EchoTrail

WPS Office (12.2.0.23196) 12.2.0.23196

by Kingsoft Corp.installer signed by Zhuhai Kingsoft Office Software Co., Ltd.Valid

Sources: observed in the EchoTrail lab on Windows 11 on October 27, 2026.

The install

Installer
wpsoffice_23196.exe
Installer type
nsis
Installed through
a type-detected silent switch
Install directory
C:\Users\lab\AppData\Local\kingsoft
Launched
ksolaunch.exe
Windows
Windows 11
Date
October 27, 2026
Executables dropped
344

installer sha256 12417429e8a02e43cb089ab4a2cb449a9f15ad428af69f1f2f5277571046ddbd

The lab used WPS Office (12.2.0.23196) for 3 minutes, changed a setting, then rebooted and watched what came back.

On screen

Frames from the lab session, cropped to WPS Office (12.2.0.23196)'s own windows.

WPS Office (12.2.0.23196) 12.2.0.23196: First window
First window. WPS Office shows a Privacy Policy dialog with Exit WPS and Agree & Continue buttons.
WPS Office (12.2.0.23196) 12.2.0.23196: Main window
Main window. WPS Office Home window is shown with a Recent files list and a left navigation panel after the dialogs were dismissed.
WPS Office (12.2.0.23196) 12.2.0.23196: Settings
Settings. WPS Office Home shows a gear dropdown with the View submenu open, offering List View (checked) and Icon View.
WPS Office (12.2.0.23196) 12.2.0.23196: Worth a look
Worth a look. A WPS Office promotional dialog offering an exclusive discount for WPS Pro + WPS AI is displayed over the Home screen, with an X close button at top right.

