File name:

FyPluginSetup.v1.0.0.8.exe

Full analysis: https://app.any.run/tasks/70d12ba9-7e96-4a88-ab32-95dc925472b5
Verdict: Malicious activity
Analysis date: February 26, 2025, 15:06:38
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

1DF9D3507AA374DC5A19039F422963B3

SHA1:

22E9723362C8023CED673408AD7BB6664E17A210

SHA256:

493328947220DF8601332DABB4397AA36AD360DD423B3084DB6C5F20F1F2EE24

SSDEEP:

49152:SKvds9h4Viyo/W30jzIMR3y7IPMwHPK7rpKkHplYuUYZZLhA+c0Wu8/HmV9yAJUV:SKu8Viyo/W0TEIu7rpKINUY3dA3u8/Ge

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • FyPluginSetup.v1.0.0.8.exe (PID: 4172)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • FyPluginSetup.v1.0.0.8.exe (PID: 4172)

    • Creates a software uninstall entry

      • FyPluginSetup.v1.0.0.8.exe (PID: 4172)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 1616)

  • INFO

    • Checks supported languages

      • FyPluginSetup.v1.0.0.8.exe (PID: 4172)

    • The sample compiled with chinese language support

      • FyPluginSetup.v1.0.0.8.exe (PID: 4172)

    • Creates files or folders in the user directory

      • FyPluginSetup.v1.0.0.8.exe (PID: 4172)

    • Checks proxy server information

      • slui.exe (PID: 7952)

    • Reads the software policy settings

      • slui.exe (PID: 7952)
      • slui.exe (PID: 864)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2015:12:11 07:12:34+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 23552
InitializedDataSize: 263680
UninitializedDataSize: 8192
EntryPoint: 0x30de
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.8
ProductVersionNumber: 1.0.0.8
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Windows, Chinese (Simplified)
CompanyName: 深圳风月科技有限公司
FileDescription: fygameplugin
FileVersion: 1.0.0.8
InternalName: fygameplugin
LegalCopyright: 深圳风月科技有限公司
OriginalFileName: fygameplugin
ProductName: fygameplugin
ProductVersion: 1.0.0.8
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
205
Monitored processes
6
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start fypluginsetup.v1.0.0.8.exe regsvr32.exe no specs sppextcomobj.exe no specs slui.exe rundll32.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
864"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1616regsvr32 /s /n /i:--lang=cn--user=true "C:\Users\admin\AppData\Roaming\fyplugin\FyGamePluginIE.dll"C:\Windows\SysWOW64\regsvr32.exe—FyPluginSetup.v1.0.0.8.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
4172"C:\Users\admin\AppData\Local\Temp\FyPluginSetup.v1.0.0.8.exe" C:\Users\admin\AppData\Local\Temp\FyPluginSetup.v1.0.0.8.exe
explorer.exe
User:
admin
Company:
深圳风月科技有限公司
Integrity Level:
MEDIUM
Description:
fygameplugin
Exit code:
0
Version:
1.0.0.8
Modules
Images
c:\users\admin\appdata\local\temp\fypluginsetup.v1.0.0.8.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5800C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
6436C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7952C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
1 286
Read events
1 275
Write events
11
Delete events
0

