Windows Analysis Report
wps_wid.cid-735916525.1730301987.exe

Overview

General Information

Sample name: wps_wid.cid-735916525.1730301987.exe
Analysis ID: 1545519
MD5: 8d76bb0011099f752d1df93ad3f697f2
SHA1: 467d3da8b2fa7ff0d2958d30c3345c109647e09d
SHA256: d19fe85036be98b74fff67bb43864b51c0e774085daac2fa09a3182acf08e772
Tags: exeuser-Fuzzy
Infos:

Detection

Score: 26
Range: 0 - 100
Whitelisted: false
Confidence: 0%

Compliance

Score: 34
Range: 0 - 100

Signatures

Contains functionality to infect the boot sector
Drops large PE files
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
AV process strings found (often used to terminate AV products)
Binary contains a suspicious time stamp
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Drops PE files
Drops certificate files (DER)
EXE planting / hijacking vulnerabilities found
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Uses the system / local time for branch decision (may execute only at specific dates)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009CA920 CryptQueryObject,CryptMsgGetParam,CryptMsgGetParam,CertFindCertificateInStore,CertGetNameStringW,CertGetNameStringW,CertGetNameStringW,CertFreeCRLContext,CertCloseStore,CryptMsgClose,CertGetNameStringW,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,PathFileExistsW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,RegCloseKey, 5_2_009CA920
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00C0F0D0 ?replace@QString@kso_qt@@QAEAAV12@ABV12@0W4CaseSensitivity@Qt@2@@Z,??0QByteArray@kso_qt@@QAE@ABV01@@Z,?isOverseasVersion@product@krt@@YA_NXZ,?fromAscii_helper@QString@kso_qt@@CAPAU?$QTypedArrayData@G@2@PBDH@Z,??4QString@kso_qt@@QAEAAV01@$$QAV01@@Z,??1QString@kso_qt@@QAE@XZ,??1QString@kso_qt@@QAE@XZ,??YQString@kso_qt@@QAEAAV01@PBD@Z,??0QUrl@kso_qt@@QAE@ABVQString@1@W4ParsingMode@01@@Z,??0QNetworkRequest@kso_qt@@QAE@ABVQUrl@1@@Z,??1QUrl@kso_qt@@QAE@XZ,?toUtf8@QString@kso_qt@@QHAE?AVQByteArray@2@XZ,??0QByteArray@kso_qt@@QAE@PBDH@Z,?setRawHeader@QNetworkRequest@kso_qt@@QAEXABVQByteArray@2@0@Z,??1QByteArray@kso_qt@@QAE@XZ,??1QByteArray@kso_qt@@QAE@XZ,?toUtf8@QString@kso_qt@@QHAE?AVQByteArray@2@XZ,??0QByteArray@kso_qt@@QAE@PBDH@Z,?setRawHeader@QNetworkRequest@kso_qt@@QAEXABVQByteArray@2@0@Z,??1QByteArray@kso_qt@@QAE@XZ,??1QByteArray@kso_qt@@QAE@XZ,?fromAscii_helper@QString@kso_qt@@CAPAU?$QTypedArrayData@G@2@PBDH@Z,??0QLocale@kso_qt@@QAE@W4Language@01@W4Country@01@@Z,?currentDateTimeUtc@QDateTime@kso_qt@@SA?AV12@XZ,?toString@QLocale@kso_qt@@QBE?AVQString@2@ABVQDateTime@2@ABV32@@Z,??1QDateTime@kso_qt@@QAE@XZ,??0QChar@kso_qt@@QAE@UQLatin1Char@1@@Z,?arg@QString@kso_qt@@QBE?AV12@ABV12@HVQChar@2@@Z,??1QString@kso_qt@@QAE@XZ,??1QLocale@kso_qt@@QAE@XZ,?hash@QCryptographicHash@kso_qt@@SA?AVQByteArray@2@ABV32@W4Algorithm@12@@Z,?toHex@QByteArray@kso_qt@@QBE?AV12@XZ,?toBase64@QByteArray@kso_qt@@QBE?AV12@XZ,??1QByteArray@kso_qt@@QAE@XZ,??1QByteArray@kso_qt@@QAE@XZ,?toUtf8@QString@kso_qt@@QHAE?AVQByteArray@2@XZ,??1QString@kso_qt@@QAE@XZ,??1QString@kso_qt@@QAE@XZ,??0QByteArray@kso_qt@@QAE@PBDH@Z,??0QByteArray@kso_qt@@QAE@PBDH@Z,?setRawHeader@QNetworkRequest@kso_qt@@QAEXABVQByteArray@2@0@Z,??1QByteArray@kso_qt@@QAE@XZ,??0QByteArray@kso_qt@@QAE@PBDH@Z,?setRawHeader@QNetworkRequest@kso_qt@@QAEXABVQByteArray@2@0@Z,??1QByteArray@kso_qt@@QAE@XZ,?toUtf8@QString@kso_qt@@QHAE?AVQByteArray@2@XZ,??0QByteArray@kso_qt@@QAE@PBDH@Z,?setRawHeader@QNetworkRequest@kso_qt@@QAEXABVQByteArray@2@0@Z,??1QByteArray@kso_qt@@QAE@XZ,??1QByteArray@kso_qt@@QAE@XZ,?sslConfiguration@QNetworkRequest@kso_qt@@QBE?AVQSslConfiguration@2@XZ,?setPeerVerifyMode@QSslConfiguration@kso_qt@@QAEXW4PeerVerifyMode@QSslSocket@2@@Z,?setSslConfiguration@QNetworkRequest@kso_qt@@QAEXABVQSslConfiguration@2@@Z,??1QSslConfiguration@kso_qt@@QAE@XZ,?post@QNetworkAccessManager@kso_qt@@QAEPAVQNetworkReply@2@ABVQNetworkRequest@2@ABVQByteArray@2@@Z,??0QEventLoop@kso_qt@@QAE@PAVQObject@1@@Z,??0QTimer@kso_qt@@QAE@PAVQObject@1@@Z,?quit@QEventLoop@kso_qt@@QAEXXZ,?finished@QNetworkReply@kso_qt@@QAEXXZ,?staticMetaObject@QNetworkReply@kso_qt@@2UQMetaObject@2@B,?connectImpl@QObject@kso_qt@@CA?AVConnection@QMetaObject@2@PBV12@PAPAX01PAVQSlotObjectBase@QtPrivate@2@W4ConnectionType@Qt@2@PBHPBU42@@Z,??1Connection@QMetaObject@kso_qt@@QAE@XZ,??1Connection@QMetaObject@kso_qt@@QAE@XZ,??1Connection@QMetaObject@kso_qt@@QAE@XZ,??1Connection@QMetaObject@kso_qt@@QAE@XZ,?timeout@QTimer@kso_qt@@QAEXUQPrivateSignal@12@@Z,?staticMetaObje 7_2_00C0F0D0
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00C0EB50 ?fromAscii_helper@QString@kso_qt@@CAPAU?$QTypedArrayData@G@2@PBDH@Z,??0QByteArray@kso_qt@@QAE@ABV01@@Z,??0QByteArray@kso_qt@@QAE@ABV01@@Z,??0QByteArray@kso_qt@@QAE@ABV01@@Z,??0QString@kso_qt@@QAE@ABVQByteArray@1@@Z,??0QByteArray@kso_qt@@QAE@ABV01@@Z,??0QByteArray@kso_qt@@QAE@ABV01@@Z,?shared_null@QListData@kso_qt@@2UData@12@B,?realloc@QListData@kso_qt@@QAEXH@Z,?shared_null@QListData@kso_qt@@2UData@12@B,?begin@QListData@kso_qt@@QBEPAPAXXZ,?end@QListData@kso_qt@@QBEPAPAXXZ,?toLower@QString@kso_qt@@QGBE?AV12@XZ,??1QString@kso_qt@@QAE@XZ,?cbegin@QByteArray@kso_qt@@QBEPBDXZ,?QStringList_join@QtPrivate@kso_qt@@YA?AVQString@2@PBVQStringList@2@PBVQChar@2@H@Z,?toUtf8@QString@kso_qt@@QHAE?AVQByteArray@2@XZ,??1QString@kso_qt@@QAE@XZ,??1QString@kso_qt@@QAE@XZ,?toUtf8@QString@kso_qt@@QHAE?AVQByteArray@2@XZ,?hash@QMessageAuthenticationCode@kso_qt@@SA?AVQByteArray@2@ABV32@0W4Algorithm@QCryptographicHash@2@@Z,?toHex@QByteArray@kso_qt@@QBE?AV12@XZ,?toBase64@QByteArray@kso_qt@@QBE?AV12@XZ,??1QByteArray@kso_qt@@QAE@XZ,??1QByteArray@kso_qt@@QAE@XZ,??1QByteArray@kso_qt@@QAE@XZ,??0QChar@kso_qt@@QAE@UQLatin1Char@1@@Z,?arg@QString@kso_qt@@QBE?AV12@ABV12@HVQChar@2@@Z,?arg@QString@kso_qt@@QBE?AV12@ABV12@HVQChar@2@@Z,?fromUtf8@QString@kso_qt@@SA?AV12@ABVQByteArray@2@@Z,??0QChar@kso_qt@@QAE@UQLatin1Char@1@@Z,?arg@QString@kso_qt@@QBE?AV12@ABV12@HVQChar@2@@Z,??1QString@kso_qt@@QAE@XZ,??1QString@kso_qt@@QAE@XZ,??1QString@kso_qt@@QAE@XZ,??1QByteArray@kso_qt@@QAE@XZ,??1QByteArray@kso_qt@@QAE@XZ, 7_2_00C0EB50
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00BA3B70 ??0QVariant@kso_qt@@QAE@ABV?$QMap@VQString@kso_qt@@VQVariant@2@@1@@Z,?fromVariant@QJsonDocument@kso_qt@@SA?AV12@ABVQVariant@2@@Z,??1QVariant@kso_qt@@QAE@XZ,?freeTree@QMapDataBase@kso_qt@@QAEXPAUQMapNodeBase@2@H@Z,?freeData@QMapDataBase@kso_qt@@SAXPAU12@@Z,?toJson@QJsonDocument@kso_qt@@QBE?AVQByteArray@2@W4JsonFormat@12@@Z,??0QString@kso_qt@@QAE@ABVQByteArray@1@@Z,??1QByteArray@kso_qt@@QAE@XZ,??0QUrl@kso_qt@@QAE@XZ,??0QNetworkRequest@kso_qt@@QAE@ABVQUrl@1@@Z,??1QUrl@kso_qt@@QAE@XZ,??1QUrl@kso_qt@@QAE@XZ,??0QUrl@kso_qt@@QAE@ABVQString@1@W4ParsingMode@01@@Z,?setUrl@QNetworkRequest@kso_qt@@QAEXABVQUrl@2@@Z,??1QUrl@kso_qt@@QAE@XZ,??0QByteArray@kso_qt@@QAE@PBDH@Z,??0QByteArray@kso_qt@@QAE@PBDH@Z,??0QByteArray@kso_qt@@QAE@PBDH@Z,?setRawHeader@QNetworkRequest@kso_qt@@QAEXABVQByteArray@2@0@Z,??1QByteArray@kso_qt@@QAE@XZ,??1QByteArray@kso_qt@@QAE@XZ,??0QString@kso_qt@@QAE@XZ,?toUtf8@QString@kso_qt@@QHAE?AVQByteArray@2@XZ,?aesEncrypt@KAesEncrypt@@SA_NABVQByteArray@kso_qt@@00AAVQString@3@@Z,??1QByteArray@kso_qt@@QAE@XZ,?toUtf8@QString@kso_qt@@QHAE?AVQByteArray@2@XZ,?post@QNetworkAccessManager@kso_qt@@QAEPAVQNetworkReply@2@ABVQNetworkRequest@2@ABVQByteArray@2@@Z,??1QByteArray@kso_qt@@QAE@XZ,?connect@QObject@kso_qt@@SA?AVConnection@QMetaObject@2@PBV12@PBD01W4ConnectionType@Qt@2@@Z,??1Connection@QMetaObject@kso_qt@@QAE@XZ,?start@QTime@kso_qt@@QAEXXZ,?shared_null@QHashData@kso_qt@@2U12@B,?fromAscii_helper@QString@kso_qt@@CAPAU?$QTypedArrayData@G@2@PBDH@Z,?fromAscii_helper@QString@kso_qt@@CAPAU?$QTypedArrayData@G@2@PBDH@Z,?fromAscii_helper@QString@kso_qt@@CAPAU?$QTypedArrayData@G@2@PBDH@Z,??1QString@kso_qt@@QAE@XZ,??1QString@kso_qt@@QAE@XZ,?free_helper@QHashData@kso_qt@@QAEXP6AXPAUNode@12@@Z@Z,??1QString@kso_qt@@QAE@XZ,??1QNetworkRequest@kso_qt@@QAE@XZ,??1QString@kso_qt@@QAE@XZ,??1QJsonArray@kso_qt@@QAE@XZ, 7_2_00BA3B70
Source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_a9ababca-9
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe EXE: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Jump to behavior

Compliance
barindex
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe EXE: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Jump to behavior
Uses 32bit PE files
Source: wps_wid.cid-735916525.1730301987.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kingsoft Office Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File created: C:\Users\user\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log Jump to behavior
Source: wps_wid.cid-735916525.1730301987.exe Static PE information: certificate valid
Source: wps_wid.cid-735916525.1730301987.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668023522.0000000014F80000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3767362095.00000000157B6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\rc_bug_mas_v12_2409\wpsenv\3rd\qt5\build_x86\qtbase\plugins\printsupport\windowsprintersupport.pdb source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668023522.0000000014F80000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\rc_bug_mas_v12_2409\wpsenv\3rd\qt5\build_x86\qtbase\plugins\printsupport\windowsprintersupport.pdb## source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668023522.0000000014F80000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\rc_bug_mas_v12_2409\wpsenv\3rd\qt5\build_x86\qtbase\plugins\platforms\qwindows.pdb source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014251000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: H:\pub_bh8f\rc_bug_mas_v12_2409\Build\Release\WPSOffice\office6\addons\yunkitapi\yunkitapi.pdb source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\rc_bug_mas_v12_2409\wpsenv\3rd\qt5\build_x86\qtbase\plugins\imageformats\qsvg.pdb source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000002.4126160918.000000006B153000.00000002.00000001.01000000.00000017.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.000000001328C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\rc_bug_mas_v12_2409\wpsenv\3rd\qt5\build_x86\qtbase\plugins\iconusers\qsvgicon.pdb source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.000000001328C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ?COMCTL32.dllWINHTTP.dllcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -FS -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASMLoad file into cachecrypto\x509\by_file.cunspecified certificate verification errorunable to get issuer certificateunable to get certificate CRLunable to decrypt certificate's signatureunable to decrypt CRL's signatureunable to decode issuer public keycertificate signature failureCRL signature failurecertificate is not yet validcertificate has expiredCRL is not yet validCRL has expiredformat error in certificate's notBefore fieldformat error in certificate's notAfter fieldformat error in CRL's lastUpdate fieldformat error in CRL's nextUpdate fieldout of memoryself signed certificateself signed certificate in certificate chainunable to get local issuer certificateunable to verify the first certificatecertificate chain too longcertificate revokedinvalid CA certificatepath length constraint exceededunsupported certificate purposecertificate not trustedcertificate rejectedsubject issuer mismatchauthority and subject key identifier mismatchauthority and issuer serial number mismatchkey usage does not include certificate signingunable to get CRL issuer certificateunhandled critical extensionkey usage does not include CRL signingunhandled critical CRL extensioninvalid non-CA certificate (has CA markings)proxy path length constraint exceededkey usage does not include digital signatureproxy certificates not allowed, please set the appropriate flaginvalid or inconsistent certificate extensioninvalid or inconsistent certificate policy extensionno explicit policyDifferent CRL scopeUnsupported extension featureRFC 3779 resource not subset of parent's resourcespermitted subtree violationexcluded subtree violationname constraints minimum and maximum not supportedapplication verification failureunsupported name constraint typeunsupported or invalid name constraint syntaxunsupported or invalid name syntaxCRL path validation errorPath LoopSuite B: certificate version invalidSuite B: invalid public key algorithmSuite B: invalid ECC curveSuite B: invalid signature algorithmSuite B: curve not allowed for this LOSSuite B: cannot sign P-384 with P-256Hostname mismatchEmail address mismatchIP address mismatchNo matching DANE TLSA recordsEE certificate key too weakCA certificate key too weakCA signature digest algorithm too weakInvalid certificate verification contextIssuer certificate lookup errorCertificate Transparency required, but no valid SCTs foundproxy subject name violationOCSP verification neededOCSP verification failedOCSP unknown certCertificate public key has explicit ECC parametersunknown certificate verification errorcrypto\asn1\x_info.ccrypto\pem\pem_info.cRSA P
Source: Binary string: ucrtbase.pdb source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\rc_v12_i18n_202409_branch\Build\Release\WPSOffice\office6\addons\konlinesetup_xa\konlinesetup_xa.pdb source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp
Source: Binary string: D:\rc_bug_mas_v12_2409\wpsenv\3rd\qt5\build_x86\qtbase\plugins\styles\qwindowsvistastyle.pdb%% source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: H:\pub_bh8f\rc_bug_mas_v12_2409\Build\Release\WPSOffice\office6\wpsuil.pdb source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.0000000016B1B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\rc_bug_mas_v12_2409\wpsenv\3rd\qt5\build_x86\qtbase\plugins\platforms\qdirect2d.pdb source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000013241000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: H:\pub_bh8f\rc_bug_mas_v12_2409\Build\Release\WPSOffice\office6\wpsupdate_res.pdb source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.0000000016B1B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ucrtbase.pdbUGP source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\vccorlib140.i386.pdbGCTL source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668023522.0000000014F80000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\rc_bug_mas_v12_2409\wpsenv\3rd\qt5\build_x86\qtbase\plugins\styles\qwindowsvistastyle.pdb source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -FS -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASM source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp
