File name:

wps_lid.lid-s8HJc0rg29Mi.exe

Full analysis: https://app.any.run/tasks/272e9d71-b759-414f-b04f-594e52dcce50
Verdict: Malicious activity
Analysis date: October 04, 2024, 09:07:25
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
qrcode
maldoc-17
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

942A47FCC5B669BDC9D2B0226968E2FE

SHA1:

14522FBD0F417640B2BFD1415EF81759AD3016CF

SHA256:

77702FF79E0B2B3C5997AA90C7250E2EDE5A9F9B7F1D95A29A041EA8C09BC5BA

SSDEEP:

98304:OFs0JDndqGNDhv0XzX0zYdIbeb6AeVyfQmnxWq7KGK+8kz5LTHPwSXz7nWVsiYIb:e6JrfmEY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops known malicious document

      • 0c449bf71a3551f4a36d5ed8d4f53907-15_setup_XA_mui_Free.exe.600.1007.exe (PID: 4784)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 0c449bf71a3551f4a36d5ed8d4f53907-15_setup_XA_mui_Free.exe.600.1007.exe (PID: 4784)

    • Process drops legitimate windows executable

      • 0c449bf71a3551f4a36d5ed8d4f53907-15_setup_XA_mui_Free.exe.600.1007.exe (PID: 4784)

    • The process drops C-runtime libraries

      • 0c449bf71a3551f4a36d5ed8d4f53907-15_setup_XA_mui_Free.exe.600.1007.exe (PID: 4784)

    • There is functionality for taking screenshot (YARA)

      • 0c449bf71a3551f4a36d5ed8d4f53907-15_setup_XA_mui_Free.exe.600.1007.exe (PID: 4784)

    • Process drops SQLite DLL files

      • 0c449bf71a3551f4a36d5ed8d4f53907-15_setup_XA_mui_Free.exe.600.1007.exe (PID: 4784)

  • INFO

    • Checks supported languages

      • wps_lid.lid-s8HJc0rg29Mi.exe (PID: 4180)

    • Reads the machine GUID from the registry

      • wps_lid.lid-s8HJc0rg29Mi.exe (PID: 4180)

    • Process checks computer location settings

      • wps_lid.lid-s8HJc0rg29Mi.exe (PID: 4180)

    • Reads the computer name

      • wps_lid.lid-s8HJc0rg29Mi.exe (PID: 4180)

    • Reads the software policy settings

      • wps_lid.lid-s8HJc0rg29Mi.exe (PID: 4180)

    • Create files in a temporary directory

      • wps_lid.lid-s8HJc0rg29Mi.exe (PID: 4180)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (3.6)
.exe | Generic Win/DOS Executable (1.6)
.exe | DOS Executable Generic (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:08:12 05:03:11+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 4018176
InitializedDataSize: 1696256
UninitializedDataSize: -
EntryPoint: 0x270706
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 12.2.0.17561
ProductVersionNumber: 12.2.0.17561
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Zhuhai Kingsoft Office Software Co.,Ltd
FileDescription: WPS Office Setup
FileVersion: 12,2,0,17561
InternalName: konlinesetup_xa
LegalCopyright: Copyright©2024 Kingsoft Corporation. All rights reserved.
OriginalFileName: konlinesetup_xa.exe
ProductName: WPS Office
ProductVersion: 12,2,0,17561
MIMEType: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wps_lid.lid-s8hjc0rg29mi.exe THREAT 0c449bf71a3551f4a36d5ed8d4f53907-15_setup_xa_mui_free.exe.600.1007.exe shellexperiencehost.exe no specs systemsettingsbroker.exe no specs explorer.exe no specs COpenControlPanel no specs COpenControlPanel no specs

Process information

PID
CMD
Path
Indicators
Parent process
880C:\WINDOWS\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shcore.dll
1700C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}C:\Windows\SysWOW64\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
1744C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}C:\Windows\SysWOW64\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
3532C:\Windows\System32\SystemSettingsBroker.exe -EmbeddingC:\Windows\System32\SystemSettingsBroker.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
System Settings Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\systemsettingsbroker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
4180"C:\Users\admin\AppData\Local\Temp\wps_lid.lid-s8HJc0rg29Mi.exe" C:\Users\admin\AppData\Local\Temp\wps_lid.lid-s8HJc0rg29Mi.exe
explorer.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
MEDIUM
Description:
WPS Office Setup
Version:
12,2,0,17561
Modules
Images
c:\users\admin\appdata\local\temp\wps_lid.lid-s8hjc0rg29mi.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4784C:\Users\admin\AppData\Local\Temp\wps_download\0c449bf71a3551f4a36d5ed8d4f53907-15_setup_XA_mui_Free.exe.600.1007.exe -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -curlangofinstalledproduct=en_US -notElevateAndDirectlyInstall -D="C:\Users\admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\admin\AppData\Roaming"C:\Users\admin\AppData\Local\Temp\wps_download\0c449bf71a3551f4a36d5ed8d4f53907-15_setup_XA_mui_Free.exe.600.1007.exe
wps_lid.lid-s8HJc0rg29Mi.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
MEDIUM
Description:
WPS Install Application
Version:
12,2,0,18283
Modules
Images
c:\users\admin\appdata\local\temp\wps_download\0c449bf71a3551f4a36d5ed8d4f53907-15_setup_xa_mui_free.exe.600.1007.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msi.dll
6644"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\wincorlib.dll
Total events
24 621
Read events
24 525
Write events
90
Delete events
6

