File name:

sp136491.exe

Full analysis: https://app.any.run/tasks/390fd506-116f-4de3-8552-47ead80acb22
Verdict: Malicious activity
Analysis date: February 24, 2022, 20:27:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

7B471248AA5A7AD86171B494F61039A9

SHA1:

B5038F5420F18BACD9955690785F32FA56EDE951

SHA256:

2BF526DD8C2734DE80226AC54403AEB4C3963C5944E0E9BE9C49DDD37C5014FD

SSDEEP:

196608:Uhe2waiLfUeKCgJvbBejCydaOMjcRCkczhUEIMzvFdvenYfiIKXklr0A:OsJg1FyX5fcDrFQnur

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • HPBIOS~1.EXE (PID: 3220)

    • Changes the autorun value in the registry

      • reg.exe (PID: 2976)

  • SUSPICIOUS

    • Reads the computer name

      • sp136491.exe (PID: 3004)
      • cmd.exe (PID: 4092)
      • HPBIOS~1.EXE (PID: 3220)
      • Skype.exe (PID: 3520)
      • Skype.exe (PID: 308)
      • Skype.exe (PID: 3576)
      • Skype.exe (PID: 2748)
      • Skype.exe (PID: 188)
      • Skype.exe (PID: 2052)

    • Checks supported languages

      • cmd.exe (PID: 4092)
      • HPBIOS~1.EXE (PID: 3220)
      • sp136491.exe (PID: 3004)
      • Skype.exe (PID: 3520)
      • Skype.exe (PID: 308)
      • Skype.exe (PID: 2748)
      • Skype.exe (PID: 3576)
      • Skype.exe (PID: 188)
      • Skype.exe (PID: 2052)

    • Drops a file that was compiled in debug mode

      • sp136491.exe (PID: 3004)

    • Application launched itself

      • Skype.exe (PID: 3520)
      • Skype.exe (PID: 2748)
      • Skype.exe (PID: 188)

    • Changes default file association

      • Skype.exe (PID: 3520)

    • Uses REG.EXE to modify Windows registry

      • Skype.exe (PID: 3520)

    • Creates files in the user directory

      • Skype.exe (PID: 3520)
      • Skype.exe (PID: 2748)
      • Skype.exe (PID: 188)

    • Reads CPU info

      • Skype.exe (PID: 3520)

    • Executable content was dropped or overwritten

      • sp136491.exe (PID: 3004)

  • INFO

    • Checks supported languages

      • WINWORD.EXE (PID: 908)
      • reg.exe (PID: 2976)
      • reg.exe (PID: 2464)

    • Reads the computer name

      • WINWORD.EXE (PID: 908)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 908)

    • Manual execution by user

      • Skype.exe (PID: 3520)
      • WINWORD.EXE (PID: 908)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 908)

    • Reads the hosts file

      • Skype.exe (PID: 3520)

    • Reads settings of System Certificates

      • Skype.exe (PID: 3520)

    • Dropped object may contain Bitcoin addresses

      • Skype.exe (PID: 3520)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

LegalCopyright: Copyright (c) 2019 HP Development Company, LP.
ProductVersion: 01.53
ProductName: HP Notebook System BIOS Update (N75)
OriginalFileName: hpsoftpaqwrapper.exe
InternalName: hpsoftpaqwrapper
FileVersion: 0.2.56.9141
FileDescription: HP Notebook System BIOS Update (N75)
CompanyName: HP Inc.
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 0.2.0.0
FileVersionNumber: 0.2.56.9141
Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 6
EntryPoint: 0x190f6
UninitializedDataSize: -
InitializedDataSize: 126464
CodeSize: 186880
LinkerVersion: 14.16
PEType: PE32
TimeStamp: 2020:11:19 08:38:27+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 19-Nov-2020 07:38:27
Detected languages:
  • English - United States
Debug artifacts:
  • D:\a\1\s\Release\hpsoftpaqwrapper.pdb
CompanyName: HP Inc.
FileDescription: HP Notebook System BIOS Update (N75)
FileVersion: 0.2.56.9141
InternalName: hpsoftpaqwrapper
OriginalFilename: hpsoftpaqwrapper.exe
ProductName: HP Notebook System BIOS Update (N75)
ProductVersion: 01.53
LegalCopyright: Copyright (c) 2019 HP Development Company, LP.

