File scan report
Verdict Safe
Is hpsoftpaqwrapper.
An installer carrying a valid HP Inc. signature that none of the 71 antivirus engines that checked it flagged, first seen in June 2022 and sent in by 125 separate sources.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
Install it if it came from HP's official support or driver pages. Keep your antivirus protection enabled and prefer the vendor's own download site over third-party mirrors.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing HP Inc.
- Test run Completed
- First seen 4y ago
Chapter 02
Why we think so
0 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This is an HP software installer with a valid digital signature from HP Inc., and none of the 71 antivirus engines that checked it flagged it. It has been in circulation since June 2022 and was submitted by 125 distinct sources, which is the pattern of a widely distributed vendor package rather than a targeted attack. Nothing in the behaviour or files it created points to harm.
The file is a Windows installer whose digital signature verifies and names HP Inc., a publisher on our trusted list, and no engine in the 75-engine set raised anything at all — the 18 highest-trust engines were all silent. Network activity stayed on Microsoft identity and content devices, and every contacted host we could check returned no malicious or suspicious report. The ten dropped files we inspected included two known-good software entries and none judged harmful. Combined with wide, long-running distribution and one earlier clean call on another file from the same publisher, the evidence describes a legitimate vendor package.
What We Detected
Nothing. Every one of the 71 antivirus engines that checked it in our network returned a clean result, including the 18 that carry the most weight, such as Kaspersky, ESET-NOD32, BitDefender, Fortinet, Avast and Avira. The portable-executable layout shows no packer, no unusual section entropy and no wrapped or encrypted code.
Signature and Publisher
The executable carries a valid digital signature that verifies against HP Inc., a publisher already on our trusted list. A matching signature means the bytes are exactly what that publisher shipped; it would fail verification if the file had been altered after signing.
Threat Behavior
Six sandbox runs recorded ordinary installer activity: extraction into a program directory, creation of a display-control service, registry entries for that service and an uninstall record, plus normal system queries. The summary includes generic technique labels for process injection and defence tampering, but no injected target process and no tampering artefact were recorded, and such labels appear on the majority of files that no engine flags, so they do not describe anything observed. Network contacts were limited to Microsoft identity and content devices, and the host reputation check found nothing malicious or suspicious. Of the dropped files, two are known-good software entries and none was judged harmful. Our own static review of the bytes was not performed for this submission, so the archive and code contents were not examined by us.
Distribution
The file was first seen on Jun 23, 2022 and has been submitted by 125 distinct sources — the spread expected from a vendor-supplied HP software package. A previous file from the same publisher was also judged clean.
What To Do Now
No action is needed beyond normal care: keep it if you obtained it from HP's own support or driver pages. Keep your antivirus protection enabled, and install HP software from HP's site rather than from third-party download portals, where repackaged installers can differ from the signed original.
Where this verdict could be wrong1 caveat
- A signed installer can still bundle unwanted components; here that concern is not supported, since the dropped files inspected were either known-good software or had no hostile findings, and no engine raised anything.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Valid digital signature from HP Inc., a publisher on our trusted list
- None of the 71 antivirus engines that checked it flagged the file, including all 18 highest-trust engines
- Submitted by 125 distinct sources since June 2022 — the spread of a widely distributed vendor package
- No malicious network contact, no harmful dropped file and no malicious sandbox verdict across six runs
- An earlier file from the same publisher was also judged clean in our records
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 6 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 6isolated sandbox runs
- 20sandbox rule tags
- 4spawned processes
- 2network contacts
- 34filesystem & mutex artifacts
What this file did when executed
This file was detonated in 6 sandboxes and its runtime behaviour was observed.
Techniques observed in the sandbox
20MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1027· Obfuscated code
- T1036
- T1055· Process injection
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1112
- T1129· Loads modules
- T1134
- T1135
- T1218.010
- T1222
- T1497· Sandbox evasion
- T1497.001· Sandbox evasion
- T1543.003· Service install
- T1562.001· Disables security
- T1569.002
- T1574.002· Execution hijack
Observed activity
Processes started
4Programs the file ran, with their command lines.
file.exe"C:\Users\<USER>\Desktop\file.exe"HPDC_Service_4.8.67.0 (1).exe%SAMPLEPATH%\HPDC_Service_4.8.67.0 (1).exehpsoftpaqwrapper.exe%SAMPLEPATH%\hpsoftpaqwrapper.exeHPDC_Service_4.8.67.0.exe%SAMPLEPATH%\HPDC_Service_4.8.67.0.exe
Network contacts
22 hosts, listed as 1 domain, 1 address. Links show the host and path only.
- Domain
prda.aadg.msidentity.com - IP address
23.6.103.183
Files
30Files the file created, changed or deleted.