Modification events

(PID) Process:(4180) wps_lid.lid-s8HJc0rg29Mi.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\kwpsonlinesetup
Operation:writeName:infoGuid
Value:
F87C6CDAD7A64ADB93693763333CE47C
(PID) Process:(4180) wps_lid.lid-s8HJc0rg29Mi.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\kwpsonlinesetup
Operation:writeName:infoHdid
Value:
253e80bee18cf27911a3fa788c1b6f73
(PID) Process:(4180) wps_lid.lid-s8HJc0rg29Mi.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\kwpsonlinesetup
Operation:writeName:onlinesetup_penetrate_id_type
Value:
web
(PID) Process:(4180) wps_lid.lid-s8HJc0rg29Mi.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\kwpsonlinesetup
Operation:writeName:onlinesetup_penetrate_id
Value:
lid-s8HJc0rg29Mi
(PID) Process:(4180) wps_lid.lid-s8HJc0rg29Mi.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\Office\6.0\Common
Operation:writeName:newGuideShow
Value:
1
(PID) Process:(4180) wps_lid.lid-s8HJc0rg29Mi.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\Office\6.0\plugins\kdcsdk
Operation:writeName:countrycode
Value:
DE
(PID) Process:(4180) wps_lid.lid-s8HJc0rg29Mi.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\Office\6.0\plugins\kdcsdk
Operation:writeName:lastupdatecountrycode
Value:
1728032856745
(PID) Process:(4180) wps_lid.lid-s8HJc0rg29Mi.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\Office\6.0\plugins\kdcsdk
Operation:writeName:lastUpdateDeviceInfoDate
Value:
2024/10/4
(PID) Process:(4180) wps_lid.lid-s8HJc0rg29Mi.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\Office\6.0\Common
Operation:writeName:Version
Value:
12.2.0.18283
(PID) Process:(4180) wps_lid.lid-s8HJc0rg29Mi.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\kwpsonlinesetup\shortlink
Operation:delete keyName:(default)
Value:
Executable files
342
Suspicious files
832
Text files
2 514
Unknown types
12