Source: Binary string: H:\pub_bh8f\rc_bug_mas_v12_2409\Build\Release\WPSOffice\office6\wpsofficeicon.pdb source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.000000001591E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\vccorlib140.i386.pdb source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668023522.0000000014F80000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A0C1A0 PathAddBackslashW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,SHGetSpecialFolderPathW, 5_2_00A0C1A0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A1C140 PathAddBackslashW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose, 5_2_00A1C140
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009D42F0 FindFirstFileW,PathFileExistsW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,GetLastError,FindClose,CopyFileW,lstrcmpW,FindNextFileW, 5_2_009D42F0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A34270 SHGetSpecialFolderPathW,CoInitialize,CoCreateInstance,FindFirstFileW,FindNextFileW,FindNextFileW,StrStrIW,StrStrIW,FindNextFileW,FindClose,CoUninitialize, 5_2_00A34270
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009CB6E0 FindFirstFileW,FindNextFileW,FindNextFileW,FindClose, 5_2_009CB6E0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009EFBA0 RegCloseKey,FindFirstFileW,MoveFileExW,MoveFileExW,FindNextFileW,FindClose,MoveFileExW,Concurrency::cancel_current_task,MoveFileExW,MoveFileExW, 5_2_009EFBA0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A37D60 RegOpenKeyExW,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegCloseKey,SHGetSpecialFolderPathW,SHGetSpecialFolderPathW,SHGetSpecialFolderPathW,FindFirstFileW,FindNextFileW,FindClose,GetLastError, 5_2_00A37D60
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009EC0D0 FindFirstFileW,FindNextFileW,FindClose,CopyFileW,RegOpenKeyExW,RegSetValueExW,RegCloseKey, 5_2_009EC0D0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00990160 FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,FindClose,GetLastError,GetLastError,RemoveDirectoryW,MoveFileExW,GetLastError,FindClose,GetSystemDirectoryW,SetFileAttributesW,DeleteFileW,MoveFileExW,SetFileAttributesW,DeleteFileW,GetTickCount,MoveFileExW,MoveFileExW,lstrcmpW,FindNextFileW,__Init_thread_footer, 5_2_00990160
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A004A0 PathAddBackslashW,FindFirstFileW,FindNextFileW,FindClose, 5_2_00A004A0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A5E890 SHGetSpecialFolderPathW,SHGetSpecialFolderPathW,CoInitialize,CoCreateInstance,FindFirstFileW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,DeleteFileW,FindNextFileW,FindClose,CoUninitialize, 5_2_00A5E890
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009D5150 FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose, 5_2_009D5150
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A3F6B0 PathFileExistsW,GetFileAttributesW,FindFirstFileW,FindNextFileW,FindClose,WritePrivateProfileStringW,WritePrivateProfileStringW,WritePrivateProfileStringW,WritePrivateProfileStringW, 5_2_00A3F6B0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_0098B710 FindFirstFileW,FindNextFileW,FindClose, 5_2_0098B710
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009C98F0 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose, 5_2_009C98F0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A3D8D0 FindFirstFileW,GetLastError,PathFileExistsW,CopyFileW,FindNextFileW,FindClose,PathFileExistsW,CopyFileW,GetLastError,GetLastError, 5_2_00A3D8D0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A39BC0 PathFileExistsW,FindFirstFileW,lstrcmpW,lstrcmpW,CopyFileW,FindNextFileW,FindClose, 5_2_00A39BC0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A33EE0 FindNextFileW,StrStrIW,StrStrIW,CopyFileW,GetSystemDirectoryW,SHGetSpecialFolderPathW,CoInitialize,CoCreateInstance,FindFirstFileW,FindNextFileW,FindNextFileW,StrStrIW,StrStrIW,FindNextFileW,FindClose,CoUninitialize, 5_2_00A33EE0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009C9F70 FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,FindNextFileW,DeleteFileW,FindClose, 5_2_009C9F70
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A924B0 memset,memset,GetVersionExW,wcscat_s,memset,?fromUtf16@QString@kso_qt@@SA?AV12@PBGH@Z,??1QString@kso_qt@@QAE@XZ,?utf16@QString@kso_qt@@QBEPBGXZ,FindFirstFileW,?fromUtf16@QString@kso_qt@@SA?AV12@PBGH@Z,?fromUtf16@QString@kso_qt@@SA?AV12@PBGH@Z,??0QByteArray@kso_qt@@QAE@ABV01@@Z,?append@QString@kso_qt@@QAEAAV12@ABV12@@Z,??1QString@kso_qt@@QAE@XZ,??1QString@kso_qt@@QAE@XZ,?utf16@QString@kso_qt@@QBEPBGXZ,??1QString@kso_qt@@QAE@XZ,FindNextFileW,FindClose,??1QString@kso_qt@@QAE@XZ, 7_2_00A924B0
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A89420 memset,wcsncpy,wcsncat,memset,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose, 7_2_00A89420
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A9D6A0 ?shared_null@QListData@kso_qt@@2UData@12@B,memset,??0QByteArray@kso_qt@@QAE@ABV01@@Z,?fromUtf8@QString@kso_qt@@SA?AV12@PBDH@Z,?append@QString@kso_qt@@QAEAAV12@ABV12@@Z,??1QString@kso_qt@@QAE@XZ,?toNativeSeparators@QDir@kso_qt@@SA?AVQString@2@ABV32@@Z,??1QString@kso_qt@@QAE@XZ,?utf16@QString@kso_qt@@QBEPBGXZ,FindFirstFileW,?fromUtf16@QString@kso_qt@@SA?AV12@PBGH@Z,??0QByteArray@kso_qt@@QAE@ABV01@@Z,?fromUtf8@QString@kso_qt@@SA?AV12@PBDH@Z,?append@QString@kso_qt@@QAEAAV12@ABV12@@Z,??1QString@kso_qt@@QAE@XZ,??0QByteArray@kso_qt@@QAE@ABV01@@Z,?append@QString@kso_qt@@QAEAAV12@ABV12@@Z,??1QString@kso_qt@@QAE@XZ,??1QString@kso_qt@@QAE@XZ,??1QString@kso_qt@@QAE@XZ,FindNextFileW,?shared_null@QListData@kso_qt@@2UData@12@B,?shared_null@QListData@kso_qt@@2UData@12@B,FindClose,??1QString@kso_qt@@QAE@XZ, 7_2_00A9D6A0
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A9A95C ??0QString@kso_qt@@QAE@PBD@Z,??1QString@kso_qt@@QAE@XZ,memmove,memset,wcscpy_s,_invalid_parameter_noinfo_noreturn,memset,memset,memset,GetVersionExW,memset,FindFirstFileW,??0QString@kso_qt@@QAE@XZ,?isOverseasVersion@product@krt@@YA_NXZ,??4QString@kso_qt@@QAEAAV01@PBD@Z,??0QByteArray@kso_qt@@QAE@ABV01@@Z,??0QByteArray@kso_qt@@QAE@ABV01@@Z,??1QString@kso_qt@@QAE@XZ,DeleteFileW,FindNextFileW,??1QString@kso_qt@@QAE@XZ,FindClose,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 7_2_00A9A95C
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A9BA70 FindClose,Sleep,memset,FindFirstFileW,FindClose,Sleep, 7_2_00A9BA70
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A92A40 ?translate@QCoreApplication@kso_qt@@SA?AVQString@2@PBD00H@Z,?shared_null@QListData@kso_qt@@2UData@12@B,?isEmpty@QListData@kso_qt@@QBE_NXZ,?toNativeSeparators@QDir@kso_qt@@SA?AVQString@2@ABV32@@Z,??0QChar@kso_qt@@QAE@H@Z,?endsWith@QString@kso_qt@@QBE_NVQChar@2@W4CaseSensitivity@Qt@2@@Z,??YQString@kso_qt@@QAEAAV01@PBD@Z,?utf16@QString@kso_qt@@QBEPBGXZ,FindFirstFileW,FindNextFileW,?translate@QCoreApplication@kso_qt@@SA?AVQString@2@PBD00H@Z,?fromWCharArray@QString@kso_qt@@SA?AV12@PB_WH@Z,?QStringList_contains@QtPrivate@kso_qt@@YA_NPBVQStringList@2@ABVQString@2@W4CaseSensitivity@Qt@2@@Z,??1QString@kso_qt@@QAE@XZ,FindNextFileW,FindClose,??1QString@kso_qt@@QAE@XZ, 7_2_00A92A40
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00B07DB0 FindFirstFileW,_wcsnicmp,FindNextFileW,FindClose,_invalid_parameter_noinfo_noreturn, 7_2_00B07DB0
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A97E40 memset,FindFirstFileW,DeleteFileW,FindNextFileW,memmove,FindClose,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,?isSupportRibbonScale@product@krt@@YA_NXZ,?fromAscii_helper@QString@kso_qt@@CAPAU?$QTypedArrayData@G@2@PBDH@Z,??1QString@kso_qt@@QAE@XZ,?shared_null@QHashData@kso_qt@@2U12@B,?translate@QCoreApplication@kso_qt@@SA?AVQString@2@PBD00H@Z,??0QChar@kso_qt@@QAE@UQLatin1Char@1@@Z,?arg@QString@kso_qt@@QBE?AV12@ABV12@HVQChar@2@@Z,?utf16@QString@kso_qt@@QBEPBGXZ,??1QString@kso_qt@@QAE@XZ,??1QString@kso_qt@@QAE@XZ,??1QString@kso_qt@@QAE@XZ,?shared_null@QHashData@kso_qt@@2U12@B, 7_2_00A97E40
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A8DE50 memset,FindFirstFileW,memset,memset,_wcsicmp,memset,memset,_wcsnicmp,FindNextFileW,FindClose, 7_2_00A8DE50
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009F75A0 GetTempPathW,PathAddBackslashW,GetLogicalDriveStringsW,GetDriveTypeW,GetDriveTypeW,GetDriveTypeW,GetDriveTypeW,PathAddBackslashW,GetTickCount, 5_2_009F75A0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File opened: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\addons\kapplist\mui\default\html\kappcustomwidget\static\ Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File opened: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\addons\kapplist\mui\default\ Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File opened: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\addons\kapplist\mui\default\html\ Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File opened: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\addons\kapplist\mui\default\html\kappcustomwidget\ Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File opened: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\addons\kapplist\mui\ Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File opened: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\addons\kapplist\mui\default\html\kappcustomwidget\static\css\ Jump to behavior
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://120.131.9.220
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://120.131.9.220$
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.000000001591E000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3773294724.000000001558E000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668023522.0000000014F80000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.0000000016B1B000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3766343833.0000000001543000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.000000001328C000.00000004.00000020.00020000.00000000.sdmp, ksomisc.exe, 00000007.00000003.3795276373.00000000009E3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.000000001591E000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668023522.0000000014F80000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.0000000016B1B000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3772969203.0000000015005000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3766343833.0000000001543000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.000000001328C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.000000001591E000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668023522.0000000014F80000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.0000000016B1B000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3772969203.0000000015005000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3766343833.0000000001543000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.000000001328C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.000000001591E000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668023522.0000000014F80000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.0000000016B1B000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3766343833.0000000001543000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.000000001328C000.00000004.00000020.00020000.00000000.sdmp, ksomisc.exe, 00000007.00000003.3795276373.00000000009E3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.000000001591E000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3773294724.000000001558E000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668023522.0000000014F80000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.0000000016B1B000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3766343833.0000000001543000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.000000001328C000.00000004.00000020.00020000.00000000.sdmp, ksomisc.exe, 00000007.00000003.3795276373.00000000009E3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.000000001591E000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668023522.0000000014F80000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.0000000016B1B000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3772969203.0000000015005000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3766343833.0000000001543000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.000000001328C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.000000001591E000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668023522.0000000014F80000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.0000000016B1B000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3772969203.0000000015005000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3766343833.0000000001543000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.000000001328C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.000000001328C000.00000004.00000020.00020000.00000000.sdmp, ksomisc.exe, 00000007.00000003.3795276373.00000000009E3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.000000001591E000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668023522.0000000014F80000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.0000000016B1B000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3772969203.0000000015005000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3766343833.0000000001543000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.000000001328C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: http://dw-collect-debug.ksord.com)datesign_eventslocal
