File name:

wps_wid.cid-1726498999.1749666569.exe

Full analysis: https://app.any.run/tasks/2cd85135-5e79-4aed-8c48-8649cc2853d0
Verdict: Malicious activity
Analysis date: June 11, 2025, 18:53:14
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
wps
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

24F7506508AE01E9C029E2AC4FD34451

SHA1:

1CF4D9095B9BC390572C680CA2D3A695A71D21D4

SHA256:

6B953C7B60D39E0ADF0CA1A1DCBF53225E079447EB9C02D549506C583BB1909E

SSDEEP:

98304:f6s0B3ZevjfsjC+qI9zquslfr9fPHMcQpjWeisy5xbLluuJjglkXEXWHH4XL4HuY:/lct3/g

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops known malicious document

      • eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe (PID: 1468)

  • SUSPICIOUS

    • WPS mutex has been found

      • wps_wid.cid-1726498999.1749666569.exe (PID: 1944)
      • eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe (PID: 1468)

    • Executable content was dropped or overwritten

      • eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe (PID: 1468)

    • Process drops legitimate windows executable

      • eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe (PID: 1468)

    • The process drops C-runtime libraries

      • eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe (PID: 1468)

    • The process checks if it is being run in the virtual environment

      • eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe (PID: 1468)

    • Reads security settings of Internet Explorer

      • eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe (PID: 1468)

    • Process drops SQLite DLL files

      • eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe (PID: 1468)

    • There is functionality for taking screenshot (YARA)

      • eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe (PID: 1468)

  • INFO

    • Reads the computer name

      • wps_wid.cid-1726498999.1749666569.exe (PID: 1944)
      • eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe (PID: 1468)

    • Creates files or folders in the user directory

      • wps_wid.cid-1726498999.1749666569.exe (PID: 1944)
      • eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe (PID: 1468)

    • Checks supported languages

      • wps_wid.cid-1726498999.1749666569.exe (PID: 1944)
      • eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe (PID: 1468)

    • Reads the machine GUID from the registry

      • wps_wid.cid-1726498999.1749666569.exe (PID: 1944)
      • eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe (PID: 1468)

    • Process checks computer location settings

      • wps_wid.cid-1726498999.1749666569.exe (PID: 1944)

    • Create files in a temporary directory

      • wps_wid.cid-1726498999.1749666569.exe (PID: 1944)
      • eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe (PID: 1468)

    • The sample compiled with english language support

      • eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe (PID: 1468)

    • Reads the software policy settings

      • eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe (PID: 1468)

    • The sample compiled with chinese language support

      • eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe (PID: 1468)

    • The sample compiled with japanese language support

      • eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe (PID: 1468)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (3.6)
.exe | Generic Win/DOS Executable (1.6)
.exe | DOS Executable Generic (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:23 07:34:03+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 4140544
InitializedDataSize: 1524736
UninitializedDataSize: -
EntryPoint: 0x2a6501
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 12.2.0.21212
ProductVersionNumber: 12.2.0.21212
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Zhuhai Kingsoft Office Software Co.,Ltd
FileDescription: WPS Office Setup
FileVersion: 12,2,0,21212
InternalName: konlinesetup_xa
LegalCopyright: Copyright©2025 Kingsoft Corporation. All rights reserved.
OriginalFileName: konlinesetup_xa.exe
ProductName: WPS Office
ProductVersion: 12,2,0,21212
MIMEType: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wps_wid.cid-1726498999.1749666569.exe eaf19e78da1037899ada3bfea5ffe5ae-16_setup_xa_mui_free.exe.601.1081.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1468"C:\Users\admin\AppData\Local\Temp\wps_download\eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -curlangofinstalledproduct=en_US -notElevateAndDirectlyInstall -D="C:\Users\admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\admin\AppData\Roaming"C:\Users\admin\AppData\Local\Temp\wps_download\eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe
wps_wid.cid-1726498999.1749666569.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
MEDIUM
Description:
WPS Install Application
Version:
12,2,0,21546
Modules
Images
c:\users\admin\appdata\local\temp\wps_download\eaf19e78da1037899ada3bfea5ffe5ae-16_setup_xa_mui_free.exe.601.1081.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msi.dll
1944"C:\Users\admin\AppData\Local\Temp\wps_wid.cid-1726498999.1749666569.exe" C:\Users\admin\AppData\Local\Temp\wps_wid.cid-1726498999.1749666569.exe
explorer.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
MEDIUM
Description:
WPS Office Setup
Version:
12,2,0,21212
Modules
Images
c:\users\admin\appdata\local\temp\wps_wid.cid-1726498999.1749666569.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4868C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
12 524
Read events
12 501
Write events
20
Delete events
3