What it dropped

Executables

  • libcef.dllsigned by CN="Zhuhai Kingsoft Office Software Co., Ltd.", O="Zhuhai Kingsoft Office Software Co., Ltd.", L=???, S=???, C=CNValid
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\addons\cef\libcef.dll
    sha256 59ac2853f95205d75c5be55bc0459cd9a15ed77adb04710ae877a0a8f83d89cc
  • qingbangong.dllsigned by CN="Zhuhai Kingsoft Office Software Co., Ltd.", O="Zhuhai Kingsoft Office Software Co., Ltd.", L=???, S=???, C=CNValid
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\addons\qing\qingbangong.dll
    sha256 f319d1108ba22ec87c53a4eefa87004ca42003f9a4d4a480c5ca6bfcd437f915
  • pdfcore.dll
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\pdfcore.dll
    sha256 0af1b2287e160dfe67e7fa0048afbbfdf7fea4ab48a67bc66b203e08296d899b
  • wpscore.dll
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\wpscore.dll
    sha256 ae26e30fe7d3ebfbf5aef79a9c269ecc2e0035f91d5c42b815d35521a063d60e
  • kso.dllsigned by CN="Zhuhai Kingsoft Office Software Co., Ltd.", O="Zhuhai Kingsoft Office Software Co., Ltd.", L=???, S=???, C=CNValid
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\kso.dll
    sha256 e07a7977016d1d0e06ba699d62133b1f217cf867f0fc22c77837f74ab94a5611
  • kshell.dllsigned by CN="Zhuhai Kingsoft Office Software Co., Ltd.", O="Zhuhai Kingsoft Office Software Co., Ltd.", L=???, S=???, C=CNValid
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\kshell.dll
    sha256 69ebabdfbde0101af884be1d663bb23292feeda5a41be5ff64ecf7cda3b056aa
  • etcore.dll
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\etcore.dll
    sha256 7ea4b76453c0d574b563010d4f70155ec72944d211baf576dc0d67b0b4fd8791
  • etmain.dll
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\etmain.dll
    sha256 d62aafdcc55a84026a997b5c39dac4b04317dc1975a7cae001e6a167ba39a489
  • wpsmain.dll
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\wpsmain.dll
    sha256 9503c58f0eeb6ac47597b348f56e94479793c3201380748845501c7e5e45dc2d
  • pdfmain.dll
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\pdfmain.dll
    sha256 6b77cabf65d329504da3d1ceb9e6a6c83c259f638090885adbd75900051d72fb
  • photo.dll
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\addons\photo\photo.dll
    sha256 19a2aba3fa516999935b5c381678ce1d2b276cf73e6e02b4ce1806da251b02f1
  • kstartpage.dllsigned by CN="Zhuhai Kingsoft Office Software Co., Ltd.", O="Zhuhai Kingsoft Office Software Co., Ltd.", L=???, S=???, C=CNValid
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\addons\kstartpage\kstartpage.dll
    sha256 b073e90defe77879a1b521778250055ae3752488fe6da3437111a298e5346e7b
  • wppcore.dll
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\wppcore.dll
    sha256 c77dc1e90c5c5941635e4212726f33ddd9ad22c2bec072d150e9d8a4e34e207c
  • officespace.dll
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\addons\officespace\officespace.dll
    sha256 2f54266d1beebd252dcdf1955c1348d9a51e0fa58341a9b8f85d236c625143dc
  • khyperion.dllsigned by CN="Zhuhai Kingsoft Office Software Co., Ltd.", O="Zhuhai Kingsoft Office Software Co., Ltd.", L=???, S=???, C=CNValid
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\addons\khyperion\khyperion.dll
    sha256 6a320f9291b2c1bc7de7d507efac3b30f0d7326b795a9c585f7ff9e2ad1f84ea
  • ksolite.dllsigned by CN="Zhuhai Kingsoft Office Software Co., Ltd.", O="Zhuhai Kingsoft Office Software Co., Ltd.", L=???, S=???, C=CNValid
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\ksolite.dll
    sha256 3176c8729945ff3fadcdcf1556590c2f78f3211bf50a7dd036e01b75b3d74117
  • wppmain.dll
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\wppmain.dll
    sha256 fafd8b6e6fd7f35c18402c8d2f7fc37c3c63a0b4d143db3406483ef282bbf466
  • etapi.dll
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\etapi.dll
    sha256 f06bcad81f91339f5b72571aad45c504f9421fdb9bcb7eb990c85c5ea4736613
  • wpsofficeicon.dll
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\wpsofficeicon.dll
    sha256 51f4688741651ef9a67e684ec553e5c9e8d796fc5341ae5632e44c3e9dfd640a
  • kaiwpp.dll
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\addons\kaiwpp\kaiwpp.dll
    sha256 cc7ffda9edb3ad88e1b8945225e338b9b0245aead68ae930788a537dc9bc34c9
  • kprometheus.dllsigned by CN="Zhuhai Kingsoft Office Software Co., Ltd.", O="Zhuhai Kingsoft Office Software Co., Ltd.", L=???, S=???, C=CNValid