Modification events

(PID) Process:(1616) regsvr32.exeKey:HKEY_CURRENT_USER\SOFTWARE\fygame
Operation:writeName:lang
Value:
cn
(PID) Process:(1616) regsvr32.exeKey:HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{7D1D314E-19D7-432A-9743-2F6EF43029AA}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(1616) regsvr32.exeKey:HKEY_CLASSES_ROOT\WOW6432Node\Interface\{454E1DB0-7BC9-4BD1-A3AB-6A00AAFAA06F}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(1616) regsvr32.exeKey:HKEY_CLASSES_ROOT\Interface\{454E1DB0-7BC9-4BD1-A3AB-6A00AAFAA06F}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(1616) regsvr32.exeKey:HKEY_CLASSES_ROOT\WOW6432Node\Interface\{EE95A3A1-587A-4D7E-81B8-AFC3D764963A}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(1616) regsvr32.exeKey:HKEY_CLASSES_ROOT\Interface\{EE95A3A1-587A-4D7E-81B8-AFC3D764963A}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(4172) FyPluginSetup.v1.0.0.8.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fygameplugin
Operation:writeName:DisplayName
Value:
fygameplugin 1.0.0.8
(PID) Process:(4172) FyPluginSetup.v1.0.0.8.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fygameplugin
Operation:writeName:UninstallString
Value:
C:\Users\admin\AppData\Roaming\fyplugin\uninst.exe
(PID) Process:(4172) FyPluginSetup.v1.0.0.8.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fygameplugin
Operation:writeName:DisplayVersion
Value:
1.0.0.8
(PID) Process:(4172) FyPluginSetup.v1.0.0.8.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fygameplugin
Operation:writeName:Publisher
Value:
ÉîÛÚ·çÔ¿Ƽ¼ÓÐÏÞ¹«Ë¾
Executable files
3
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
4172FyPluginSetup.v1.0.0.8.exeC:\Users\admin\AppData\Roaming\fyplugin\FyGamePluginIE.dllexecutable
MD5:18AA5A5E73CED186EF33B03FE74EE8BD
SHA256:A6C4BEEEA6959B2BF08B21A6A5D701CEC58C0BB2E1292A200BF247D2FCCF6B02
4172FyPluginSetup.v1.0.0.8.exeC:\Users\admin\AppData\Roaming\fyplugin\uninst.exeexecutable
MD5:AE32E57A42B7EB37624BB980CDEEB468
SHA256:6E4344B8A0811539EBB36C48579689099BB6CF6A1045427E46E78CD449ED2A06
4172FyPluginSetup.v1.0.0.8.exeC:\Users\admin\AppData\Roaming\fyplugin\npfygameplugin.dllexecutable
MD5:597B52E3D62806388C58584BA8F50FF3
SHA256:13C0949B3599D453D721A7EC02C43EBC898DC4B709C0D61DE1EE4505344A7DB4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
51
TCP/UDP connections
78
DNS requests
78
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2152
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
2152
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4944
svchost.exe
HEAD
200
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/68591036-2289-4858-9f7f-9149e89c8a08?P1=1741005477&P2=404&P3=2&P4=ON%2bx7uUKdpj8Q74wSPvz%2fQTtpfuIpBglxxN0nUza8cqcK8TI93ITj8xE82KmKyOLgxe5HbJpvuL5U3Vy7xMLIA%3d%3d
unknown
—
—
whitelisted
4944
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/68591036-2289-4858-9f7f-9149e89c8a08?P1=1741005477&P2=404&P3=2&P4=ON%2bx7uUKdpj8Q74wSPvz%2fQTtpfuIpBglxxN0nUza8cqcK8TI93ITj8xE82KmKyOLgxe5HbJpvuL5U3Vy7xMLIA%3d%3d
unknown
—
—
whitelisted
4944
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/68591036-2289-4858-9f7f-9149e89c8a08?P1=1741005477&P2=404&P3=2&P4=ON%2bx7uUKdpj8Q74wSPvz%2fQTtpfuIpBglxxN0nUza8cqcK8TI93ITj8xE82KmKyOLgxe5HbJpvuL5U3Vy7xMLIA%3d%3d
unknown
—
—
whitelisted
4944
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/68591036-2289-4858-9f7f-9149e89c8a08?P1=1741005477&P2=404&P3=2&P4=ON%2bx7uUKdpj8Q74wSPvz%2fQTtpfuIpBglxxN0nUza8cqcK8TI93ITj8xE82KmKyOLgxe5HbJpvuL5U3Vy7xMLIA%3d%3d
unknown
—
—
whitelisted
4944
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/68591036-2289-4858-9f7f-9149e89c8a08?P1=1741005477&P2=404&P3=2&P4=ON%2bx7uUKdpj8Q74wSPvz%2fQTtpfuIpBglxxN0nUza8cqcK8TI93ITj8xE82KmKyOLgxe5HbJpvuL5U3Vy7xMLIA%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3008
backgroundTaskHost.exe
2.23.227.215:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
2040
backgroundTaskHost.exe
20.223.36.55:443
fd.api.iris.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2152
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2152
SIHClient.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.238
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
login.live.com
  • 40.126.32.72
  • 40.126.32.140
  • 20.190.160.22
  • 20.190.160.2
  • 40.126.32.68
  • 20.190.160.4
  • 20.190.160.128
  • 40.126.32.74
whitelisted
client.wns.windows.com
  • 40.113.110.67
  • 40.115.3.253
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
  • 184.86.251.16
  • 184.86.251.15
  • 184.86.251.14
  • 184.86.251.12
  • 184.86.251.13
  • 184.86.251.20
  • 184.86.251.10
  • 184.86.251.18
  • 184.86.251.11
whitelisted
fd.api.iris.microsoft.com
  • 20.223.36.55
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
th.bing.com
  • 2.23.227.208
  • 2.23.227.215
  • 23.15.178.226
  • 23.15.178.192
  • 23.15.178.216
  • 23.15.178.203
  • 23.15.178.201
  • 23.15.178.219
  • 23.15.178.200
  • 23.15.178.208
  • 23.15.178.187
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
FyPluginSetup.v1.0.0.8.exe