Source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: http://dw-online.ksosoft.com/api/dynamicParam/v3/app/2.9.0dcsdk_eventv3.dbdcsdk_dpv3.data10C
Source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: http://en.ksupdate.com/errorreport/uphttps://en.ksupdate.com/errorreport/up-crashdmp
Source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: http://event.4wps.nethttps://event.wps.comcountryCodeFinishTaghttps://www.google-analytics.com/mp/co
Source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: http://ic.wps.cn/wpsv6internet/infos.ads?v=D1S1E1&d=kdcsdk_infoc/wps/client/appcountrycodelastupdate
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3772969203.0000000015005000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.di
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.000000001591E000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668023522.0000000014F80000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.0000000016B1B000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3772969203.0000000015005000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3766343833.0000000001543000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.000000001328C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.000000001591E000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668023522.0000000014F80000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.0000000016B1B000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3766343833.0000000001543000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.000000001328C000.00000004.00000020.00020000.00000000.sdmp, ksomisc.exe, 00000007.00000003.3795276373.00000000009E3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.000000001591E000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3773294724.000000001558E000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668023522.0000000014F80000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.0000000016B1B000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3766343833.0000000001543000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.000000001328C000.00000004.00000020.00020000.00000000.sdmp, ksomisc.exe, 00000007.00000003.3795276373.00000000009E3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.000000001591E000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668023522.0000000014F80000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.0000000016B1B000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3772969203.0000000015005000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3766343833.0000000001543000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.000000001328C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0X
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3790893433.0000000001550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://up.wps.kingsoft.com/wpsupdate2009
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000002.4116265647.00000000036B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wu005.kuaikuai.cn/wpsupdate
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000002.4116265647.00000000036B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wu005.kuaikuai.cn/wpsupdateoad
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.000000001591E000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668023522.0000000014F80000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.0000000016B1B000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3772969203.0000000015005000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3766343833.0000000001543000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.000000001328C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com/CPS0
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe String found in binary or memory: https://account.wps.cn/healthy
Source: ksomisc.exe String found in binary or memory: https://api.wps.com/pc/special/api/user/remove-data
Source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crxSoftware
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://conf.psvr.wps.cn
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000002.4121012144.0000000014EE6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:51:0
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000002.4116265647.00000000036B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:51:0
Source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe String found in binary or memory: https://curl.se/docs/alt-svc.html#
Source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe String found in binary or memory: https://curl.se/docs/hsts.html
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe String found in binary or memory: https://curl.se/docs/hsts.html#
Source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe String found in binary or memory: https://curl.se/docs/http-cookies.html#
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://deviceapi.wps.cn
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://deviceapi.wps.cnclient_type=%1
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000002.4116265647.00000000036B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://en.ksupdate.com/errorreport/up
Source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: https://event.wps.comdynamicParamFinishTagt1_app_start_p_st_sv_app_gid_did_hdid3_aid_ut_rid_av_ch_db
Source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: https://http_.index.inicert_detailis_cached_fileverify_cert_failedKOnlineSetupImpl::__generateCacheF
Source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: https://params.wps.com/api/map/online_params/webparam_mig/onlineParamByFunc?funcName=
Source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: https://params.wps.com/api/map/online_params/webparam_mig/onlineParamByFunc?funcName=&version=&chann
Source: ksomisc.exe String found in binary or memory: https://phapi.wps.cn/api/v2/handle/setting
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000002.4121012144.0000000014EE6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://qing.wps.cn
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000002.4121012144.0000000014EE6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://qing.wps.cne_id_type
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://qr.wps.cn
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://qr.wps.cn/api/v3/channel
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://s%1.vip.wpscdn.cn
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://s%1.vip.wpscdn.cnTTransportException:
Source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: https://s.wps.comshortLinkUrlshortlink/short-link/queryshort_link_code=geterr_signAuthorizationdevic
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sharefolder.wps.cn
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sharefolder.wps.cn/api/v1/space/notify/ownerspace_owner_id
Source: ksomisc.exe String found in binary or memory: https://switch.pcfg.cache.wpscdn.cn/wps_cdn_config/hashcalcswitch
Source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: https://wdl1.pcfg.cache.wpscdn.com/wpsdl/wpsoffice/onlinesetup/distsrc/.execrashdmppidtidexp1IS_WPSO
Source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: https://wdl1.pcfg.cache.wpscdn.com/wpsdl/wpsoffice/onlinesetup/package/SOFTWARE
Source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: https://website-prod.cache.wpscdn.com/pkgs/win/setup_XA_mui_Free.exeSOFTWARE
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://wpsplus.com
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://wpsplus.com/3rd/drive/api/v3/mine/team/link/%1with_corp_name=%1
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3772969203.0000000014FDE000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3766195637.0000000014FE6000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000002.4116265647.00000000036DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google-analytics.com/
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3772969203.0000000014FDE000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3766195637.0000000014FE6000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000002.4121012144.0000000014FE7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google-analytics.com/-(Gn
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000002.4116265647.00000000036DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google-analytics.com/Th
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000002.4116265647.00000000036DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google-analytics.com/mp/collect?firebase_app_id=1:463244832315:android:fe82dee1e0f73e232
Source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: https://www.google-analytics.com/mp/collecthttps://http:///Iphlpapi.dllGetNetworkParamsinternal_proc
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000002.4121012144.0000000014EE6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google-analytics.com:443/mp/collect?firebase_app_id=1:463244832315:android:fe82dee1e0f73
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000002.4121012144.0000000014EE6000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000002.4122341949.0000000015581000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.wps.com
Source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: https://www.wps.com/eula
Source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: https://www.wps.com/eulaprivacy_policylicense_agreementlabelTitleMsg_Wps_OnlineSetup_TaskMsgMsg_Wps_
Source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: https://www.wps.com/privacy-policy
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000002.4116265647.00000000036B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.wps.com8
Drops certificate files (DER)
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File created: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\tmp\PDF\Security\Trustworthy\watl.bin Jump to dropped file

System Summary
barindex
Drops large PE files
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe File dump: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe.0.dr 252569368 Jump to dropped file
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_64E64110 GetFileInformationByHandle,GetLastError,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtClose, 7_2_64E64110
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_64E643B0 GetFileInformationByHandle,GetLastError,GetCurrentProcess,NtAllocateVirtualMemory,GetCurrentProcess,NtFreeVirtualMemory,GetCurrentProcess,NtUnmapViewOfSection,NtClose,GetCurrentProcess,GetCurrentProcess,NtAllocateVirtualMemory,NtCreateSection,GetCurrentProcess,NtFreeVirtualMemory,GetCurrentProcess,NtMapViewOfSection,NtClose,GetCurrentProcess,GetCurrentProcess,NtFreeVirtualMemory, 7_2_64E643B0
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_64E64330 NtClose,GetCurrentProcess,NtUnmapViewOfSection,GetOverlappedResult,GetLastError, 7_2_64E64330
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_64E64E10 InitializeCriticalSection,NtQuerySystemInformation,GetSystemTimeAsFileTime,Sleep,GetSystemTimeAsFileTime, 7_2_64E64E10
Contains functionality to communicate with device drivers
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_64E0B3F0: memset,GetSystemDirectoryW,GetLastError,__acrt_iob_func,_fprintf,CreateFileW,GetLastError,__acrt_iob_func,_fprintf,DeviceIoControl,GetLastError,__acrt_iob_func,_fprintf,CloseHandle,CloseHandle,CreateFileA,DeviceIoControl,DeviceIoControl,memset,DeviceIoControl,strncpy_s,strncpy_s,strncpy_s,memset,CloseHandle,CloseHandle, 7_2_64E0B3F0
Detected potential crypto function
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A14280 5_2_00A14280
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A483A0 5_2_00A483A0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009FA6E0 5_2_009FA6E0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009CA920 5_2_009CA920
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00948C50 5_2_00948C50
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009DEFB0 5_2_009DEFB0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A5DD50 5_2_00A5DD50
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A2BF90 5_2_00A2BF90
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009F2080 5_2_009F2080
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009EC0D0 5_2_009EC0D0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009BA110 5_2_009BA110
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00C922AD 5_2_00C922AD
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A46230 5_2_00A46230
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00AB2200 5_2_00AB2200
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00C3A3A0 5_2_00C3A3A0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A4A350 5_2_00A4A350
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00C924DF 5_2_00C924DF
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00C064F0 5_2_00C064F0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00C86490 5_2_00C86490
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A60690 5_2_00A60690
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00C2C680 5_2_00C2C680
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00C14600 5_2_00C14600
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00C40840 5_2_00C40840
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00BEA930 5_2_00BEA930
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00CBA918 5_2_00CBA918
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A38AB0 5_2_00A38AB0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00ABCA40 5_2_00ABCA40
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00CBAA38 5_2_00CBAA38
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A3CBB0 5_2_00A3CBB0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00BECBD0 5_2_00BECBD0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00C40C40 5_2_00C40C40