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000110

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 19-Nov-2020 07:38:27
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0002D9DE
0x0002DA00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.5599
.rdata
0x0002F000
0x0000CAA2
0x0000CC00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.03169
.data
0x0003C000
0x00002300
0x00001600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.15838
.rsrc
0x0003F000
0x0000DE84
0x0000E000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.51669
.reloc
0x0004D000
0x00002B88
0x00002C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.6058

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.12227
810
Latin 1 / Western European
English - United States
RT_MANIFEST
2
7.85069
1698
Latin 1 / Western European
English - United States
RT_ICON
3
7.89767
2869
Latin 1 / Western European
English - United States
RT_ICON
4
7.94506
4630
Latin 1 / Western European
English - United States
RT_ICON
5
7.97237
10113
Latin 1 / Western European
English - United States
RT_ICON
6
7.96456
19260
Latin 1 / Western European
English - United States
RT_ICON
13
3.22339
1014
Latin 1 / Western European
English - United States
RT_STRING
14
3.27585
1482
Latin 1 / Western European
English - United States
RT_STRING
102
2.47732
128
Latin 1 / Western European
English - United States
RT_DIALOG
115
2.70924
116
Latin 1 / Western European
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
MPR.dll (delay-loaded)
OLEAUT32.dll
SHELL32.dll
USER32.dll
gdiplus.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
14
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start cmd.exe no specs sp136491.exe no specs sp136491.exe no specs sp136491.exe hpbios~1.exe no specs winword.exe no specs skype.exe skype.exe reg.exe skype.exe no specs reg.exe no specs skype.exe skype.exe no specs skype.exe

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --type=renderer --ms-disable-indexeddb-transaction-timeout --no-sandbox --service-pipe-token=7E46DF044C8BAE8677C923D35155902A --lang=en-US --app-user-model-id=Microsoft.Skype.SkypeDesktop --app-path="C:\Program Files\Microsoft\Skype for Desktop\resources\app.asar" --node-integration=false --webview-tag=true --no-sandbox --preload="C:\Program Files\Microsoft\Skype for Desktop\resources\app.asar\Preload.js" --context-id=1 --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=7E46DF044C8BAE8677C923D35155902A --renderer-client-id=4 --mojo-platform-channel-handle=2316 /prefetch:1C:\Program Files\Microsoft\Skype for Desktop\Skype.exe—Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Exit code:
0
Version:
8.29.0.50
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft\skype for desktop\skype.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\program files\microsoft\skype for desktop\node.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\program files\microsoft\skype for desktop\msvcp140.dll
308"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1C:\Program Files\Microsoft\Skype for Desktop\Skype.exe
Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Exit code:
0
Version:
8.29.0.50
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft\skype for desktop\skype.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\skype for desktop\node.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\rpcrt4.dll
c:\program files\microsoft\skype for desktop\msvcp140.dll
580"C:\Users\admin\AppData\Local\Temp\sp136491.exe" C:\Users\admin\AppData\Local\Temp\sp136491.exe—cmd.exe
User:
admin
Company:
HP Inc.
Integrity Level:
MEDIUM
Description:
HP Notebook System BIOS Update (N75)
Exit code:
3221226540
Version:
0.2.56.9141
Modules
Images
c:\users\admin\appdata\local\temp\sp136491.exe
c:\windows\system32\ntdll.dll
908"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\instrumentssaturday.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\gdi32.dll
2052"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1C:\Program Files\Microsoft\Skype for Desktop\Skype.exe
Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Exit code:
2
Version:
8.29.0.50
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft\skype for desktop\skype.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\microsoft\skype for desktop\node.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\program files\microsoft\skype for desktop\api-ms-win-crt-runtime-l1-1-0.dll
2464C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Skype /v RestartForUpdateC:\Windows\system32\reg.exe—Skype.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
2748"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --type=renderer --ms-disable-indexeddb-transaction-timeout --no-sandbox --service-pipe-token=03AC55AE0393E648C05AAD6E91F643D3 --lang=en-US --app-user-model-id=Microsoft.Skype.SkypeDesktop --app-path="C:\Program Files\Microsoft\Skype for Desktop\resources\app.asar" --node-integration=false --webview-tag=true --no-sandbox --preload="C:\Program Files\Microsoft\Skype for Desktop\resources\app.asar\Preload.js" --context-id=2 --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=03AC55AE0393E648C05AAD6E91F643D3 --renderer-client-id=3 --mojo-platform-channel-handle=1580 /prefetch:1C:\Program Files\Microsoft\Skype for Desktop\Skype.exe—Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Exit code:
0
Version:
8.29.0.50
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft\skype for desktop\skype.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\skype for desktop\node.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\program files\microsoft\skype for desktop\msvcp140.dll
2976C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Skype for Desktop" /t REG_SZ /d "C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" /fC:\Windows\system32\reg.exe
Skype.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3004"C:\Users\admin\AppData\Local\Temp\sp136491.exe" C:\Users\admin\AppData\Local\Temp\sp136491.exe
cmd.exe
User:
admin
Company:
HP Inc.
Integrity Level:
HIGH
Description:
HP Notebook System BIOS Update (N75)
Exit code:
0
Version:
0.2.56.9141
Modules
Images
c:\users\admin\appdata\local\temp\sp136491.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
3220HPBIOSUPDREC.exe c:\SWSetup\sp136491\HPBIOS~1.EXE—sp136491.exe
User:
admin
Company:
HP
Integrity Level:
HIGH
Description:
HP Bios Update and Recovery
Exit code:
0
Version:
1.1.42.1
Modules
Images
c:\swsetup\sp136491\hpbiosupdrec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msimg32.dll
Total events
8 033
Read events
7 696
Write events
194
Delete events
143

