
      • drvinst.exe (PID: 8168)
      • drvinst.exe (PID: 8024)

    • Drops a system driver (possible attempt to evade defenses)

      • TranscreenSoftware.exe (PID: 7480)
      • devcon.exe (PID: 8132)
      • drvinst.exe (PID: 2236)
      • drvinst.exe (PID: 5124)
      • devcon.exe (PID: 6512)
      • drvinst.exe (PID: 7988)
      • drvinst.exe (PID: 8024)

    • Creates or modifies Windows services

      • drvinst.exe (PID: 5124)
      • drvinst.exe (PID: 8168)
      • drvinst.exe (PID: 8024)

    • Creates files in the driver directory

      • drvinst.exe (PID: 5124)
      • drvinst.exe (PID: 7988)
      • drvinst.exe (PID: 8060)
      • drvinst.exe (PID: 8024)
      • drvinst.exe (PID: 2236)
      • drvinst.exe (PID: 8168)

    • There is functionality for taking screenshot (YARA)

      • TranscreenSoftware.exe (PID: 7480)

    • Executes as Windows Service

      • WUDFHost.exe (PID: 7624)

    • Creates/Modifies COM task schedule object

      • drvinst.exe (PID: 8024)

  • INFO

    • Reads the computer name

      • tranScreen.exe (PID: 7340)
      • TranscreenSoftware.exe (PID: 7480)
      • InstallDeviceDriver.exe (PID: 7976)
      • devcon.exe (PID: 8132)
      • drvinst.exe (PID: 2236)
      • InstallDeviceDriver.exe (PID: 7316)
      • InstallDeviceDriver.exe (PID: 7236)
      • devcon.exe (PID: 6512)
      • devcon.exe (PID: 2772)
      • drvinst.exe (PID: 7988)
      • drvinst.exe (PID: 8060)
      • drvinst.exe (PID: 8168)
      • drvinst.exe (PID: 5124)
      • drvinst.exe (PID: 8024)

    • The sample compiled with english language support

      • tranScreen.exe (PID: 7340)
      • TranscreenSoftware.exe (PID: 7480)
      • devcon.exe (PID: 6512)
      • drvinst.exe (PID: 7988)
      • drvinst.exe (PID: 8024)

    • The sample compiled with russian language support

      • tranScreen.exe (PID: 7340)
      • TranscreenSoftware.exe (PID: 7480)

    • Creates files in the program directory

      • tranScreen.exe (PID: 7340)

    • Creates files or folders in the user directory

      • TranscreenSoftware.exe (PID: 7480)
      • tranScreen.exe (PID: 7340)
      • InstallDeviceDriver.exe (PID: 7976)
      • InstallDeviceDriver.exe (PID: 7316)

    • Checks supported languages

      • TranscreenSoftware.exe (PID: 7480)
      • tranScreen.exe (PID: 7340)
      • devcon.exe (PID: 8132)
      • devcon.exe (PID: 8088)
      • drvinst.exe (PID: 2236)
      • InstallDeviceDriver.exe (PID: 7316)
      • InstallDeviceDriver.exe (PID: 7236)
      • devcon.exe (PID: 4108)
      • devcon.exe (PID: 1672)
      • devcon.exe (PID: 2772)
      • devcon.exe (PID: 6512)
      • InstallDeviceDriver.exe (PID: 7976)
      • drvinst.exe (PID: 7988)
      • drvinst.exe (PID: 8060)
      • drvinst.exe (PID: 5124)
      • drvinst.exe (PID: 8024)
      • drvinst.exe (PID: 8168)

    • Process checks computer location settings

      • tranScreen.exe (PID: 7340)
      • TranscreenSoftware.exe (PID: 7480)
      • InstallDeviceDriver.exe (PID: 7976)
      • InstallDeviceDriver.exe (PID: 7316)
      • InstallDeviceDriver.exe (PID: 7236)

    • The sample compiled with chinese language support

      • TranscreenSoftware.exe (PID: 7480)
      • devcon.exe (PID: 8132)
      • drvinst.exe (PID: 2236)
      • tranScreen.exe (PID: 7340)
      • drvinst.exe (PID: 5124)
      • devcon.exe (PID: 2772)
      • drvinst.exe (PID: 8060)
      • drvinst.exe (PID: 8168)