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A5F080 5_2_00A5F080
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009810D0 5_2_009810D0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00BF10D0 5_2_00BF10D0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009BF000 5_2_009BF000
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00CB91F2 5_2_00CB91F2
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00BEB140 5_2_00BEB140
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009BB230 5_2_009BB230
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00C893C6 5_2_00C893C6
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00985490 5_2_00985490
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A914D0 5_2_00A914D0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009D5450 5_2_009D5450
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A2B580 5_2_00A2B580
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_0099B5B0 5_2_0099B5B0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009F95A0 5_2_009F95A0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A01530 5_2_00A01530
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00ABD660 5_2_00ABD660
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00987780 5_2_00987780
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00983730 5_2_00983730
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A63770 5_2_00A63770
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00C9D720 5_2_00C9D720
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_0099D890 5_2_0099D890
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A978D0 5_2_00A978D0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A63820 5_2_00A63820
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009BB850 5_2_009BB850
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00BE7840 5_2_00BE7840
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_0099B9C0 5_2_0099B9C0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00C2D910 5_2_00C2D910
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A09AE0 5_2_00A09AE0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009D7A20 5_2_009D7A20
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009BFB00 5_2_009BFB00
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00C2DB70 5_2_00C2DB70
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A61B60 5_2_00A61B60
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A89CB0 5_2_00A89CB0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_0099DC60 5_2_0099DC60
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009A3D10 5_2_009A3D10
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00CABEC0 5_2_00CABEC0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009D5FB0 5_2_009D5FB0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009ADF00 5_2_009ADF00
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00C2BF60 5_2_00C2BF60
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_6B1725C0 5_2_6B1725C0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_6B16D34E 5_2_6B16D34E
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_6B172200 5_2_6B172200
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_6B16E2BC 5_2_6B16E2BC
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_6B171970 5_2_6B171970
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_6B161810 5_2_6B161810
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_6B169610 5_2_6B169610
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_6B173570 5_2_6B173570
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_6B1ECB30 5_2_6B1ECB30
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_6B1D3B90 5_2_6B1D3B90
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_6B1A4B80 5_2_6B1A4B80
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_6B1BABF0 5_2_6B1BABF0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_6B1A93E0 5_2_6B1A93E0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_6B1CC220 5_2_6B1CC220
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_6B1B3260 5_2_6B1B3260
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_6B1EC2B0 5_2_6B1EC2B0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_6B19D940 5_2_6B19D940
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_6B1D6140 5_2_6B1D6140
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_6B1CC9A0 5_2_6B1CC9A0
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00BD5130 7_2_00BD5130
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00BD00F0 7_2_00BD00F0
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A88000 7_2_00A88000
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A8D190 7_2_00A8D190
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00B952E0 7_2_00B952E0
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00ABA580 7_2_00ABA580
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A9C500 7_2_00A9C500
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00BF9630 7_2_00BF9630
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00BE4610 7_2_00BE4610
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00BB3710 7_2_00BB3710
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00B75770 7_2_00B75770
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00BB6850 7_2_00BB6850
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00BE3A50 7_2_00BE3A50
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A9EB40 7_2_00A9EB40
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00ADBCB0 7_2_00ADBCB0
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00AC5CD0 7_2_00AC5CD0
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00BE4D30 7_2_00BE4D30
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00ADAEA0 7_2_00ADAEA0
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00B8CEC0 7_2_00B8CEC0
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00BE5E70 7_2_00BE5E70
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A97E40 7_2_00A97E40
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_64E12790 7_2_64E12790
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_64E0FC10 7_2_64E0FC10
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_64E1EFB0 7_2_64E1EFB0
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_64E138B0 7_2_64E138B0
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_64E0F9B0 7_2_64E0F9B0
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_64E654F0 7_2_64E654F0
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_64E55560 7_2_64E55560
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_64E643B0 7_2_64E643B0
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_64E50310 7_2_64E50310
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_64E64E10 7_2_64E64E10
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_64E424A0 7_2_64E424A0
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_64E414B0 7_2_64E414B0
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_64E5C460 7_2_64E5C460
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_64E5F590 7_2_64E5F590
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_64E44560 7_2_64E44560
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_64E4453C 7_2_64E4453C
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: String function: 00B41EB0 appears 47 times
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: String function: 00B0E750 appears 69 times
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: String function: 00B10190 appears 83 times
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: String function: 00A8BF80 appears 221 times
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: String function: 00BB95A0 appears 71 times
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: String function: 64E451B0 appears 32 times
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: String function: 00B96C30 appears 39 times
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: String function: 00962170 appears 31 times
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: String function: 00C8FF12 appears 31 times
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: String function: 00984BF0 appears 41 times
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: String function: 0099C4B0 appears 205 times
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: String function: 00977830 appears 41 times
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: String function: 0095FAB0 appears 135 times
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: String function: 0099C180 appears 38 times
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: String function: 0095F420 appears 70 times
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: String function: 0097FBF0 appears 70 times
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: String function: 009D0EE0 appears 42 times
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: String function: 0095F7E0 appears 151 times
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: String function: 00C80430 appears 50 times
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: String function: 0095ECB0 appears 48 times
PE file contains executable resources (Code or Archives)
Source: wps_wid.cid-735916525.1730301987.exe Static PE information: Resource name: ZIPRES type: Zip archive data, at least v1.0 to extract, compression method=store
Source: wps_wid.cid-735916525.1730301987.exe Static PE information: Resource name: ZIPRES type: Zip archive data, at least v1.0 to extract, compression method=store
PE file does not import any functions
Source: api-ms-win-core-console-l1-2-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238651595.0000000000B37000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamekonlinesetup_xa.exe6 vs wps_wid.cid-735916525.1730301987.exe
Uses 32bit PE files
Source: wps_wid.cid-735916525.1730301987.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.000000001328C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: com.slnishinomiya.hyogo.jpkustanai.rucom.snpassenger-association.aerocom.sotsushima.nagasaki.jpcom.stuy.comx.seisa-geek.comcom.sv
Source: classification engine Classification label: sus26.evad.winEXE@6/1037@0/3
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_64E50310 memset,GetFileInformationByHandle,GetLastError,ReadFile,GetLastError,SleepEx,ReadFile,GetLastError,FormatMessageA,ReadFile,GetLastError,SleepEx,ReadFile,GetLastError,FormatMessageA,FormatMessageA,FormatMessageA,FormatMessageA, 7_2_64E50310
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009994B0 RegOpenKeyExW,RegOpenKeyExW,RegOpenKeyExW,RegEnumKeyExW,RegCloseKey,RegOpenKeyExW,RegOpenKeyExW,RegQueryValueExW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,ExpandEnvironmentStringsW,GetFileAttributesW,RegUnLoadKeyW,RegUnLoadKeyW,RegLoadKeyW,RegOpenKeyExW,RegCloseKey,RegUnLoadKeyW,RegCloseKey,RegEnumKeyExW,RegCloseKey, 5_2_009994B0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009CB450 GetCurrentProcessId,ProcessIdToSessionId,ProcessIdToSessionId,OpenProcess,OpenProcessToken,CloseHandle,CloseHandle,GetLastError,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges, 5_2_009CB450
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009F1960 GetDiskFreeSpaceExW,GetModuleFileNameW,CreateFileW,GetFileSize,CloseHandle, 5_2_009F1960
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009CC5B0 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle, 5_2_009CC5B0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A34270 SHGetSpecialFolderPathW,CoInitialize,CoCreateInstance,FindFirstFileW,FindNextFileW,FindNextFileW,StrStrIW,StrStrIW,FindNextFileW,FindClose,CoUninitialize, 5_2_00A34270
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A062F0 RegCreateKeyExW,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,FindResourceW,LoadResource,LockResource,SizeofResource,GetTempPathW,GetTickCount,GetTempFileNameW,CreateFileW,CloseHandle,WaitForSingleObject,GetLastError,Concurrency::cancel_current_task, 5_2_00A062F0
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe File created: C:\Users\user\AppData\Roaming\kingsoft Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Mutant created: NULL
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Mutant created: \Sessions\1\BaseNamedObjects\{7B585BD5-8E73-4058-B7DF-F46EE9AB43BC}KDCSDK_SEND_DEVICE_INFO_MUTEX
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Mutant created: \Sessions\1\BaseNamedObjects\6128installer
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Mutant created: \Sessions\1\BaseNamedObjects\2548installer
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Mutant created: \Sessions\1\BaseNamedObjects\_KHDID3MGR_3E67DFEF-DF4E-4CC6-9413-5F71C7C96C04
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Mutant created: \Sessions\1\BaseNamedObjects\{5BE9D8BC-AF60-4b40-A4D0-21F65B4F8788}
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\wpssetup_C42D7A0A-2868-45FF-92EE-9B7AE7124588
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Mutant created: \Sessions\1\BaseNamedObjects\KdcDBGlobalMutexC:_Users_user_AppData_Roaming_kingsoft_wps_dcsdk_cache.db
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Mutant created: \Sessions\1\BaseNamedObjects\_KHDIDMGR_3E67DFEF-DF4E-4CC6-9413-5F71C7C96C04
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Mutant created: \Sessions\1\BaseNamedObjects\KOnlinesetupMutexNew_EF472A88-E1D0-44DF-B44E-FF5186E43ADC
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Mutant created: \Sessions\1\BaseNamedObjects\{7B585BD5-8E73-4058-B7DF-F46EE9AB43BC}KDCSDK_RESTORE_LOCK_MUTEX01a86845241d76e805eba1a3636fc13f
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Mutant created: \Sessions\1\BaseNamedObjects\__#_KCCSDK_WPS_PROCESS_EXIST_KEY_#__
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Mutant created: \Sessions\1\BaseNamedObjects\_#_UPD_LogFile_Z_MutxName_#_
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe File created: C:\Users\user\AppData\Local\Temp\konlinesetup Jump to behavior