Dropped files

PID
Process
Filename
Type
4180wps_lid.lid-s8HJc0rg29Mi.exeC:\Users\admin\AppData\Local\Temp\wps_download\0c449bf71a3551f4a36d5ed8d4f53907-15_setup_XA_mui_Free.exe.600.1007.exe —
MD5:—
SHA256:—
47840c449bf71a3551f4a36d5ed8d4f53907-15_setup_XA_mui_Free.exe.600.1007.exeC:\Users\admin\AppData\Local\Temp\wps\~405898\CONTROL\prereadimages_qing.txt —
MD5:—
SHA256:—
47840c449bf71a3551f4a36d5ed8d4f53907-15_setup_XA_mui_Free.exe.600.1007.exeC:\Users\admin\AppData\Local\Temp\wps\~405898\CONTROL\default\background_msgbox_xa.pngimage
MD5:B43A492B0223096B73DE9A2B29D631B5
SHA256:AAFA36EF3DD914A1F00E0A4C9E7683E1AB2F160F0D5A88C8206C78EBA61DDF6F
47840c449bf71a3551f4a36d5ed8d4f53907-15_setup_XA_mui_Free.exe.600.1007.exeC:\Users\admin\AppData\Local\Temp\wps\~405898\CONTROL\default\background.pngimage
MD5:27B9C403FA884EBF4EA0CC23D69A42D7
SHA256:5479C612C47D5CD3EBDAA11EBF897B6E84D95C364587133E03F778450A51412D
4180wps_lid.lid-s8HJc0rg29Mi.exeC:\Users\admin\AppData\Local\Temp\konlinesetup\recommand.pngimage
MD5:1BC2F7678AE9D9AE6461DD7C4BC8B142
SHA256:EEE45D0D93A0A1D56E32F7C9C2B22EE78C187B6692A4F7F4F1624DA144FA9487
47840c449bf71a3551f4a36d5ed8d4f53907-15_setup_XA_mui_Free.exe.600.1007.exeC:\Users\admin\AppData\Local\Temp\wps\~405898\CONTROL\ja_JP\1003.pngimage
MD5:2D808B698701B15B33BEC04710A4F7EF
SHA256:3CFD7FA737826AC37D44B79F688B4DD2FE7E61B790A3EB5B90081B7F77446549
47840c449bf71a3551f4a36d5ed8d4f53907-15_setup_XA_mui_Free.exe.600.1007.exeC:\Users\admin\AppData\Local\Temp\wps\~405898\CONTROL\default\background_choose_mode.pngimage
MD5:DFCD86EE5D01A98036E7FAB9634513B7
SHA256:4E595667FFBC31321ED210169F37374123291623ADD8575D6BDD78A4026DA9C2
47840c449bf71a3551f4a36d5ed8d4f53907-15_setup_XA_mui_Free.exe.600.1007.exeC:\Users\admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.logtext
MD5:847AF76E6B0DADCDBC322E8807B1821F
SHA256:F6B77CFF5F01505CDC4644D49FD1F345D52A366DD5DFDEA3F9B7ADC365657F70
47840c449bf71a3551f4a36d5ed8d4f53907-15_setup_XA_mui_Free.exe.600.1007.exeC:\Users\admin\AppData\Local\Temp\wps\~405898\CONTROL\default\imglst_close.pngimage
MD5:2818D3996780473EAF36C4B9A436795B
SHA256:0742D1B03B0BC28B133FDCA5C3E895FF5C9F715D0D890947DB7D9A71FE847C18
47840c449bf71a3551f4a36d5ed8d4f53907-15_setup_XA_mui_Free.exe.600.1007.exeC:\Users\admin\AppData\Local\Temp\wps\~405898\CONTROL\default\imglst_check.pngimage
MD5:1CBCBE2FB6BD1F707C3C714FF86C5C5B
SHA256:9695BD59548A46DDE0C66F2E32B0222527FD8C51252DD8E2CB8B6B21199816DB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
70
DNS requests
27
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1308
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2120
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3268
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4092
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4092
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
876
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4180
wps_lid.lid-s8HJc0rg29Mi.exe
142.250.186.174:443
www.google-analytics.com
GOOGLE
US
whitelisted
4180
wps_lid.lid-s8HJc0rg29Mi.exe
90.84.175.86:443
api.wps.com
Orange
FR
whitelisted
876
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4180
wps_lid.lid-s8HJc0rg29Mi.exe
104.16.84.69:443
wdl1.pcfg.cache.wpscdn.com
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
google.com
  • 142.250.185.206
whitelisted
www.google-analytics.com
  • 142.250.186.174
whitelisted
api.wps.com
  • 90.84.175.86
whitelisted
wdl1.pcfg.cache.wpscdn.com
  • 104.16.84.69
  • 104.16.83.69
unknown
login.live.com
  • 40.126.32.134
  • 40.126.32.140
  • 20.190.160.22
  • 40.126.32.76
  • 20.190.160.17
  • 40.126.32.138
  • 20.190.160.20
  • 20.190.160.14
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted

Threats

No threats detected
Process
Message
0c449bf71a3551f4a36d5ed8d4f53907-15_setup_XA_mui_Free.exe.600.1007.exe
[kscreen] isElide:0 switchRec:0 switchRecElide:1
0c449bf71a3551f4a36d5ed8d4f53907-15_setup_XA_mui_Free.exe.600.1007.exe
QLayout: Attempting to add QLayout "" to QWidget "m_BrandAreaWidget", which already has a layout
0c449bf71a3551f4a36d5ed8d4f53907-15_setup_XA_mui_Free.exe.600.1007.exe
QLayout: Attempting to add QLayout "" to QWidget "", which already has a layout
0c449bf71a3551f4a36d5ed8d4f53907-15_setup_XA_mui_Free.exe.600.1007.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
0c449bf71a3551f4a36d5ed8d4f53907-15_setup_XA_mui_Free.exe.600.1007.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
0c449bf71a3551f4a36d5ed8d4f53907-15_setup_XA_mui_Free.exe.600.1007.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
0c449bf71a3551f4a36d5ed8d4f53907-15_setup_XA_mui_Free.exe.600.1007.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
0c449bf71a3551f4a36d5ed8d4f53907-15_setup_XA_mui_Free.exe.600.1007.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
0c449bf71a3551f4a36d5ed8d4f53907-15_setup_XA_mui_Free.exe.600.1007.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
0c449bf71a3551f4a36d5ed8d4f53907-15_setup_XA_mui_Free.exe.600.1007.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
wps_lid.lid-s8HJc0rg29Mi.exe