    • Create files in a temporary directory

      • devcon.exe (PID: 8132)
      • devcon.exe (PID: 2772)
      • devcon.exe (PID: 6512)

    • Reads the machine GUID from the registry

      • devcon.exe (PID: 8132)
      • devcon.exe (PID: 2772)
      • devcon.exe (PID: 6512)
      • drvinst.exe (PID: 7988)
      • drvinst.exe (PID: 8060)
      • drvinst.exe (PID: 2236)
      • drvinst.exe (PID: 8024)

    • Reads the software policy settings

      • drvinst.exe (PID: 2236)
      • devcon.exe (PID: 2772)
      • devcon.exe (PID: 6512)
      • devcon.exe (PID: 8132)
      • drvinst.exe (PID: 7988)
      • drvinst.exe (PID: 8060)
      • drvinst.exe (PID: 8024)
      • slui.exe (PID: 6132)

    • Checks proxy server information

      • slui.exe (PID: 6132)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:24 07:05:15+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.25
CodeSize: 130048
InitializedDataSize: 12712960
UninitializedDataSize: -
EntryPoint: 0xb285
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 2.6.8.11
ProductVersionNumber: 2.6.8.11
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
CompanyName: TranscreenSoft
FileDescription: TranscreenSoftClient
FileVersion: 2.6.8.11
InternalName: TranscreenSoft
LegalCopyright: -
OriginalFileName: -
ProductName: TranscreenSoft
ProductVersion: 2.6.8.11
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
169
Monitored processes
29
Malicious processes
8
Suspicious processes
2

Behavior graph

Click at the process to see the details
start transcreen.exe transcreensoftware.exe installdevicedriver.exe no specs conhost.exe no specs devcon.exe no specs conhost.exe no specs devcon.exe conhost.exe no specs drvinst.exe drvinst.exe installdevicedriver.exe no specs conhost.exe no specs installdevicedriver.exe no specs conhost.exe no specs devcon.exe no specs devcon.exe no specs conhost.exe no specs conhost.exe no specs devcon.exe devcon.exe conhost.exe no specs conhost.exe no specs drvinst.exe drvinst.exe drvinst.exe drvinst.exe wudfhost.exe no specs slui.exe transcreen.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1672"C:\Users\admin\AppData\Roaming\Transcreen\Software\Drivers\tools\amd64\devcon.exe" -remove root\SHARECAMERAC:\Users\admin\AppData\Roaming\Transcreen\Software\Drivers\tools\amd64\devcon.exe—InstallDeviceDriver.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Setup API
Exit code:
0
Version:
10.0.14393.0 (rs1_release.160715-1616)
Modules
Images
c:\users\admin\appdata\roaming\transcreen\software\drivers\tools\amd64\devcon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2236DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{50a65d31-bfa0-e84f-8093-09f3e8e6e16a}\tff_virtaudio.inf" "9" "4a5756487" "00000000000001D4" "WinSta0\Default" "000000000000008C" "208" "c:\users\admin\appdata\roaming\transcreen\software\drivers\tffaudio\x64"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
2240\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—devcon.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2772"C:\Users\admin\AppData\Roaming\Transcreen\Software\Drivers\vmonitor\x64\devcon.exe" -install "C:\Users\admin\AppData\Roaming\Transcreen\Software\Drivers\vmonitor\DisplayProxy.inf" hid\vid_1b36&pid_0d11C:\Users\admin\AppData\Roaming\Transcreen\Software\Drivers\vmonitor\x64\devcon.exe
InstallDeviceDriver.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Setup API
Exit code:
0
Version:
10.0.14393.0 (rs1_release.160715-1616)
Modules
Images
c:\users\admin\appdata\roaming\transcreen\software\drivers\vmonitor\x64\devcon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4108"C:\Users\admin\AppData\Roaming\Transcreen\Software\Drivers\vmonitor\x64\devcon.exe" -remove hid\vid_1b36&pid_0d11C:\Users\admin\AppData\Roaming\Transcreen\Software\Drivers\vmonitor\x64\devcon.exe—InstallDeviceDriver.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Setup API
Exit code:
0
Version:
10.0.14393.0 (rs1_release.160715-1616)
Modules
Images
c:\users\admin\appdata\roaming\transcreen\software\drivers\vmonitor\x64\devcon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5124DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\WINDOWS\INF\oem1.inf" "oem1.inf:ed86ca119389ada1:tff_virtaudio:1.0.0.4:*tff_virtaudio," "4a5756487" "0000000000000088"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
5544\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—devcon.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5964\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—devcon.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6132C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6512"C:\Users\admin\AppData\Roaming\Transcreen\Software\Drivers\tools\amd64\devcon.exe" -install "C:\Users\admin\AppData\Roaming\Transcreen\Software\Drivers\vcamera\amd64\TranScreenCamera.inf" root\SHARECAMERAC:\Users\admin\AppData\Roaming\Transcreen\Software\Drivers\tools\amd64\devcon.exe
InstallDeviceDriver.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Setup API
Exit code:
0
Version:
10.0.14393.0 (rs1_release.160715-1616)
Modules
Images
c:\users\admin\appdata\roaming\transcreen\software\drivers\tools\amd64\devcon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
27 970
Read events
26 599
Write events
1 356
Delete events
15