Source: wps_wid.cid-735916525.1730301987.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File read: C:\Users\user\AppData\Local\tempinstall.ini Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe String found in binary or memory: Setup/InstallPathUnswitchable
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe String found in binary or memory: Product/LauncherName
Source: ksomisc.exe String found in binary or memory: :/ksomisc/addinmgr.ico
Source: ksomisc.exe String found in binary or memory: /comaddin/addinswl
Source: ksomisc.exe String found in binary or memory: /comaddin/addinsbl
Source: ksomisc.exe String found in binary or memory: :/ksomisc/loading.gif
Source: ksomisc.exe String found in binary or memory: invalid page-address %p, offset %zi
Source: unknown Process created: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe "C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe"
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Process created: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -curlangofinstalledproduct=en_GB -D="C:\Users\user\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\user\AppData\Roaming"
Source: unknown Process created: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe "C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -curlangofinstalledproduct="en_GB" -D="C:\Users\user\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\user\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\user\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\user\AppData\Roaming" -msgwndname=wpssetup_message_48854E -curinstalltemppath=C:\Users\user\AppData\Local\Temp\wps\~4872e0\
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process created: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe "C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe" -setlng en_GB
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Process created: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -curlangofinstalledproduct=en_GB -D="C:\Users\user\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\user\AppData\Roaming" Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process created: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe "C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe" -setlng en_GB Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: msi.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: qt5winextraskso.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: qt5svgkso.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: qt5widgetskso.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: qt5guikso.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: qt5corekso.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: qt5guikso.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: qt5corekso.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: qt5guikso.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: qt5corekso.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: qt5corekso.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: msi.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: qt5networkkso.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: qt5winextraskso.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: fltlib.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: qt5widgetskso.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: qt5guikso.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: qt5corekso.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: kshell.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: ksolite.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: qt5guikso.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: qt5corekso.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: qt5corekso.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: qt5guikso.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: qt5corekso.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: qt5corekso.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: qt5svgkso.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: qt5xmlkso.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: libcurl.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: qt5corekso.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: kso.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: ksouil.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: kbase.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: kprometheus.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: kdownload.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: krt.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: qt5corekso.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: krt.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: kbase.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: libssl-kso-1_1.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: libcrypto-kso-1_1.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: kso.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: qt5svgkso.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: kbase.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: krt.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: krt.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: msvcp140_codecvt_ids.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: libcrypto-kso-1_1.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: qt5svgkso.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: krt.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: kimalloc.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File written: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\utility\install.ini Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kingsoft Office Jump to behavior
Source: wps_wid.cid-735916525.1730301987.exe Static PE information: certificate valid
Source: wps_wid.cid-735916525.1730301987.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: wps_wid.cid-735916525.1730301987.exe Static file information: File size 5806976 > 1048576
Source: wps_wid.cid-735916525.1730301987.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x3e3c00
Source: wps_wid.cid-735916525.1730301987.exe Static PE information: More than 200 imports for KERNEL32.dll
Source: wps_wid.cid-735916525.1730301987.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: wps_wid.cid-735916525.1730301987.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: wps_wid.cid-735916525.1730301987.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: wps_wid.cid-735916525.1730301987.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: wps_wid.cid-735916525.1730301987.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: wps_wid.cid-735916525.1730301987.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: wps_wid.cid-735916525.1730301987.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: wps_wid.cid-735916525.1730301987.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668023522.0000000014F80000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3767362095.00000000157B6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\rc_bug_mas_v12_2409\wpsenv\3rd\qt5\build_x86\qtbase\plugins\printsupport\windowsprintersupport.pdb source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668023522.0000000014F80000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\rc_bug_mas_v12_2409\wpsenv\3rd\qt5\build_x86\qtbase\plugins\printsupport\windowsprintersupport.pdb## source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668023522.0000000014F80000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\rc_bug_mas_v12_2409\wpsenv\3rd\qt5\build_x86\qtbase\plugins\platforms\qwindows.pdb source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014251000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: H:\pub_bh8f\rc_bug_mas_v12_2409\Build\Release\WPSOffice\office6\addons\yunkitapi\yunkitapi.pdb source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3748445348.0000000014990000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\rc_bug_mas_v12_2409\wpsenv\3rd\qt5\build_x86\qtbase\plugins\imageformats\qsvg.pdb source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000002.4126160918.000000006B153000.00000002.00000001.01000000.00000017.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.000000001328C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\rc_bug_mas_v12_2409\wpsenv\3rd\qt5\build_x86\qtbase\plugins\iconusers\qsvgicon.pdb source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.000000001328C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ?COMCTL32.dllWINHTTP.dllcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -FS -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASMLoad file into cachecrypto\x509\by_file.cunspecified certificate verification errorunable to get issuer certificateunable to get certificate CRLunable to decrypt certificate's signatureunable to decrypt CRL's signatureunable to decode issuer public keycertificate signature failureCRL signature failurecertificate is not yet validcertificate has expiredCRL is not yet validCRL has expiredformat error in certificate's notBefore fieldformat error in certificate's notAfter fieldformat error in CRL's lastUpdate fieldformat error in CRL's nextUpdate fieldout of memoryself signed certificateself signed certificate in certificate chainunable to get local issuer certificateunable to verify the first certificatecertificate chain too longcertificate revokedinvalid CA certificatepath length constraint exceededunsupported certificate purposecertificate not trustedcertificate rejectedsubject issuer mismatchauthority and subject key identifier mismatchauthority and issuer serial number mismatchkey usage does not include certificate signingunable to get CRL issuer certificateunhandled critical extensionkey usage does not include CRL signingunhandled critical CRL extensioninvalid non-CA certificate (has CA markings)proxy path length constraint exceededkey usage does not include digital signatureproxy certificates not allowed, please set the appropriate flaginvalid or inconsistent certificate extensioninvalid or inconsistent certificate policy extensionno explicit policyDifferent CRL scopeUnsupported extension featureRFC 3779 resource not subset of parent's resourcespermitted subtree violationexcluded subtree violationname constraints minimum and maximum not supportedapplication verification failureunsupported name constraint typeunsupported or invalid name constraint syntaxunsupported or invalid name syntaxCRL path validation errorPath LoopSuite B: certificate version invalidSuite B: invalid public key algorithmSuite B: invalid ECC curveSuite B: invalid signature algorithmSuite B: curve not allowed for this LOSSuite B: cannot sign P-384 with P-256Hostname mismatchEmail address mismatchIP address mismatchNo matching DANE TLSA recordsEE certificate key too weakCA certificate key too weakCA signature digest algorithm too weakInvalid certificate verification contextIssuer certificate lookup errorCertificate Transparency required, but no valid SCTs foundproxy subject name violationOCSP verification neededOCSP verification failedOCSP unknown certCertificate public key has explicit ECC parametersunknown certificate verification errorcrypto\asn1\x_info.ccrypto\pem\pem_info.cRSA P
Source: Binary string: ucrtbase.pdb source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\rc_v12_i18n_202409_branch\Build\Release\WPSOffice\office6\addons\konlinesetup_xa\konlinesetup_xa.pdb source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp
Source: Binary string: D:\rc_bug_mas_v12_2409\wpsenv\3rd\qt5\build_x86\qtbase\plugins\styles\qwindowsvistastyle.pdb%% source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: H:\pub_bh8f\rc_bug_mas_v12_2409\Build\Release\WPSOffice\office6\wpsuil.pdb source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.0000000016B1B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\rc_bug_mas_v12_2409\wpsenv\3rd\qt5\build_x86\qtbase\plugins\platforms\qdirect2d.pdb source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000013241000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: H:\pub_bh8f\rc_bug_mas_v12_2409\Build\Release\WPSOffice\office6\wpsupdate_res.pdb source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.0000000016B1B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ucrtbase.pdbUGP source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\vccorlib140.i386.pdbGCTL source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668023522.0000000014F80000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\rc_bug_mas_v12_2409\wpsenv\3rd\qt5\build_x86\qtbase\plugins\styles\qwindowsvistastyle.pdb source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -FS -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASM source: wps_wid.cid-735916525.1730301987.exe, 00000000.00000000.2238530081.0000000000A55000.00000002.00000001.01000000.00000003.sdmp
Source: Binary string: H:\pub_bh8f\rc_bug_mas_v12_2409\Build\Release\WPSOffice\office6\wpsofficeicon.pdb source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.3752183714.000000001591E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\vccorlib140.i386.pdb source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668023522.0000000014F80000.00000004.00001000.00020000.00000000.sdmp, 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2668443885.0000000014298000.00000004.00000020.00020000.00000000.sdmp
Source: wps_wid.cid-735916525.1730301987.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: wps_wid.cid-735916525.1730301987.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: wps_wid.cid-735916525.1730301987.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: wps_wid.cid-735916525.1730301987.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: wps_wid.cid-735916525.1730301987.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Binary contains a suspicious time stamp