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\kprometheus.dll
    sha256 5b0e7e084b225a3fbdbc2f289524f68771201225f1159abe5b24f90023ae0fbf
  • wpsapi.dll
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\wpsapi.dll
    sha256 c26d8578a15e06719d0b09a5fd601830df71745078d06c18c0b8cba2ea7c69c2
  • libglesv2.dllsigned by CN="Zhuhai Kingsoft Office Software Co., Ltd.", O="Zhuhai Kingsoft Office Software Co., Ltd.", L=???, S=???, C=CNValid
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\addons\cef\libGLESv2.dll
    sha256 bef906308d91cb9bf04800ab816d1869f744f28a8ad12f83ccc5ed844afdb086
  • photomultiview.dll
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\addons\photo\photomultiview.dll
    sha256 9be19209071c6005785c5e9f83646033b965d352f44906eeceabab53323cebb3
  • qt5guikso.dllsigned by CN="Zhuhai Kingsoft Office Software Co., Ltd.", O="Zhuhai Kingsoft Office Software Co., Ltd.", L=???, S=???, C=CNValid
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\Qt5GuiKso.dll
    sha256 c161c1a91ee9f07d1fc47d1b414057e555530d31cb54c538e08189401afe9bb0
  • qt5corekso.dllsigned by CN="Zhuhai Kingsoft Office Software Co., Ltd.", O="Zhuhai Kingsoft Office Software Co., Ltd.", L=???, S=???, C=CNValid
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\Qt5CoreKso.dll
    sha256 df7da12c96aef17ae7640ff38ee11d13b746eccaf7bfe53cd1956af9398f3169
  • kwppcopilot.dll
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\addons\kwppcopilot\kwppcopilot.dll
    sha256 8ccf98344d8f962e8da79bfd857beab14143156e29c5cad0044654c2bdea10d3
  • qt5widgetskso.dllsigned by CN="Zhuhai Kingsoft Office Software Co., Ltd.", O="Zhuhai Kingsoft Office Software Co., Ltd.", L=???, S=???, C=CNValid
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\Qt5WidgetsKso.dll
    sha256 4d4dd82c4b92ca239f2d6c2d988ddf3f378c308ea59b8f425eab9ccc5e2dc309
  • kappcenter.dll
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\addons\kappcenter\kappcenter.dll
    sha256 a54bc35827928d7d5a90faeb3fc391baf34157c5ff8f935c5b99af9088ca6015
  • jsetapi.dll
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\jsetapi.dll
    sha256 b85ed354b5a438dffc88db812fb6cb7ca1e906dae449bdb7cc90800fc8a5fd36
  • ksoapi.dll
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\ksoapi.dll
    sha256 35d34710877c7d1c83387ad2438fe816f352cf42abf638a66eb2f4cfa5fb4d64
  • vk_swiftshader.dllsigned by CN="Zhuhai Kingsoft Office Software Co., Ltd.", O="Zhuhai Kingsoft Office Software Co., Ltd.", L=???, S=???, C=CNValid
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\addons\cef\vk_swiftshader.dll
    sha256 ed8015645ba839e11a55d215e58de233aaf323fc508e149a015e1a546d87020d
  • d3dcompiler_47.dllsigned by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\addons\cef\d3dcompiler_47.dll
    sha256 c2c7ca6505ad10826e6b92319ce7aa355392b0cbd092a0fb8d4381c2d31268bf
  • wpsuil.dll
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\wpsuil.dll
    sha256 d551d9ad137d289772f13eaa133e32bc810882b1cb9b7f29bbe8cb8a63d61ee5
  • wpsio.dll
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\wpsio.dll
    sha256 708110caa3c411240c1889c27f5f571233b0a97ed73945c841e768956d771b25
  • qingipc.dllsigned by CN="Zhuhai Kingsoft Office Software Co., Ltd.", O="Zhuhai Kingsoft Office Software Co., Ltd.", L=???, S=???, C=CNValid
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\qingipc.dll
    sha256 218737e12bb59efafce7a898e31d585592a1aef8cc4d8fb40d2e5f7ca31e499e
  • jswpsapi.dll
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\jswpsapi.dll
    sha256 268e337964e969f09c15b7a650a122b8ebb772230d42bc46539262d3a519e81c
  • kpromebrowser.dllsigned by CN="Zhuhai Kingsoft Office Software Co., Ltd.", O="Zhuhai Kingsoft Office Software Co., Ltd.", L=???, S=???, C=CNValid
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\addons\kpromebrowser\kpromebrowser.dll
    sha256 c2a870fe03734ddc547d055d96c6638222b14a672c7c503212fa98ba8a441922
  • kqingaccountsdk.dll
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\kqingaccountsdk.dll
    sha256 5e572cd3a64bd558e1b21d3fa4ba128d5e9cf76a00838b4b81a6b9a2bb615c56
  • kwpscopilot.dll
    C:\Users\lab\AppData\Local\kingsoft\WPS Office\12.2.0.23196\office6\addons\kwpscopilot\kwpscopilot.dll
    sha256 4ceb2042c78e004fab88ce21a9fbb36b4bb99e1aa41e62e70fc1b4a99c80fa8f