- Written
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll - Written
C:\Program Files - Written
C:\Program Files\Portrait Displays - Written
C:\Program Files\Portrait Displays\HP Display Control Service - Written
C:\Program Files\Portrait Displays\HP Display Control Service\ACKNOWLEDGEMENTS.txt - Written
C:\Program Files\Portrait Displays\HP Display Control Service\CTHelper.exe
Show all 30 entries for files
- Written
C:\Program Files\Portrait Displays\HP Display Control Service\DisplayControlService.exe - Written
C:\Program Files\Portrait Displays\HP Display Control Service\PdiShellExt.dll - Written
C:\Program Files\Portrait Displays\HP Display Control Service\ScalarInputUtil.exe - Written
C:\Program Files\Portrait Displays\HP Display Control Service\Uninstall.exe - Written
C:\Program Files\Portrait Displays\HP Display Control Service\cgt.exe - Written
C:\Program Files\Portrait Displays\HP Display Control Service\icctool.exe - Written
C:\SWSetup\SP140213\Service_Setup.exe - Written
C:\Users\user\AppData\Local\Microsoft\Windows\Caches - Written
C:\Users\user\AppData\Local\Temp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER13D1.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER14AC.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER14DC.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E03.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E04.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E05.tmp.txt - Deleted
C:\Windows\System32\spp\store\2.0\cache\cache.dat - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER49F4.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4ABF.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4AEF.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER657B.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER658D.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER659D.tmp.txt - Deleted
%USERPROFILE%\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000018.db - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER913.tmp.WERInternalMetadata.xml
Registry and auto-start
15Settings the file changed, including ways to start again after a restart.
- Set
HKLM\System\CurrentControlSet\Services\GoogleChromeElevationService\Start - Set
HKLM\System\CurrentControlSet\Services\GoogleChromeElevationService\ImagePath - Set
HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\A70D59A1-8EAD-4F40-AAAB-FBFC460800A4\FriendlyName - Set
HKEY_CURRENT_USER\Software\Portrait Displays - Set
HKEY_CURRENT_USER\Software\Portrait Displays\HP Display Control Service - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Portrait Displays
Show all 15 entries for registry and auto-start
- Set
HKEY_LOCAL_MACHINE\SOFTWARE\Portrait Displays\HP Display Control Service - Set
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{08EE20F5-7351-4CFD-9447-F0CD26C63974} - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5F8D079B-8CE6-4F58-BF10-55C1B68D88F3} - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5F8D079B-8CE6-4F58-BF10-55C1B68D88F3}\InprocServer32 - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DesktopBackground\shellex\ContextMenuHandlers\PdiShellExt - Set
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\HPDCService - Set
HKEY_CURRENT_USER\Software\Portrait Displays\HP Display Control Service\NULL - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Portrait Displays\HP Display Control Service\AppName - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Portrait Displays\HP Display Control Service\AppPath
Mutexes
4Named locks a program uses so only one copy runs; malware families often reuse them.
\BaseNamedObjects\Local\SM0:1604:304:WilStaging_02\BaseNamedObjects\Local\SM0:8124:304:WilStaging_02\BaseNamedObjects\Local\SM0:6644:304:WilStaging_02\BaseNamedObjects\Local\SM0:6792:304:WilStaging_02
Sandbox background — not the file
13The analysis machine's own processes and connections, recorded in every run.
- VM process
wuapihost.exeC:\Windows\System32\wuapihost.exe - VM host
query.prod.cms.rt.microsoft.com - VM host
20.99.132.105 - VM host
a83f:8110:6c61:794e:616d:6500:0:0 - VM host
23.216.147.64 - VM host
20.99.186.246
Show all 13 entries for sandbox background — not the file
- VM host
192.229.211.108 - VM host
20.99.133.109 - VM host
23.216.147.76 - VM host
20.99.185.48 - VM host
20.99.184.37 - VM host
a83f:8110:6d00:6500:6e00:7400:6300:6f00 - VM host
13.107.4.50
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 8 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 43d28decbd5f5270b49c…cbf17aNot checkedno saved verdict
- 09f91f39900d64e2f21b…44354bNot checkedno saved verdict
- 9cc19d2143c4b6953f5a…32d4a0Not checkedno saved verdict
- 9f7a620e13961694595e…b3b336Not checkedno saved verdict
- 05011b6129e5e5c913c6…8e7d55Not checkedno saved verdict
- b6a185cea0820f17776a…1e50b2Not checkedno saved verdict
- 94579a22f2e400770e28…537bf6Not checkedno saved verdict
- ce67fc14fda98d6c481f…e9e1f8Not checkedno saved verdict
- 4ff9b2678d698677c5d9…595cbeCleantrust 85known-software reference set · not scanned here
- 49a6a1c1f19574b2a247…74ae5dCleantrust 85known-software reference set · not scanned here
Chapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; signed by HP Inc..
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Nov 6, 2026, 9:27 PM UTC
- SHA-256
8d20daca49ddf1408b95a52be4e40c1ab5a041c109328bb5b2cb5d39ce7888a3- SHA-1
168c956f30fa8ab58533cd5742ed43d0d5c132fd- MD5
4a65d50cc6dc68ee56fe081c4a39a268
About this file
hpsoftpaqwrapper.exe says it is HP Display Control Service, 1.9 MB.
- Claims to be
- HP Display Control ServiceFrom the file's own version information, written by whoever built it.
- Original name
- hpsoftpaqwrapper.exeMatches the shared file name.
- Type and size
- Win32 EXE · 1.9 MB
- Signer
- HP Inc.Valid code signature.
- First seen
- Jun 23, 2022On VirusTotal.
- Submitted by
- 125 distinct sources
- Packer
- None detected
- Entropy
- 6.44 of 8
First scanned
Antivirus consensus
0 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is hpsoftpaqwrapper.exe safe?
What is hpsoftpaqwrapper.exe?
How many antivirus engines detected hpsoftpaqwrapper.exe?
Is hpsoftpaqwrapper.exe digitally signed?
What is the SHA-256 hash of hpsoftpaqwrapper.exe?
Is it safe to run hpsoftpaqwrapper.exe?
How up to date is this analysis of hpsoftpaqwrapper.exe?
Community
Member reviews and reports for this exact file hash.