Source: api-ms-win-core-console-l1-1-0.dll.5.dr Static PE information: 0xF471666F [Wed Dec 16 02:48:15 2099 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_0098D6B0 LoadLibraryW,GetProcAddress,FreeLibrary,ExpandEnvironmentStringsW,FreeLibrary,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,Sleep,ExpandEnvironmentStringsW,RegCloseKey,FreeLibrary,FreeLibrary, 5_2_0098D6B0
PE file contains sections with non-standard names
Source: kshell.dll.5.dr Static PE information: section name: .detourc
Source: kshell.dll.5.dr Static PE information: section name: .detourd
Source: krpt.dll.5.dr Static PE information: section name: .detourc
Source: krpt.dll.5.dr Static PE information: section name: .detourd
Source: ksandbox.dll.5.dr Static PE information: section name: .detourc
Source: ksandbox.dll.5.dr Static PE information: section name: .detourd
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00CD2209 push ecx; ret 5_2_00CD221C
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A8B255 push eax; retf 7_2_00A8B256

Persistence and Installation Behavior
barindex
Contains functionality to infect the boot sector
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: memset,GetSystemDirectoryW,GetLastError,__acrt_iob_func,_fprintf,CreateFileW,GetLastError,__acrt_iob_func,_fprintf,DeviceIoControl,GetLastError,__acrt_iob_func,_fprintf,CloseHandle,CloseHandle,CreateFileA,DeviceIoControl,DeviceIoControl,memset,DeviceIoControl,strncpy_s,strncpy_s,strncpy_s,memset,CloseHandle,CloseHandle, \\.\PhysicalDrive%d 7_2_64E0B3F0
Drops PE files
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File created: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\kqingaccountsdk.dll Jump to dropped file
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File created: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\addons\ksearchpanel\ksearchpanel.dll Jump to dropped file
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File created: C:\Users\user\AppData\Local\Temp\wps\~4872e0\CONTROL\office6\api-ms-win-core-console-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File created: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\kshell.dll Jump to dropped file
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File created: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\krpt.dll Jump to dropped file
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File created: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\addons\ksandbox\ksandbox.dll Jump to dropped file
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File created: C:\Users\user\AppData\Local\Temp\wps\~4872e0\CONTROL\office6\api-ms-win-core-console-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File created: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\addons\kscreengrab\kscreengrab.dll Jump to dropped file
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File created: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksaddndr.dll Jump to dropped file
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File created: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\addons\ksharedoc_xa\ksharedoc_xa.dll Jump to dropped file
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File created: C:\Users\user\AppData\Local\Temp\wps\~4872e0\CONTROL\office6\api-ms-win-core-datetime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File created: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\utility\diffbase\office6\mui\default\templates\printTemplate.pdf_bk (copy) Jump to dropped file
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File created: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\addons\kqingdlg\kqingdlg.dll Jump to dropped file
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File created: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\addons\krecentfile\krecentfile.dll Jump to dropped file
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File created: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\krt.dll Jump to dropped file
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe File created: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Jump to dropped file
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009CA920 CryptQueryObject,CryptMsgGetParam,CryptMsgGetParam,CertFindCertificateInStore,CertGetNameStringW,CertGetNameStringW,CertGetNameStringW,CertFreeCRLContext,CertCloseStore,CryptMsgClose,CertGetNameStringW,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,PathFileExistsW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,RegCloseKey, 5_2_009CA920
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A54D00 GetPrivateProfileStringW, 5_2_00A54D00
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A0AD50 GetPrivateProfileStringW, 5_2_00A0AD50
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00978E30 GetPrivateProfileStringW,GetPrivateProfileStringW, 5_2_00978E30
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009F0F10 RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,GetPrivateProfileStringW, 5_2_009F0F10
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A15D90 SendMessageW,CreateSemaphoreW,ReleaseSemaphore,FindWindowW,GetPrivateProfileStringW,WritePrivateProfileStringW,GetTickCount,SendMessageW,SendMessageW,RegOpenKeyExW,RegDeleteValueW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegDeleteValueW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegDeleteValueW,RegCloseKey,SendMessageW,SendMessageW,RegOpenKeyExW,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,RegCloseKey,OpenSCManagerW,OpenServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,GetLastError,RegCreateKeyExW,RegSetValueExW,RegSetValueExW,RegSetValueExW,RegCloseKey,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCloseKey,RegCloseKey,RegCloseKey,RegSetValueExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,PathQuoteSpacesW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegSetValueExW,RegSetValueExW,RegCloseKey,RegSetValueExW,RegCreateKeyExW,RegSetValueExW,RegSetValueExW,RegCloseKey,WaitForSingleObject,WaitForSingleObject,CloseHandle,CloseHandle,GetTickCount,WaitForSingleObject, 5_2_00A15D90
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A55E60 GetPrivateProfileStringW, 5_2_00A55E60
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A541E0 GetPrivateProfileStringW, 5_2_00A541E0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A46230 PathFileExistsW,GetPrivateProfileIntW,PathFileExistsW, 5_2_00A46230
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A54490 GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW, 5_2_00A54490
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A54AA0 GetPrivateProfileStringW,GetPrivateProfileStringW, 5_2_00A54AA0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009BF000 LoadLibraryExW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,PathFileExistsW, 5_2_009BF000
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A574B0 GetPrivateProfileStringW, 5_2_00A574B0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A01530 GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,WritePrivateProfileStringW,WritePrivateProfileStringW,WritePrivateProfileStringW,RegOpenKeyExW,RegCloseKey,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegCloseKey, 5_2_00A01530
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009BFB00 GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetCommandLineW,WritePrivateProfileStringW, 5_2_009BFB00
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A61B60 RegOpenKeyExW,RegQueryValueExW,RegOpenKeyExW,RegCloseKey,RegQueryValueExW,RegCloseKey,MultiByteToWideChar,MultiByteToWideChar,RegCloseKey,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,SHGetSpecialFolderPathW,GetPrivateProfileStringW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCloseKey,RegCloseKey,RegCloseKey,RegOpenKeyExW,RegQueryValueExW,RegCloseKey, 5_2_00A61B60
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_0097FDB0 GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,PathFileExistsW,DeleteFileW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW, 5_2_0097FDB0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009FFE10 GetPrivateProfileStringW,SHGetSpecialFolderPathW,SHGetSpecialFolderPathW, 5_2_009FFE10
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00ABF220 _invalid_parameter_noinfo_noreturn,GetPrivateProfileStringW,GetPrivateProfileStringW,_invalid_parameter_noinfo_noreturn, 7_2_00ABF220
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00B03550 _invalid_parameter_noinfo_noreturn,memset,GetPrivateProfileStringW,_invalid_parameter_noinfo_noreturn, 7_2_00B03550
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00AF77F0 memset,memset,GetModuleFileNameW,wcsrchr,wcsncpy,GetPrivateProfileIntW,__Init_thread_footer, 7_2_00AF77F0
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00AF39D0 _invalid_parameter_noinfo_noreturn,memset,GetPrivateProfileStringW,_invalid_parameter_noinfo_noreturn, 7_2_00AF39D0
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A8D190 _wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,GetPrivateProfileIntW,memset,memset,memset,memset,GetVersionExW,wcsrchr,??0QString@kso_qt@@QAE@XZ,??0QString@kso_qt@@QAE@XZ,??0QString@kso_qt@@QAE@XZ,??0QString@kso_qt@@QAE@XZ,??0QString@kso_qt@@QAE@XZ, 7_2_00A8D190
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A9F2C0 ?isChecked@QAbstractButton@kso_qt@@QBE_NXZ,?isChecked@QAbstractButton@kso_qt@@QBE_NXZ,?isChecked@QAbstractButton@kso_qt@@QBE_NXZ,?isChecked@QAbstractButton@kso_qt@@QBE_NXZ,GetPrivateProfileIntW,WritePrivateProfileStringW,?tr@QMetaObject@kso_qt@@QBE?AVQString@2@PBD0H@Z,?tr@QMetaObject@kso_qt@@QBE?AVQString@2@PBD0H@Z,?tr@QMetaObject@kso_qt@@QBE?AVQString@2@PBD0H@Z,?information@QMessageBox@kso_qt@@SA?AW4StandardButton@12@PAVQWidget@2@ABVQString@2@1V?$QFlags@W4StandardButton@QMessageBox@kso_qt@@@2@W4312@@Z,??1QString@kso_qt@@QAE@XZ,??1QString@kso_qt@@QAE@XZ, 7_2_00A9F2C0
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A8E3D0 memset,memset,memset,memset,memset,memset,memset,_wcsicmp,_wcsicmp,memset,memset,wcsncpy,wcsncpy,wcsncpy,wcsrchr,memset,GetPrivateProfileStringW,_wcsicmp,wcscat_s,?utf16@QString@kso_qt@@QBEPBGXZ,?utf16@QString@kso_qt@@QBEPBGXZ,?utf16@QString@kso_qt@@QBEPBGXZ, 7_2_00A8E3D0
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A8D850 _wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,GetPrivateProfileIntW,memset,memset,memset,memset,GetVersionExW,wcsrchr,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,??0QString@kso_qt@@QAE@XZ,?isOverseasVersion@product@krt@@YA_NXZ,??4QString@kso_qt@@QAEAAV01@PBD@Z,??YQString@kso_qt@@QAEAAV01@PBD@Z,??0QByteArray@kso_qt@@QAE@ABV01@@Z,??0QByteArray@kso_qt@@QAE@ABV01@@Z,??1QString@kso_qt@@QAE@XZ, 7_2_00A8D850
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00AA2930 GetPrivateProfileIntW,WritePrivateProfileStringW,GetPrivateProfileIntW,WritePrivateProfileStringW,GetPrivateProfileIntW,WritePrivateProfileStringW,GetPrivateProfileIntW,WritePrivateProfileStringW,GetPrivateProfileIntW,WritePrivateProfileStringW, 7_2_00AA2930
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A8CA20 ?translate@QCoreApplication@kso_qt@@SA?AVQString@2@PBD00H@Z,?translate@QCoreApplication@kso_qt@@SA?AVQString@2@PBD00H@Z,_CxxThrowException,?translate@QCoreApplication@kso_qt@@SA?AVQString@2@PBD00H@Z,memset,memset,memset,GetVersionExW,memset,GetPrivateProfileStringW,??0QString@kso_qt@@QAE@XZ,?isSupportRibbonScale@product@krt@@YA_NXZ,?isSupportRibbonScale@product@krt@@YA_NXZ,memset,?isSupportRibbonScale@product@krt@@YA_NXZ,?translate@QCoreApplication@kso_qt@@SA?AVQString@2@PBD00H@Z,?trimmed@QString@kso_qt@@QHAE?AV12@XZ,??0QString@kso_qt@@QAE@$$QAV01@@Z,??1QString@kso_qt@@QAE@XZ,??1QString@kso_qt@@QAE@XZ,??1QString@kso_qt@@QAE@XZ,??1QString@kso_qt@@QAE@XZ,wcsncpy,?utf16@QString@kso_qt@@QBEPBGXZ,?translate@QCoreApplication@kso_qt@@SA?AVQString@2@PBD00H@Z,?utf16@QString@kso_qt@@QBEPBGXZ,??1QString@kso_qt@@QAE@XZ,?fromAscii_helper@QString@kso_qt@@CAPAU?$QTypedArrayData@G@2@PBDH@Z,??1QString@kso_qt@@QAE@XZ,?isSupportRibbonScale@product@krt@@YA_NXZ,wcsrchr,wcsrchr,??1QString@kso_qt@@QAE@XZ, 7_2_00A8CA20
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A92C20 GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,_invalid_parameter_noinfo_noreturn, 7_2_00A92C20
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00AFAD00 ?endGroup@QSettings@kso_qt@@QAEXXZ,?setValue@QSettings@kso_qt@@QAEXABVQString@2@ABVQVariant@2@@Z,memset,GetPrivateProfileStringW,_invalid_parameter_noinfo_noreturn,?endGroup@QSettings@kso_qt@@QAEXXZ,memset,?endGroup@QSettings@kso_qt@@QAEXXZ,GetModuleFileNameW,?endGroup@QSettings@kso_qt@@QAEXXZ,?isOverseasVersion@product@krt@@YA_NXZ,??0KCommonSettings@krt@@QAE@W4Scope@QSettings@kso_qt@@@Z,?fromAscii_helper@QString@kso_qt@@CAPAU?$QTypedArrayData@G@2@PBDH@Z,?fromAscii_helper@QString@kso_qt@@CAPAU?$QTypedArrayData@G@2@PBDH@Z,?beginGroup@QSettings@kso_qt@@QAEXABVQString@2@@Z,?beginGroup@QSettings@kso_qt@@QAEXABVQString@2@@Z,??1QString@kso_qt@@QAE@XZ,?fromAscii_helper@QString@kso_qt@@CAPAU?$QTypedArrayData@G@2@PBDH@Z,?beginGroup@QSettings@kso_qt@@QAEXABVQString@2@@Z,??1QString@kso_qt@@QAE@XZ,??0QVariant@kso_qt@@QAE@H@Z,??0QVariant@kso_qt@@QAE@H@Z,?fromAscii_helper@QString@kso_qt@@CAPAU?$QTypedArrayData@G@2@PBDH@Z,?setValue@QSettings@kso_qt@@QAEXABVQString@2@ABVQVariant@2@@Z,?setValue@QSettings@kso_qt@@QAEXABVQString@2@ABVQVariant@2@@Z,?setValue@QSettings@kso_qt@@QAEXABVQString@2@ABVQVariant@2@@Z,??1QString@kso_qt@@QAE@XZ,??1QVariant@kso_qt@@QAE@XZ,??1QVariant@kso_qt@@QAE@XZ,??0QVariant@kso_qt@@QAE@H@Z,?fromAscii_helper@QString@kso_qt@@CAPAU?$QTypedArrayData@G@2@PBDH@Z,?setValue@QSettings@kso_qt@@QAEXABVQString@2@ABVQVariant@2@@Z,?setValue@QSettings@kso_qt@@QAEXABVQString@2@ABVQVariant@2@@Z,??1QString@kso_qt@@QAE@XZ,??1QVariant@kso_qt@@QAE@XZ,?endGroup@QSettings@kso_qt@@QAEXXZ,?endGroup@QSettings@kso_qt@@QAEXXZ,?endGroup@QSettings@kso_qt@@QAEXXZ,??1KWpsCloudSvrSettings@krt@@UAE@XZ, 7_2_00AFAD00
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File created: C:\Users\user\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log Jump to behavior