Services

  • MicrosoftCopilotElevationService (Manual)"C:\Program Files (x86)\Microsoft\Copilot\Application\156.0.4314.42\elevation_service.exe"
  • wpscloudsvr (Manual)"C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe" LocalService

Scheduled tasks

  • WpsExternal_lab_20261027125905C:\Users\lab\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wpscloudsvr.exe /wpscloudlaunch /run_plugin /plugin_name=ktaskschdtool /plugin_entry=ktaskschdtool.dll /task=wpsexternal /launchtask /ver=1.0 /start_from=task_external
  • WpsExternal_lab_startupC:\Users\lab\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wpscloudsvr.exe /wpscloudlaunch /run_plugin /plugin_name=ktaskschdtool /plugin_entry=ktaskschdtool.dll /task=wpsexternal /launchtask /ver=1.0 /start_from=task_external_startup
  • WpsUpdateTask_labC:\Users\lab\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wpsupdate.exe -from=task
  • WpsWakeWnsLogonTask"C:\Users\lab\AppData\Local\Kingsoft\WPS Office\\ksolaunch.exe" Run addons/kpluginwrapper/kpluginwrapper.dll run_plugin -plugin_name=kmessagepushcenter -dll_name=kmessagepushcenter wake_wns

After the reboot

Started on its own

  • wps.exe started by wps.exe
  • promecefpluginhost.exe started by wps.exe
  • wpsupdate.exe started by wps.exe
  • ksolaunch.exe started by wpscloudsvr.exe
  • wps.exe started by wps.exe
  • ksomisc.exe started by wps.exe
  • wpscloudsvr.exe started by ksolaunch.exe
  • kwpswnsserver.exe started by wps.exe
  • promecefpluginhost.exe started by wps.exe
  • kwinappinstaller.exe started by wpscloudsvr.exe
  • wps.exe started by wps.exe
  • wpscenter.exe started by wpscloudsvr.exe

Autostart entries

  • scheduled task: WpsExternal_lab_20261027130657C:\Users\lab\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wpscloudsvr.exe /wpscloudlaunch /run_plugin /plugin_name=ktaskschdtool /plugin_entry=ktaskschdtool.dll /task=wpsexternal /launchtask /ver=1.0 /start_from=task_external
  • scheduled task: WpsExternal_lab_intervalC:\Users\lab\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wpscloudsvr.exe /wpscloudlaunch /run_plugin /plugin_name=ktaskschdtool /plugin_entry=ktaskschdtool.dll /task=wpsexternal /launchtask /ver=1.0 /start_from=task_external_interval
  • scheduled task: WpsExternal_lab_startupC:\Users\lab\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wpscloudsvr.exe /wpscloudlaunch /run_plugin /plugin_name=ktaskschdtool /plugin_entry=ktaskschdtool.dll /task=wpsexternal /launchtask /ver=1.0 /start_from=task_external_startup
  • scheduled task: WpsUpdateTask_labC:\Users\lab\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wpsupdate.exe -from=task -source=task
  • scheduled task: WpsWakeWnsLogonTask"C:\Users\lab\AppData\Local\Kingsoft\WPS Office\\ksolaunch.exe" Run addons/kpluginwrapper/kpluginwrapper.dll run_plugin -plugin_name=kmessagepushcenter -dll_name=kmessagepushcenter wake_wns
  • service: MicrosoftCopilotElevationService"C:\Program Files (x86)\Microsoft\Copilot\Application\156.0.4314.42\elevation_service.exe"
  • service: wpscloudsvr"C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService

What it talked to

Destinations

  • 74.125.201.113:443asked by ksomisc.exe50 connections
  • 8.209.65.234:443asked by ksomisc.exe25 connections
  • 98.98.70.67:443asked by wpscloudsvr.exe25 connections
  • 98.98.70.77:443asked by wps.exe20 connections
  • 172.217.214.100:443asked by ksomisc.exe18 connections
  • 34.213.156.79:443asked by wpscloudsvr.exe17 connections
  • 98.98.70.77:443asked by wpscloudsvr.exe17 connections
  • 192.179.17.138:443asked by ksomisc.exe16 connections
  • 74.125.132.102:443asked by ksomisc.exe11 connections
  • 8.211.55.206:443asked by ksomisc.exe11 connections
  • 98.98.70.67:443asked by ksomisc.exe10 connections
  • 34.213.156.79:443asked by wps.exe9 connections
  • 98.98.70.67:443asked by wps.exe9 connections
  • 74.125.201.113:443asked by wpscenter.exe7 connections
  • 111.31.99.17:80asked by ksomisc.exe6 connections
  • 199.245.60.195:443asked by promecefpluginhost.exe6 connections
  • 34.213.156.79:443asked by wpscenter.exe6 connections
  • 52.11.126.7:443asked by ksomisc.exe6 connections
  • 74.125.132.102:443asked by wps.exe6 connections
  • 74.125.201.113:443asked by wps.exe6 connections
  • 172.96.121.180:443asked by promecefpluginhost.exe5 connections
  • 172.96.121.182:443asked by wpscloudsvr.exe5 connections
  • 192.179.17.138:443asked by wps_29162.exe5 connections
  • 216.239.32.181:443asked by promecefpluginhost.exe5 connections
  • 74.125.201.113:443asked by wpscloudsvr.exe5 connections
  • 94.74.80.110:443asked by ksomisc.exe5 connections
  • 98.98.70.69:443asked by wpscloudsvr.exe5 connections
  • 74.125.132.102:443asked by wpscloudsvr.exe4 connections
  • 8.211.55.206:443asked by wps_29162.exe4 connections
  • 8.211.55.206:443asked by wps.exe4 connections
  • 107.151.158.227:443asked by wps.exe3 connections
  • 172.96.121.180:443asked by wpsoffice.exe3 connections
  • 18.236.47.97:443asked by promecefpluginhost.exe3 connections
  • 23.11.33.159:80asked by kwinappinstaller.exe3 connections
  • 40.119.6.228:123asked by wpscloudsvr.exe3 connections
  • 52.43.62.210:443asked by wpsoffice.exe3 connections
  • 74.125.132.102:443asked by wpscenter.exe3 connections
  • 74.125.132.97:443asked by promecefpluginhost.exe3 connections
  • 8.211.55.206:443asked by wpscenter.exe3 connections
  • 111.31.99.17:80asked by wpsupdate.exe2 connections
  • 111.31.99.17:80asked by wpsoffice.exe2 connections
  • 172.217.113.4:443asked by promecefpluginhost.exe2 connections
  • 172.217.116.4:443asked by promecefpluginhost.exe2 connections
  • 172.217.118.4:443asked by promecefpluginhost.exe2 connections
  • 172.217.119.4:443asked by promecefpluginhost.exe2 connections
  • 172.217.214.100:443asked by wpsupdate.exe2 connections
  • 192.179.17.138:443asked by wpsupdate.exe2 connections
  • 192.179.17.138:443asked by wpsoffice.exe2 connections
  • 199.245.60.197:443asked by wps.exe2 connections
  • 216.239.32.181:443asked by promecefpluginhost.exe2 connections
  • 216.239.38.181:443asked by promecefpluginhost.exe2 connections
  • 216.239.38.181:443asked by promecefpluginhost.exe2 connections
  • 23.11.33.159:80asked by wpsupdate.exe2 connections
  • 34.213.156.79:443asked by ksomisc.exe2 connections
  • 44.250.121.250:443asked by promecefpluginhost.exe2 connections
  • 47.254.184.99:443asked by wps_29162.exe2 connections
  • 52.42.28.80:443asked by wpscloudsvr.exe2 connections
  • 74.125.201.113:443asked by wpsupdate.exe2 connections
  • 8.209.65.234:443asked by wps_29162.exe2 connections
  • 8.211.55.206:443asked by wpscloudsvr.exe2 connections
  • 98.98.70.67:443asked by wpsoffice.exe2 connections
  • 111.31.99.17:80asked by wps_29162.exe
  • 142.251.153.119:443asked by promecefpluginhost.exe
  • 142.251.156.119:443asked by promecefpluginhost.exe
  • 142.251.183.97:443asked by promecefpluginhost.exe
  • 142.251.183.97:443asked by promecefpluginhost.exe
  • 155.102.176.87:80asked by wpsupdate.exe
  • 172.217.113.4:443asked by promecefpluginhost.exe
  • 172.217.116.4:443asked by promecefpluginhost.exe
  • 172.217.118.4:443asked by promecefpluginhost.exe
  • 172.217.119.4:443asked by promecefpluginhost.exe
  • 172.96.121.180:443asked by wpscenter.exe
  • 18.236.47.97:443asked by wpscenter.exe
  • 18.236.47.97:443asked by wps.exe
  • 184.29.31.250:443asked by wpscloudsvr.exe
  • 199.245.60.197:443asked by ksomisc.exe
  • 23.15.254.60:443asked by wpscloudsvr.exe
  • 34.214.20.112:443asked by promecefpluginhost.exe
  • 52.10.85.105:443asked by ksomisc.exe
  • 52.10.85.105:443asked by wps.exe
  • 52.11.126.7:443asked by wpscloudsvr.exe
  • 52.42.28.80:443asked by wpsoffice_23196.exe
  • 54.188.171.204:443asked by wpsupdate.exe
  • 64.233.181.154:443asked by promecefpluginhost.exe
  • 74.125.132.97:443asked by promecefpluginhost.exe
  • 74.125.69.157:443asked by promecefpluginhost.exe
  • 8.211.46.156:443asked by promecefpluginhost.exe
  • 94.74.80.110:443asked by wpsoffice.exe
  • 94.74.80.110:443asked by wpsupdate.exe
  • 98.98.70.77:443asked by wpscenter.exe