Modification events

(PID) Process:(7480) TranscreenSoftware.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie\devenum\{33D9A762-90C8-11D0-BD43-00A0C911CE86}\wave:{A14F8BF5-56E3-412D-AF34-D2240261ED67}
Operation:writeName:FriendlyName
Value:
Line In (2- Realtek AC'97 Audio)
(PID) Process:(7480) TranscreenSoftware.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie\devenum\{33D9A762-90C8-11D0-BD43-00A0C911CE86}\wave:{A14F8BF5-56E3-412D-AF34-D2240261ED67}
Operation:writeName:CLSID
Value:
{E30629D2-27E5-11CE-875D-00608CB78066}
(PID) Process:(7480) TranscreenSoftware.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie\devenum\{33D9A762-90C8-11D0-BD43-00A0C911CE86}\wave:{A14F8BF5-56E3-412D-AF34-D2240261ED67}
Operation:writeName:FilterData
Value:
02000000000020000000000000000000
(PID) Process:(7480) TranscreenSoftware.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie\devenum\{33D9A762-90C8-11D0-BD43-00A0C911CE86}\wave:{A14F8BF5-56E3-412D-AF34-D2240261ED67}
Operation:writeName:EndpointId
Value:
{0.0.1.00000000}.{a14f8bf5-56e3-412d-af34-d2240261ed67}
(PID) Process:(7480) TranscreenSoftware.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie\devenum\{33D9A762-90C8-11D0-BD43-00A0C911CE86}\wave:{A14F8BF5-56E3-412D-AF34-D2240261ED67}
Operation:writeName:EndpointGuid
Value:
{A14F8BF5-56E3-412D-AF34-D2240261ED67}
(PID) Process:(7480) TranscreenSoftware.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie\devenum\{33D9A762-90C8-11D0-BD43-00A0C911CE86}\wave:{A14F8BF5-56E3-412D-AF34-D2240261ED67}
Operation:writeName:WaveInId
Value:
1
(PID) Process:(7480) TranscreenSoftware.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie\devenum\{33D9A762-90C8-11D0-BD43-00A0C911CE86}\wave:{05B02C95-C55A-499C-A533-120810B973DF}
Operation:writeName:FriendlyName
Value:
Microphone (2- Realtek AC'97 Audio)
(PID) Process:(7480) TranscreenSoftware.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie\devenum\{33D9A762-90C8-11D0-BD43-00A0C911CE86}\wave:{05B02C95-C55A-499C-A533-120810B973DF}
Operation:writeName:CLSID
Value:
{E30629D2-27E5-11CE-875D-00608CB78066}
(PID) Process:(7480) TranscreenSoftware.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie\devenum\{33D9A762-90C8-11D0-BD43-00A0C911CE86}\wave:{05B02C95-C55A-499C-A533-120810B973DF}
Operation:writeName:FilterData
Value:
02000000000020000000000000000000
(PID) Process:(7480) TranscreenSoftware.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie\devenum\{33D9A762-90C8-11D0-BD43-00A0C911CE86}\wave:{05B02C95-C55A-499C-A533-120810B973DF}
Operation:writeName:EndpointId
Value:
{0.0.1.00000000}.{05b02c95-c55a-499c-a533-120810b973df}
Executable files
109
Suspicious files
41
Text files
377
Unknown types
0