Boot Survival
barindex
Contains functionality to infect the boot sector
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: memset,GetSystemDirectoryW,GetLastError,__acrt_iob_func,_fprintf,CreateFileW,GetLastError,__acrt_iob_func,_fprintf,DeviceIoControl,GetLastError,__acrt_iob_func,_fprintf,CloseHandle,CloseHandle,CreateFileA,DeviceIoControl,DeviceIoControl,memset,DeviceIoControl,strncpy_s,strncpy_s,strncpy_s,memset,CloseHandle,CloseHandle, \\.\PhysicalDrive%d 7_2_64E0B3F0
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009F95A0 SHGetSpecialFolderPathW,RegOpenKeyExW,RegCloseKey,RegCloseKey,GetModuleHandleW,GetProcAddress,RegOpenKeyExW,RegCloseKey,RegCloseKey,GetModuleHandleW,GetProcAddress,RegOpenKeyExW,RegCloseKey,RegDeleteValueW,RegDeleteValueW,RegCloseKey,GetModuleHandleW,GetProcAddress,RegOpenKeyExW,RegCloseKey,RegCloseKey,GetModuleHandleW,GetProcAddress,RegOpenKeyExW,RegCloseKey,RegCloseKey,GetModuleHandleW,GetProcAddress,RegOpenKeyExW,RegCloseKey,RegCloseKey,GetModuleHandleW,GetProcAddress,RegOpenKeyExW,RegCloseKey,RegCloseKey,GetModuleHandleW,GetProcAddress,RegOpenKeyExW,RegCloseKey,RegCloseKey,GetModuleHandleW,GetProcAddress,RegOpenKeyExW,RegCloseKey,RegDeleteValueW,RegCloseKey,GetModuleHandleW,GetProcAddress,RegOpenKeyExW,RegCloseKey,RegCloseKey,GetModuleHandleW,GetProcAddress,RegOpenKeyExW,RegCloseKey,RegCloseKey,RegDeleteValueW,RegCloseKey,RegCloseKey, 5_2_009F95A0
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_DiskDrive
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00C2A610 GetLastError,GetCurrentProcessId,ProcessIdToSessionId,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,ProcessIdToSessionId,OpenProcess,OpenProcessToken,CloseHandle,CloseHandle,RegOpenCurrentUser,RevertToSelf, 5_2_00C2A610
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Window / User API: threadDelayed 630 Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Window / User API: foregroundWindowGot 622 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\kqingaccountsdk.dll Jump to dropped file
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wps\~4872e0\CONTROL\office6\api-ms-win-core-console-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\addons\ksearchpanel\ksearchpanel.dll Jump to dropped file
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\krpt.dll Jump to dropped file
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wps\~4872e0\CONTROL\office6\api-ms-win-core-console-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\addons\ksandbox\ksandbox.dll Jump to dropped file
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\addons\kscreengrab\kscreengrab.dll Jump to dropped file
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksaddndr.dll Jump to dropped file
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wps\~4872e0\CONTROL\office6\api-ms-win-core-datetime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\addons\ksharedoc_xa\ksharedoc_xa.dll Jump to dropped file
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\utility\diffbase\office6\mui\default\templates\printTemplate.pdf_bk (copy) Jump to dropped file
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\addons\kqingdlg\kqingdlg.dll Jump to dropped file
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\addons\krecentfile\krecentfile.dll Jump to dropped file
Found evasive API chain (date check)
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Evasive API call chain: GetLocalTime,DecisionNodes
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe API coverage: 3.7 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe TID: 2036 Thread sleep time: -30000s >= -30000s
Queries disk information (often used to detect virtual machines)
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe File opened: PhysicalDrive0 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Last function: Thread delayed
Uses the system / local time for branch decision (may execute only at specific dates)
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_64E64E10 GetSystemTimeAsFileTime followed by cmp: cmp ebp, 04h and CTI: jbe 64E6530Bh 7_2_64E64E10
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe File Volume queried: C:\Users\user\Desktop FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File Volume queried: C:\Users\user\Desktop\wps_download FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File Volume queried: C:\Users\user\Desktop\wps_download FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File Volume queried: C:\Users\user\Desktop\wps_download FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe File Volume queried: C:\Users\user\Desktop\wps_download FullSizeInformation
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A0C1A0 PathAddBackslashW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,SHGetSpecialFolderPathW, 5_2_00A0C1A0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A1C140 PathAddBackslashW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose, 5_2_00A1C140
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009D42F0 FindFirstFileW,PathFileExistsW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,GetLastError,FindClose,CopyFileW,lstrcmpW,FindNextFileW, 5_2_009D42F0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A34270 SHGetSpecialFolderPathW,CoInitialize,CoCreateInstance,FindFirstFileW,FindNextFileW,FindNextFileW,StrStrIW,StrStrIW,FindNextFileW,FindClose,CoUninitialize, 5_2_00A34270
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009CB6E0 FindFirstFileW,FindNextFileW,FindNextFileW,FindClose, 5_2_009CB6E0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009EFBA0 RegCloseKey,FindFirstFileW,MoveFileExW,MoveFileExW,FindNextFileW,FindClose,MoveFileExW,Concurrency::cancel_current_task,MoveFileExW,MoveFileExW, 5_2_009EFBA0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A37D60 RegOpenKeyExW,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegCloseKey,SHGetSpecialFolderPathW,SHGetSpecialFolderPathW,SHGetSpecialFolderPathW,FindFirstFileW,FindNextFileW,FindClose,GetLastError, 5_2_00A37D60
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009EC0D0 FindFirstFileW,FindNextFileW,FindClose,CopyFileW,RegOpenKeyExW,RegSetValueExW,RegCloseKey, 5_2_009EC0D0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00990160 FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,FindClose,GetLastError,GetLastError,RemoveDirectoryW,MoveFileExW,GetLastError,FindClose,GetSystemDirectoryW,SetFileAttributesW,DeleteFileW,MoveFileExW,SetFileAttributesW,DeleteFileW,GetTickCount,MoveFileExW,MoveFileExW,lstrcmpW,FindNextFileW,__Init_thread_footer, 5_2_00990160
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A004A0 PathAddBackslashW,FindFirstFileW,FindNextFileW,FindClose, 5_2_00A004A0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A5E890 SHGetSpecialFolderPathW,SHGetSpecialFolderPathW,CoInitialize,CoCreateInstance,FindFirstFileW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,DeleteFileW,FindNextFileW,FindClose,CoUninitialize, 5_2_00A5E890
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009D5150 FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose, 5_2_009D5150
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A3F6B0 PathFileExistsW,GetFileAttributesW,FindFirstFileW,FindNextFileW,FindClose,WritePrivateProfileStringW,WritePrivateProfileStringW,WritePrivateProfileStringW,WritePrivateProfileStringW, 5_2_00A3F6B0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_0098B710 FindFirstFileW,FindNextFileW,FindClose, 5_2_0098B710
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009C98F0 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose, 5_2_009C98F0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A3D8D0 FindFirstFileW,GetLastError,PathFileExistsW,CopyFileW,FindNextFileW,FindClose,PathFileExistsW,CopyFileW,GetLastError,GetLastError, 5_2_00A3D8D0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A39BC0 PathFileExistsW,FindFirstFileW,lstrcmpW,lstrcmpW,CopyFileW,FindNextFileW,FindClose, 5_2_00A39BC0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A33EE0 FindNextFileW,StrStrIW,StrStrIW,CopyFileW,GetSystemDirectoryW,SHGetSpecialFolderPathW,CoInitialize,CoCreateInstance,FindFirstFileW,FindNextFileW,FindNextFileW,StrStrIW,StrStrIW,FindNextFileW,FindClose,CoUninitialize, 5_2_00A33EE0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009C9F70 FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,FindNextFileW,DeleteFileW,FindClose, 5_2_009C9F70
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A924B0 memset,memset,GetVersionExW,wcscat_s,memset,?fromUtf16@QString@kso_qt@@SA?AV12@PBGH@Z,??1QString@kso_qt@@QAE@XZ,?utf16@QString@kso_qt@@QBEPBGXZ,FindFirstFileW,?fromUtf16@QString@kso_qt@@SA?AV12@PBGH@Z,?fromUtf16@QString@kso_qt@@SA?AV12@PBGH@Z,??0QByteArray@kso_qt@@QAE@ABV01@@Z,?append@QString@kso_qt@@QAEAAV12@ABV12@@Z,??1QString@kso_qt@@QAE@XZ,??1QString@kso_qt@@QAE@XZ,?utf16@QString@kso_qt@@QBEPBGXZ,??1QString@kso_qt@@QAE@XZ,FindNextFileW,FindClose,??1QString@kso_qt@@QAE@XZ, 7_2_00A924B0
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A89420 memset,wcsncpy,wcsncat,memset,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose, 7_2_00A89420
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A9D6A0 ?shared_null@QListData@kso_qt@@2UData@12@B,memset,??0QByteArray@kso_qt@@QAE@ABV01@@Z,?fromUtf8@QString@kso_qt@@SA?AV12@PBDH@Z,?append@QString@kso_qt@@QAEAAV12@ABV12@@Z,??1QString@kso_qt@@QAE@XZ,?toNativeSeparators@QDir@kso_qt@@SA?AVQString@2@ABV32@@Z,??1QString@kso_qt@@QAE@XZ,?utf16@QString@kso_qt@@QBEPBGXZ,FindFirstFileW,?fromUtf16@QString@kso_qt@@SA?AV12@PBGH@Z,??0QByteArray@kso_qt@@QAE@ABV01@@Z,?fromUtf8@QString@kso_qt@@SA?AV12@PBDH@Z,?append@QString@kso_qt@@QAEAAV12@ABV12@@Z,??1QString@kso_qt@@QAE@XZ,??0QByteArray@kso_qt@@QAE@ABV01@@Z,?append@QString@kso_qt@@QAEAAV12@ABV12@@Z,??1QString@kso_qt@@QAE@XZ,??1QString@kso_qt@@QAE@XZ,??1QString@kso_qt@@QAE@XZ,FindNextFileW,?shared_null@QListData@kso_qt@@2UData@12@B,?shared_null@QListData@kso_qt@@2UData@12@B,FindClose,??1QString@kso_qt@@QAE@XZ, 7_2_00A9D6A0
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A9A95C ??0QString@kso_qt@@QAE@PBD@Z,??1QString@kso_qt@@QAE@XZ,memmove,memset,wcscpy_s,_invalid_parameter_noinfo_noreturn,memset,memset,memset,GetVersionExW,memset,FindFirstFileW,??0QString@kso_qt@@QAE@XZ,?isOverseasVersion@product@krt@@YA_NXZ,??4QString@kso_qt@@QAEAAV01@PBD@Z,??0QByteArray@kso_qt@@QAE@ABV01@@Z,??0QByteArray@kso_qt@@QAE@ABV01@@Z,??1QString@kso_qt@@QAE@XZ,DeleteFileW,FindNextFileW,??1QString@kso_qt@@QAE@XZ,FindClose,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 7_2_00A9A95C
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A9BA70 FindClose,Sleep,memset,FindFirstFileW,FindClose,Sleep, 7_2_00A9BA70
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A92A40 ?translate@QCoreApplication@kso_qt@@SA?AVQString@2@PBD00H@Z,?shared_null@QListData@kso_qt@@2UData@12@B,?isEmpty@QListData@kso_qt@@QBE_NXZ,?toNativeSeparators@QDir@kso_qt@@SA?AVQString@2@ABV32@@Z,??0QChar@kso_qt@@QAE@H@Z,?endsWith@QString@kso_qt@@QBE_NVQChar@2@W4CaseSensitivity@Qt@2@@Z,??YQString@kso_qt@@QAEAAV01@PBD@Z,?utf16@QString@kso_qt@@QBEPBGXZ,FindFirstFileW,FindNextFileW,?translate@QCoreApplication@kso_qt@@SA?AVQString@2@PBD00H@Z,?fromWCharArray@QString@kso_qt@@SA?AV12@PB_WH@Z,?QStringList_contains@QtPrivate@kso_qt@@YA_NPBVQStringList@2@ABVQString@2@W4CaseSensitivity@Qt@2@@Z,??1QString@kso_qt@@QAE@XZ,FindNextFileW,FindClose,??1QString@kso_qt@@QAE@XZ, 7_2_00A92A40
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00B07DB0 FindFirstFileW,_wcsnicmp,FindNextFileW,FindClose,_invalid_parameter_noinfo_noreturn, 7_2_00B07DB0
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A97E40 memset,FindFirstFileW,DeleteFileW,FindNextFileW,memmove,FindClose,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,?isSupportRibbonScale@product@krt@@YA_NXZ,?fromAscii_helper@QString@kso_qt@@CAPAU?$QTypedArrayData@G@2@PBDH@Z,??1QString@kso_qt@@QAE@XZ,?shared_null@QHashData@kso_qt@@2U12@B,?translate@QCoreApplication@kso_qt@@SA?AVQString@2@PBD00H@Z,??0QChar@kso_qt@@QAE@UQLatin1Char@1@@Z,?arg@QString@kso_qt@@QBE?AV12@ABV12@HVQChar@2@@Z,?utf16@QString@kso_qt@@QBEPBGXZ,??1QString@kso_qt@@QAE@XZ,??1QString@kso_qt@@QAE@XZ,??1QString@kso_qt@@QAE@XZ,?shared_null@QHashData@kso_qt@@2U12@B, 7_2_00A97E40
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00A8DE50 memset,FindFirstFileW,memset,memset,_wcsicmp,memset,memset,_wcsnicmp,FindNextFileW,FindClose, 7_2_00A8DE50
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009F75A0 GetTempPathW,PathAddBackslashW,GetLogicalDriveStringsW,GetDriveTypeW,GetDriveTypeW,GetDriveTypeW,GetDriveTypeW,PathAddBackslashW,GetTickCount, 5_2_009F75A0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_0096C9C0 GetCurrentProcess,GetProcessAffinityMask,GetSystemInfo, 5_2_0096C9C0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File opened: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\addons\kapplist\mui\default\html\kappcustomwidget\static\ Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File opened: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\addons\kapplist\mui\default\ Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File opened: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\addons\kapplist\mui\default\html\ Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File opened: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\addons\kapplist\mui\default\html\kappcustomwidget\ Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File opened: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\addons\kapplist\mui\ Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe File opened: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\addons\kapplist\mui\default\html\kappcustomwidget\static\css\ Jump to behavior
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000002.4121012144.0000000014EE6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000002.4116265647.00000000036DB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWen-GBn