Modification events

(PID) Process:(4092) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(4092) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(4092) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(4092) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(908) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:(s;
Value:
28733B008C030000010000000000000000000000
(PID) Process:(908) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(908) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(908) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(908) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(908) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
Executable files
4
Suspicious files
8
Text files
10
Unknown types
6

Dropped files

PID
Process
Filename
Type
3004sp136491.exeC:\SWSetup\sp136491\N75_0153.bin —
MD5:—
SHA256:—
3220HPBIOS~1.EXEC:\SWSetup\sp136491\N75_0153.bin.temp —
MD5:—
SHA256:—
3220HPBIOS~1.EXEC:\SWSetup\sp136491\N75_0153.bin —
MD5:—
SHA256:—
908WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR6F28.tmp.cvr —
MD5:—
SHA256:—
3520Skype.exeC:\Users\admin\AppData\Local\Temp\7297b424-0452-4ce6-94ac-52a7a5ca42f6.tmp.ico —
MD5:—
SHA256:—
3520Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\LOG.old —
MD5:—
SHA256:—
3520Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\LOG.old —
MD5:—
SHA256:—
3004sp136491.exeC:\SWSetup\sp136491\HPBIOSUPDREC.exeexecutable
MD5:—
SHA256:—
3520Skype.exeC:\Users\admin\AppData\Local\Temp\4bdd9bf4-46ae-4ea0-85d7-f63e99219f76.tmp.ico —
MD5:—
SHA256:—
3004sp136491.exeC:\SWSetup\sp136491\HpqPswd.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
6
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3520
Skype.exe
2.20.156.179:443
download.skype.com
Akamai International B.V.
—
unknown
3520
Skype.exe
20.50.201.200:443
pipe.skype.com
—
US
suspicious
3520
Skype.exe
52.174.193.75:443
get.skype.com
Microsoft Corporation
NL
whitelisted
3520
Skype.exe
152.199.19.160:443
bot-framework.azureedge.net
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3520
Skype.exe
13.107.42.16:443
a.config.skype.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
get.skype.com
  • 52.174.193.75
whitelisted
a.config.skype.com
  • 13.107.42.16
whitelisted
pipe.skype.com
  • 20.50.201.200
whitelisted
download.skype.com
  • 2.20.156.179
whitelisted
bot-framework.azureedge.net
  • 152.199.19.160
whitelisted
config.edge.skype.com
  • 13.107.42.16
malicious

Threats

No threats detected
Process
Message
Skype.exe
[308:324:0224/202855.558:VERBOSE1:crash_service_main.cc(78)] Session start. cmdline is [--reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1]
Skype.exe
[308:324:0224/202855.558:VERBOSE1:crash_service.cc(145)] window handle is 0004013E
Skype.exe
[308:324:0224/202855.558:VERBOSE1:crash_service.cc(300)] pipe name is \\.\pipe\skype-preview Crash Service dumps at C:\Users\admin\AppData\Local\Temp\skype-preview Crashes
Skype.exe
[308:324:0224/202855.558:VERBOSE1:crash_service.cc(304)] checkpoint is C:\Users\admin\AppData\Local\Temp\skype-preview Crashes\crash_checkpoint.txt server is https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload maximum 128 reports/day reporter is electron-crash-service
Skype.exe
[308:324:0224/202855.558:VERBOSE1:crash_service_main.cc(94)] Ready to process crash requests
Skype.exe
[308:2704:0224/202855.558:VERBOSE1:crash_service.cc(333)] client start. pid = 3520
Skype.exe
[308:2704:0224/202857.250:VERBOSE1:crash_service.cc(333)] client start. pid = 2748
Skype.exe
[3576:3636:0224/202857.318:VERBOSE1:crash_service_main.cc(78)] Session start. cmdline is [--reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1]
Skype.exe
[3576:3636:0224/202857.319:VERBOSE1:crash_service.cc(145)] window handle is 00040164
Skype.exe
[3576:3636:0224/202857.319:VERBOSE1:crash_service.cc(300)] pipe name is \\.\pipe\skype-preview Crash Service dumps at C:\Users\admin\AppData\Local\Temp\skype-preview Crashes
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
sp136491.exe