DNS

  • www.google-analytics.comasked by ksomisc.exe
  • ap-dw-collect.ksord.comasked by ksomisc.exe
  • cloud.wpscdn.comasked by ksomisc.exe
  • entry.wpscdn.comasked by ksomisc.exe
  • www.google-analytics.comasked by wpscenter.exe
  • ap-dw-parameters.ksord.comasked by ksomisc.exe
  • shuc-pc-hunt.ksord.comasked by ksomisc.exe
  • www.google-analytics.comasked by wps.exe
  • 365.kdocs.cnasked by wpscloudsvr.exe
  • ap-dw-collect.ksord.comasked by wps.exe
  • movip.wps.comasked by ksomisc.exe
  • www.google-analytics.comasked by wpscloudsvr.exe
  • ap-dw-collect.ksord.comasked by wpscloudsvr.exe
  • entry.wpscdn.comasked by wps.exe
  • global-static.wpscdn.comasked by wpscloudsvr.exe
  • global.wps.comasked by wps.exe
  • www.google-analytics.comasked by wpsupdate.exe
  • account.wps.cnasked by wpscloudsvr.exe
  • analytics.google.comasked by promecefpluginhost.exe
  • ap-dw-collect.ksord.comasked by wps_29162.exe
  • ap-dw-collect.ksord.comasked by wpscenter.exe
  • api.wps.cnasked by wpscloudsvr.exe
  • avatar.qwps.cnasked by wpscloudsvr.exe
  • docer-api.kdocs.cnasked by wpscloudsvr.exe
  • docer.kdocs.cnasked by wpscloudsvr.exe
  • docer.wps.cnasked by wpscloudsvr.exe
  • drive.wps.cnasked by wpscloudsvr.exe
  • dw-parameters.ksord.comasked by wps_29162.exe
  • firebase.googleapis.comasked by promecefpluginhost.exe
  • firebaseinstallations.googleapis.comasked by promecefpluginhost.exe
  • geo.wps.cnasked by wpscloudsvr.exe
  • global-static.wpscdn.comasked by wps.exe
  • global.wps.comasked by wpscenter.exe
  • home.wps.cnasked by wpscloudsvr.exe
  • hwc-bj.ag.kdocs.cnasked by wpscloudsvr.exe
  • iaas.wps.cnasked by wpscloudsvr.exe
  • kdocs.cnasked by wpscloudsvr.exe
  • ksc-bj.ag.kdocs.cnasked by wpscloudsvr.exe
  • le.wps.cnasked by wpscloudsvr.exe
  • lucky.wps.cnasked by wpscloudsvr.exe
  • pay.wps.cnasked by wpscloudsvr.exe
  • qing.wps.cnasked by wpscloudsvr.exe
  • qr.wps.cnasked by wpscloudsvr.exe
  • roaming.wps.cnasked by wpscloudsvr.exe
  • sms.wps.cnasked by wpscloudsvr.exe
  • stats.g.doubleclick.netasked by promecefpluginhost.exe
  • vaf.wps.cnasked by wpscloudsvr.exe
  • vasapi.wps.cnasked by wpscloudsvr.exe
  • vas.wps.cnasked by wpscloudsvr.exe
  • vipapi.wps.cnasked by wpscloudsvr.exe
  • vip.wps.cnasked by wpscloudsvr.exe
  • wdl1.cache.wps.cnasked by wpscloudsvr.exe
  • wdl1.file.cache.docer.comasked by wpscloudsvr.exe
  • wps-docer-property.file.docer.comasked by wpscloudsvr.exe
  • wps-docer-property.ks3-cn-beijing.ksyun.comasked by wpscloudsvr.exe
  • wps-docer-property.ks3-cn-beijing.ksyuncs.comasked by wpscloudsvr.exe
  • www.google-analytics.comasked by wps_29162.exe
  • www.google.comasked by promecefpluginhost.exe
  • www.googletagmanager.comasked by promecefpluginhost.exe
  • www.kdocs.cnasked by wpscloudsvr.exe
  • zj-roaming.wps.cnasked by wpscloudsvr.exe
  • zt.wps.cnasked by wpscloudsvr.exe
  • zw-roaming.wps.cnasked by wpscloudsvr.exe
  • 365.kdocs.cnasked by promecefpluginhost.exe
  • abroadad.cache.wpscdn.comasked by promecefpluginhost.exe
  • abroadad.cache.wpscdn.comasked by wps.exe
  • abtest-api.wps.comasked by ksomisc.exe
  • account.wps.cnasked by promecefpluginhost.exe
  • ai.wps.comasked by wpscloudsvr.exe