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe, 00000005.00000003.2626467328.0000000001376000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00C8F898 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 5_2_00C8F898
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A63770 OutputDebugStringW,GetSystemWow64DirectoryW,GetLastError,OutputDebugStringW,SHGetSpecialFolderPathW,DeleteFileW,DeleteFileW,DeleteFileW,RegCreateKeyExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey, 5_2_00A63770
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00C2A610 GetLastError,GetCurrentProcessId,ProcessIdToSessionId,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,ProcessIdToSessionId,OpenProcess,OpenProcessToken,CloseHandle,CloseHandle,RegOpenCurrentUser,RevertToSelf, 5_2_00C2A610
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_0098D6B0 LoadLibraryW,GetProcAddress,FreeLibrary,ExpandEnvironmentStringsW,FreeLibrary,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,Sleep,ExpandEnvironmentStringsW,RegCloseKey,FreeLibrary,FreeLibrary, 5_2_0098D6B0
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00CAE844 mov eax, dword ptr fs:[00000030h] 5_2_00CAE844
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00CAE888 mov eax, dword ptr fs:[00000030h] 5_2_00CAE888
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00C8F597 mov eax, dword ptr fs:[00000030h] 5_2_00C8F597
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A2BF90 GetNativeSystemInfo,GetNativeSystemInfo,GetProcessHeap,HeapAlloc,SetLastError,GetSystemDirectoryW,GetNativeSystemInfo,PathAppendW,PathAppendW,PathAppendW,PathFileExistsW,PathAppendW,PathRenameExtensionW,PathQuoteSpacesW,Concurrency::cancel_current_task,Concurrency::cancel_current_task,Concurrency::cancel_current_task,Concurrency::cancel_current_task, 5_2_00A2BF90
Enables debug privileges
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00C8F898 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 5_2_00C8F898
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00C7F82B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 5_2_00C7F82B
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_6B146A8C IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 5_2_6B146A8C
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_6B146D8B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 5_2_6B146D8B
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_6B152AB4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 5_2_6B152AB4
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_6B152917 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 5_2_6B152917
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_6B1755F4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 5_2_6B1755F4
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_6B17545A IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 5_2_6B17545A
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_00C1509F SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 7_2_00C1509F
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_64E0E981 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 7_2_64E0E981
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_64E0EB24 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 7_2_64E0EB24
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_64E7B502 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 7_2_64E7B502
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Code function: 7_2_64E7B659 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 7_2_64E7B659
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Process created: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe c:\users\user\desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_xa_mui_free.exe.500.2083.exe -installcallbyonlinesetup -defaultopen -defaultopenpdf -asso_pic_setup -createicons -curlangofinstalledproduct=en_gb -d="c:\users\user\appdata\local\kingsoft\wps office" -notautostartwps -enablesetupmuipkg -appdata="c:\users\user\appdata\roaming"
Source: unknown Process created: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe "c:\users\user\desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_xa_mui_free.exe.500.2083.exe" -downpower -installcallbyonlinesetup -defaultopen -defaultopenpdf -asso_pic_setup -createicons -curlangofinstalledproduct="en_gb" -d="c:\users\user\appdata\local\kingsoft\wps office" -notautostartwps="c:\users\user\appdata\local\kingsoft\wps office" -enablesetupmuipkg="c:\users\user\appdata\local\kingsoft\wps office" -appdata="c:\users\user\appdata\roaming" -msgwndname=wpssetup_message_48854e -curinstalltemppath=c:\users\user\appdata\local\temp\wps\~4872e0\
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Process created: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe c:\users\user\desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_xa_mui_free.exe.500.2083.exe -installcallbyonlinesetup -defaultopen -defaultopenpdf -asso_pic_setup -createicons -curlangofinstalledproduct=en_gb -d="c:\users\user\appdata\local\kingsoft\wps office" -notautostartwps -enablesetupmuipkg -appdata="c:\users\user\appdata\roaming" Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00A29E10 LoadLibraryExW,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateMutexW,CreateMutexW,CreateMutexW,CreateEventW, 5_2_00A29E10
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009D6950 AllocateAndInitializeSid,CheckTokenMembership,FreeSid, 5_2_009D6950
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_6B1468AB cpuid 5_2_6B1468AB
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: EnumSystemLocalesEx, 5_2_00CAF2C2
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: GetLocaleInfoEx,GetLocaleInfoW, 5_2_00CAF46C
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW, 5_2_00CB7AF2
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: GetLocaleInfoW, 5_2_00CB8158
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: GetLocaleInfoEx, 5_2_00C822CA
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 5_2_00CB827E
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: GetLocaleInfoW, 5_2_00CB8384
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 5_2_00CB8453
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: EnumSystemLocalesW, 5_2_00CAEEB3
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: GetLocaleInfoW, 5_2_00CB7CED
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: EnumSystemLocalesW, 5_2_00CB7DDF
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: EnumSystemLocalesW, 5_2_00CB7D94
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: EnumSystemLocalesW, 5_2_00CB7E7A
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 5_2_00CB7F05
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Queries volume information: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Queries volume information: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Queries volume information: C:\Users\user\AppData\Local\Temp\wps\~4872e0\CONTROL\office6\qt.conf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Queries volume information: C:\Users\user\AppData\Local\Temp\wps\~4872e0\CONTROL\office6\qt.conf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Queries volume information: C:\Users\user\AppData\Local\Temp\wps\~4872e0\CONTROL\office6\qt\plugins\platforms\qdirect2d.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Queries volume information: C:\Users\user\AppData\Local\Temp\wps\~4872e0\CONTROL\office6\qt\plugins\platforms\qwindows.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Queries volume information: C:\Users\user\AppData\Local\Temp\wps\~4872e0\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Queries volume information: C:\Users\user\AppData\Local\Temp\wps\~4872e0\CONTROL\office6\kpacketui\mui\en_US\kpacketui.qm VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Queries volume information: C:\Users\user\AppData\Local\Temp\wps\~4872e0\CONTROL\office6\qt\plugins\imageformats\qsvg.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Queries volume information: C:\Users\user\AppData\Local\Temp\wps\~4872e0\CONTROL\office6\qt\plugins\iconusers\qsvgicon.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Queries volume information: C:\Users\user\AppData\Local\Temp\wps\~4872e0\CONTROL\office6\kpacketui\mui\en_GB\kpacketui.qm VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Queries volume information: C:\Users\user\AppData\Local\Temp\wps\~4872e0\CONTROL\office6\kpacketui\mui\de_DE\kpacketui.qm VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Queries volume information: C:\Users\user\AppData\Local\Temp\wps\~4872e0\CONTROL\office6\kpacketui\mui\en_GB\kpacketui.qm VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\cfgs\product.dat VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\cfgs\product.dat VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\qt.conf VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\qt.conf VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\qt\plugins\platforms\qdirect2d.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\qt\plugins\platforms\qwindows.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\qt\plugins\styles\qwindowsvistastyle.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\cfgs\setup.cfg VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\cfgs\setup.cfg VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\utility\install.ini VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\utility\install.ini VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\mui\en\lang.conf VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\mui\en\lang.conf VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\mui\en_GB\lang.conf VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\mui\en_GB\lang.conf VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\mui\en_US\lang.conf VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\mui\en_US\lang.conf VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\mui\ja_JP\lang.conf VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\mui\ja_JP\lang.conf VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\mui\th_TH\lang.conf VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\mui\th_TH\lang.conf VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Roaming\kingsoft\wps\addons\data\win-i386\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Roaming\kingsoft\wps\addons\data\win-i386\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Roaming\kingsoft\wps\addons\data\win-i386\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Roaming\kingsoft\wps\addons\data\win-i386\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Roaming\kingsoft\wps\addons\data\win-i386\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.lck VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Roaming\kingsoft\wps\addons\data\win-i386\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.lck VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Roaming\kingsoft\wps\addons\data\win-i386\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.lck VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Roaming\kingsoft\wps\addons\data\win-i386\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Roaming\kingsoft\wps\addons\data\win-i386\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Roaming\kingsoft\wps\addons\data\win-i386\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat VolumeInformation
Source: C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe Queries volume information: C:\Users\user\AppData\Roaming\kingsoft\wps\addons\data\win-i386\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat VolumeInformation
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_0099C4B0 RegCloseKey,WaitForSingleObject,GetLocalTime,_strrchr,_strrchr,GetCurrentThreadId,GetCurrentProcessId,EnterCriticalSection,LeaveCriticalSection,SetEvent, 5_2_0099C4B0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_00CB1DA0 _free,_free,_free,GetTimeZoneInformation,_free, 5_2_00CB1DA0
Source: C:\Users\user\Desktop\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Code function: 5_2_009DEFB0 RegCloseKey,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,std::locale::_Init,RegCloseKey,GetVersionExW,GetVersionExW, 5_2_009DEFB0
Source: C:\Users\user\Desktop\wps_wid.cid-735916525.1730301987.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Binary or memory string: 360Safe.exe
Source: 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe Binary or memory string: ravmond.exe
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1545519 Sample: wps_wid.cid-735916525.17303... Startdate: 30/10/2024 Architecture: WINDOWS Score: 26 35 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 2->35 37 Contains functionality to infect the boot sector 2->37 6 wps_wid.cid-735916525.1730301987.exe 9 14 2->6         started        11 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe 15 6 2->11         started        process3 dnsIp4 29 90.84.175.86 OPENTRANSITFR France 6->29 31 172.217.16.206 GOOGLEUS United States 6->31 33 104.16.84.69 CLOUDFLARENETUS United States 6->33 19 060656cfd1a6402a90...ee.exe.500.2083.exe, PE32 6->19 dropped 39 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 6->39 41 Drops large PE files 6->41 13 060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.500.2083.exe 13 1003 6->13         started        17 ksomisc.exe 11->17         started        file5 signatures6 process7 file8 21 C:\...\api-ms-win-core-datetime-l1-1-0.dll, PE32 13->21 dropped 23 C:\...\api-ms-win-core-console-l1-2-0.dll, PE32 13->23 dropped 25 C:\...\api-ms-win-core-console-l1-1-0.dll, PE32 13->25 dropped 27 12 other files (none is malicious) 13->27 dropped 43 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 13->43 signatures9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.217.16.206
 unknown United States
15169 GOOGLEUS false
104.16.84.69
 unknown United States
13335 CLOUDFLARENETUS false
90.84.175.86
 unknown France
5511 OPENTRANSITFR false