Modification events

(PID) Process:(1944) wps_wid.cid-1726498999.1749666569.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\kwpsonlinesetup
Operation:writeName:onlinesetup_penetrate_id_type
Value:
web
(PID) Process:(1944) wps_wid.cid-1726498999.1749666569.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\kwpsonlinesetup
Operation:writeName:onlinesetup_penetrate_id
Value:
cid-1726498999.1749666569
(PID) Process:(1944) wps_wid.cid-1726498999.1749666569.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\Office\6.0\Common
Operation:writeName:newGuideShow
Value:
1
(PID) Process:(1944) wps_wid.cid-1726498999.1749666569.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\Office\6.0\plugins\kdcsdk
Operation:writeName:countrycode
Value:
US
(PID) Process:(1944) wps_wid.cid-1726498999.1749666569.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\Office\6.0\plugins\kdcsdk
Operation:writeName:lastupdatecountrycode
Value:
1749668001308
(PID) Process:(1944) wps_wid.cid-1726498999.1749666569.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\kwpsonlinesetup
Operation:writeName:infoGuid
Value:
80FED4B1C5B84667A88126EEC4EEAAA1
(PID) Process:(1944) wps_wid.cid-1726498999.1749666569.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\kwpsonlinesetup
Operation:writeName:infoHdid
Value:
0b037df7a599eb8eae69c33bd077c709
(PID) Process:(1944) wps_wid.cid-1726498999.1749666569.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\Office\6.0\plugins\kdcsdk
Operation:writeName:lastUpdateDeviceInfoDate
Value:
2025/6/11
(PID) Process:(1944) wps_wid.cid-1726498999.1749666569.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\Office\6.0\Common
Operation:writeName:Version
Value:
12.2.0.21546
(PID) Process:(1944) wps_wid.cid-1726498999.1749666569.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\kwpsonlinesetup\shortlink
Operation:delete keyName:(default)
Value:
Executable files
306
Suspicious files
465
Text files
2 451
Unknown types
375

Dropped files

PID
Process
Filename
Type
1944wps_wid.cid-1726498999.1749666569.exeC:\Users\admin\AppData\Local\Temp\wps_download\eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe —
MD5:—
SHA256:—
1468eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exeC:\Users\admin\AppData\Local\Temp\wps\~17c023\CONTROL\prereadimages_et.txt —
MD5:—
SHA256:—
1468eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exeC:\Users\admin\AppData\Local\Temp\wps\~17c023\CONTROL\prereadimages_pdf.txt —
MD5:—
SHA256:—
1468eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exeC:\Users\admin\AppData\Local\Temp\wps\~17c023\CONTROL\prereadimages_prometheus.txt —
MD5:—
SHA256:—
1468eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exeC:\Users\admin\AppData\Local\Temp\wps\~17c023\CONTROL\prereadimages_prome_init.txt —
MD5:—
SHA256:—
1468eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exeC:\Users\admin\AppData\Local\Temp\wps\~17c023\CONTROL\prereadimages_qing.txt —
MD5:—
SHA256:—
1468eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exeC:\Users\admin\AppData\Local\Temp\wps\~17c023\CONTROL\prereadimages_wpp.txt —
MD5:—
SHA256:—
1468eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exeC:\Users\admin\AppData\Local\Temp\wps\~17c023\CONTROL\prereadimages_wps.txt —
MD5:—
SHA256:—
1468eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exeC:\Users\admin\AppData\Local\Temp\wps\~17c023\CONTROL\default\background_msgbox_xa.pngimage
MD5:B43A492B0223096B73DE9A2B29D631B5
SHA256:AAFA36EF3DD914A1F00E0A4C9E7683E1AB2F160F0D5A88C8206C78EBA61DDF6F
1468eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exeC:\Users\admin\AppData\Local\Temp\wps\~17c023\CONTROL\default\background_msgbox.pngimage
MD5:5E288BF431CFBE4205505D24D2DC295D
SHA256:59AC8A457DD919C62821CCC395CBAADEB55A00BA4A7A7846F966083667476908
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
35
DNS requests
22
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.48.23.10:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2552
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6264
SIHClient.exe
GET
200
104.119.109.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6264
SIHClient.exe
GET
200
104.119.109.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
2.16.252.233:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6828
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5944
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1268
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1944
wps_wid.cid-1726498999.1749666569.exe
142.250.186.142:443
www.google-analytics.com
GOOGLE
US
whitelisted
1944
wps_wid.cid-1726498999.1749666569.exe
90.84.175.86:443
api.wps.com
Orange
FR
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2336
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2552
svchost.exe
20.190.159.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2552
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.206
whitelisted
www.google-analytics.com
  • 142.250.186.142
whitelisted
api.wps.com
  • 90.84.175.86
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.64
  • 20.190.159.23
  • 20.190.159.68
  • 20.190.159.130
  • 20.190.159.75
  • 40.126.31.3
  • 40.126.31.67
  • 20.190.159.4
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.48.23.10
  • 23.48.23.24
whitelisted
www.microsoft.com
  • 2.16.253.202
  • 104.119.109.218
whitelisted
wdl1.pcfg.cache.wpscdn.com
  • 23.236.112.178
unknown

Threats

No threats detected
Process
Message
eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe
[kscreen] isElide:0 switchRec:0 switchRecElide:1
eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe
QLayout: Attempting to add QLayout "" to QWidget "", which already has a layout
eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe
QLayout: Attempting to add QLayout "" to QWidget "m_BrandAreaWidget", which already has a layout
eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
eaf19e78da1037899ada3bfea5ffe5ae-16_setup_XA_mui_Free.exe.601.1081.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
wps_wid.cid-1726498999.1749666569.exe