Dropped files

PID
Process
Filename
Type
7340tranScreen.exeC:\Users\admin\AppData\Roaming\Transcreen\Software\libVMonitor.dllexecutable
MD5:91EC8074D3F068EA6EDD027D9351717D
SHA256:2D11EE5AFAC02EA89DF4C35DC1C6A928FEEE2ADF06E8B714CED3D557E8E02C14
7340tranScreen.exeC:\Users\admin\AppData\Roaming\Transcreen\Software\ScreenCast.dllexecutable
MD5:FBA080786C6651DC199F4AE528D3348D
SHA256:D934C3A308364A4354194B8B45022EC43C18DE87350DDF039ED51D3B343626D7
7340tranScreen.exeC:\Users\admin\AppData\Roaming\Transcreen\Software\ImgRes.zipcompressed
MD5:8ABB4C365FC8C00CF59EBBB2B63AB00F
SHA256:359D886D01EEAFCBE45BABE8CCEC010A337A29567F63DE1AE0A7805C9C394133
7340tranScreen.exeC:\Users\admin\AppData\Roaming\Transcreen\Software\SDL2_image.dllexecutable
MD5:B135F3468488B93EF88E8BD34106C84D
SHA256:6FB97DBED67063713A02D1833A9FA21C8BE3B9380FF1A5C9A4517A51351638AE
7340tranScreen.exeC:\Users\admin\AppData\Roaming\Transcreen\Software\libx264-146.dllexecutable
MD5:BB927B4A2DAF63516AFB2D73805949E7
SHA256:907534D4B1007FB660C21F17AF0F110AB768F42ABCED223825C4DD31A5653FFA
7340tranScreen.exeC:\Users\admin\AppData\Roaming\Transcreen\Software\ijl15.dllexecutable
MD5:4FC074C3C6CF290BB2C11E5C31C97B27
SHA256:41D37BFB0A39017497E0AA373DC01F71AC9C5046C75F7CD269BEE52112A5F3A1
7340tranScreen.exeC:\Users\admin\AppData\Roaming\Transcreen\Software\TFFPowerpoint.exeexecutable
MD5:9D576A59B70D86BDE2879080614A0749
SHA256:9EE57C36B770A266794F3904CF5B213766C06D86DDF8463E09C7EF399449A81D
7340tranScreen.exeC:\Users\admin\AppData\Roaming\Transcreen\Software\tff_virtaudio.dllexecutable
MD5:87ABC8EEAE1163E8060E2161264BF52D
SHA256:9DA84D48C20F596ED2B26181B2AE129D7ECA20C3557067BC7812DDC786148F5E
7340tranScreen.exeC:\Users\admin\AppData\Roaming\Transcreen\Software\libfaad2_dll.dllexecutable
MD5:2BF68E570BC02A7D24E44CF56B55AACD
SHA256:5647CB3D12A8651ECE1F2853D1CAA1EE7C9098A8E2E907FEBE638F57D9C37959
7340tranScreen.exeC:\Users\admin\AppData\Roaming\Transcreen\Software\DuiLib.dllexecutable
MD5:FEF2483D0B3F41E59767893681249F87
SHA256:DD8FA304426DAC773B6B42D103F6AD8EAD673402EE506C7BB7E566EEF041A5EE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
33
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3100
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.161:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3100
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
23.48.23.161:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
—
—
255.255.255.255:6889
—
—
—
unknown
6544
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.161
  • 23.48.23.169
  • 23.48.23.157
  • 23.48.23.173
  • 23.48.23.174
  • 23.48.23.168
  • 23.48.23.164
  • 23.48.23.156
  • 23.48.23.162
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 216.58.212.142
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.20
  • 20.190.160.2
  • 40.126.32.133
  • 20.190.160.128
  • 40.126.32.134
  • 20.190.160.64
  • 20.190.160.3
  • 20.190.160.131
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
go.microsoft.com
  • 69.192.162.125
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
tranScreen.exe