  • aka.msasked by wpscloudsvr.exe
  • ap-dw-parameters.ksord.comasked by wpsupdate.exe
  • ap-dw-parameters.ksord.comasked by wpsoffice.exe
  • api-ad-adapter.wps.comasked by promecefpluginhost.exe
  • api-ad-adapter.wps.comasked by wpscenter.exe
  • api-ad-adapter.wps.comasked by wps.exe
  • api.wps.cnasked by promecefpluginhost.exe
  • api.wps.comasked by wpscloudsvr.exe
  • api.wps.comasked by wpsoffice_23196.exe
  • cacerts.digicert.comasked by kwinappinstaller.exe
  • dl.vas.wpscdn.cnasked by wpscloudsvr.exe
  • dl.vas.wpscdn.cnasked by promecefpluginhost.exe
  • docer-api.kdocs.cnasked by promecefpluginhost.exe
  • docer.kdocs.cnasked by promecefpluginhost.exe
  • docer.wps.cnasked by promecefpluginhost.exe
  • download.microsoft.comasked by wpscloudsvr.exe
  • drive.wps.cnasked by promecefpluginhost.exe
  • ds.cache.wpscdn.comasked by wpscenter.exe
  • ds.cache.wpscdn.comasked by promecefpluginhost.exe
  • dyn.kingsoftstore.comasked by wps.exe
  • dyn.kingsoftstore.comasked by ksomisc.exe
  • entry.wpscdn.comasked by wpsoffice.exe
  • eu-dw-collect.ksord.comasked by wps_29162.exe
  • geo.wps.cnasked by promecefpluginhost.exe
  • global-static.wpscdn.comasked by ksomisc.exe
  • global-static.wpscdn.comasked by wpsoffice.exe
  • global.wps.comasked by wpscloudsvr.exe
  • global.wps.comasked by wpsoffice.exe
  • global.wps.comasked by ksomisc.exe
  • global.wps.comasked by promecefpluginhost.exe
  • home.wps.cnasked by promecefpluginhost.exe
  • iaas.wps.cnasked by promecefpluginhost.exe
  • kdocs.cnasked by promecefpluginhost.exe
  • le.wps.cnasked by promecefpluginhost.exe
  • lucky.wps.cnasked by promecefpluginhost.exe
  • ocsp.digicert.cnasked by wpsupdate.exe
  • ovs-activity.wps.comasked by promecefpluginhost.exe
  • ovs-shopwindow-server.wps.comasked by promecefpluginhost.exe
  • params.wps.comasked by ksomisc.exe
  • params.wps.comasked by wpscloudsvr.exe
  • pay.wps.cnasked by promecefpluginhost.exe
  • qing.wps.cnasked by promecefpluginhost.exe
  • qr.wps.cnasked by promecefpluginhost.exe
  • roaming.wps.cnasked by promecefpluginhost.exe
  • shuc-pc-hunt.ksord.comasked by wpsupdate.exe
  • shuc-pc-hunt.ksord.comasked by wps_29162.exe
  • shuc-pc-hunt.ksord.comasked by wpsoffice.exe
  • sms.wps.cnasked by promecefpluginhost.exe
  • status.rapidssl.comasked by wpsupdate.exe
  • update.kingsoftstore.comasked by wpsupdate.exe
  • vaf.wps.cnasked by promecefpluginhost.exe
  • vasapi.wps.cnasked by promecefpluginhost.exe
  • vas.wps.cnasked by promecefpluginhost.exe
  • vipapi.wps.cnasked by promecefpluginhost.exe
  • vip.wps.cnasked by promecefpluginhost.exe
  • wdl1.pcfg.cache.wpscdn.comasked by wpscloudsvr.exe
  • wdl1.pcfg.cache.wpscdn.comasked by wps.exe
  • wdl1.pcfg.cache.wpscdn.comasked by wpscenter.exe
  • wps-docer-property.file.docer.comasked by promecefpluginhost.exe
  • wps-docer-property.ks3-cn-beijing.ksyun.comasked by promecefpluginhost.exe
  • wps-docer-property.ks3-cn-beijing.ksyuncs.comasked by promecefpluginhost.exe
  • www.google-analytics.comasked by wpsoffice.exe
  • www.kdocs.cnasked by promecefpluginhost.exe
  • zj-roaming.wps.cnasked by promecefpluginhost.exe
  • zt.wps.cnasked by promecefpluginhost.exe
  • zw-roaming.wps.cnasked by promecefpluginhost.exe