home

fpplus.exe

ZGW Software

This is a self-extracting archive and installer. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
Publisher:
ZGW Software

Description:
FlashPlayer Plus Setup

MD5:
94d1ab8454a715ae6f747827d0feb081

SHA-1:
8909937da3c0121cb07d25a3a65ed125d48c879a

SHA-256:
c580a781702f356a3d60c627dfed745b78a38318db8579b122b3503de87ed4c4

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/2/2024 11:29:20 AM UTC  (today)

File size:
3.4 MB (3,561,439 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\fpplus.exe

File PE Metadata
Compilation timestamp:
6/20/1992 1:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
98304:AGXDXlYv5vFQYzEH9iwct4luDUN7gztIzMaZSY9AKl:Ae2v5vFT6iwciYDscNavdl

Entry address:
0x9424

Entry point:
55, 8B, EC, 83, C4, B8, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, BC, 89, 45, B8, E8, 9F, 9C, FF, FF, E8, D6, AE, FF, FF, E8, 19, D1, FF, FF, E8, 60, D1, FF, FF, E8, DF, F5, FF, FF, BE, C4, BD, 40, 00, 33, C0, 55, 68, E3, 9A, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 94, 9A, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, B0, 40, 00, E8, EC, FE, FF, FF, E8, 9F, F9, FF, FF, 8D, 55, F0, 33, C0, E8, F9, D4, FF, FF, 8B, 55, F0, B8, B8, BD, 40, 00, E8, 50, 9D, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, B8, BD, 40, 00...
 
[+]

Entropy:
7.9958

Developed / compiled with:
Microsoft Visual C++

Code size:
35 KB (35,840 bytes)

The file fpplus.exe has been seen being distributed by the following 12 URLs.

http://gsf-cf.softonic.com/890/993/.../file?SD_used=0&channel=WEB&fdh=no&id_file=40710&instance=softonic_en&type=PROGRAM&Expires=1487225304&Signature=dcCuZHxxP0NPLgFRrOaZ1Z2n3qsrVJB4waBKi0NCqZE0dcMc~53DxYPtw94O2rwybQKOIPZHJ7p2nHuPAbmxcW93VDKH262Bt1bdwCj2N0u6MSwvLWcVE5kzWyyxlSxgVoJ7xRsTROur1rWX3b6YG1U2QeQ8XMvJaC4JV-AqbEM_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=fpplus.exe

http://gsf-cf.softonic.com/890/993/.../file?SD_used=0&channel=WEB&fdh=no&id_file=40710&instance=softonic_en&type=PROGRAM&Expires=1477817134&Signature=AYXtYHzFgllstwJxaj1aUtGNkuLw~DhergbNxkLmB3zTlaCFhZDZxqGM3AG5xzXCY-v5fJxIbAD61EbySvaDkcqfWyghG1XAJU~dUT7Y~SJUR5qGFJe7JbRV44EJn5zjFgY4BRpQxs2hs3iXpeDC0ZtY4zB~bLkBmjGGD8V0dyc_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=fpplus.exe

http://files.downloadnow-3.com/s/software/10/38/84/.../fpplus.exe

http://gsf-cf.softonic.com/890/993/.../file?SD_used=0&channel=WEB&fdh=no&id_file=40710&instance=softonic_en&type=PROGRAM&Expires=1466856191&Signature=NoA9yto7pL2AwbXuZZrLl~pR-DWwsj2jR0Qt17j-R5t-P0WRw1Zm8SnlgQQqFVkcb-LIVRhPCG0hIa7Sdb8Fw4sj1-mYf3HHq-MY7gfyooK5LfbtWR-K2DmtpdL3bzWBhkh~RukRPiz3yrrs7fKPvwBoadZoXMAQ~NMaFoFNoyU_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=fpplus.exe

http://gsf-cf.softonic.com/890/993/.../file?SD_used=0&channel=WEB&fdh=no&id_file=40710&instance=softonic_en&type=PROGRAM&Expires=1461797365&Signature=Vn1IFEE3sB5VqxpSAiG3W7egX69oWWaav0Z2~LKFa6RKVrFLHY8eDFriWLVRGQV~ivzpvX3huQuxDWoGGKZq8RKae8ow4P9T1sdaAXKXnxxDpnZGy0-LTcMBzcxzPJpKhlPe0UQoUhe0K1sCNADsCfs4QQvxvogEylevNd2tfpE_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=fpplus.exe

http://gsf-cf.softonic.com/890/993/.../file?SD_used=0&channel=WEB&fdh=no&id_file=40710&instance=softonic_en&type=PROGRAM&Expires=1455415513&Signature=UXC-X9tJreL0aO8JeqDSIPfUOzCPxqp~F~EIqkbDMi0d94MqLmDnPeELl3tSQ-VqS71O1fMzA0edZgN6KNJ8mhtnbuTn93MV7qt8puAPZSxXoNf-P8aeDOBsE-o6bXdd2UMWNJR3f936FZ6ZOkzozehpE5KEJIHMVCK8Urno-jU_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=fpplus.exe

http://gsf-cf.softonic.com/890/993/.../file?SD_used=0&channel=WEB&fdh=no&id_file=40710&instance=softonic_en&type=PROGRAM&Expires=1459101708&Signature=MZdoFNVOysIIhxJBeu1rXDQ1GDB0w1XIP6VvQoPWizGWA4lM7In3Whl4z90HscxrDNRxwplSEL8HOm2ycsjP4GtS2BOGgd987MmmDvk9RBM23l7HrQSQ10PWMfYzzb2rquuVZIoKPviGOLZvQ2WFiLZGIBASw-KKaJG2jPaNYEk_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=fpplus.exe

http://gsf-cf.softonic.com/890/993/.../file?SD_used=0&channel=WEB&fdh=no&id_file=40710&instance=softonic_fr&type=PROGRAM&Expires=1454750161&Signature=UxPyL2sIye1fgHRpYZXYuxPJvtbHgAwyOvxL44ZKvk2fOeBhP7V-o5IYoHmlR0OojlmMqjEYNA3KHjglbJJQC0v4Ggr8v9Q3sqT05Ypdr5OvtajlnOHz38YTWY4ZC9sg3bIea3GGd511GsvqvX5LEXAPI4G~sBk4uw44JEMVcNo_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=fpplus.exe

http://gsf-cf.softonic.com/890/993/.../file?SD_used=0&channel=WEB&fdh=no&id_file=40710&instance=softonic_en&type=PROGRAM&Expires=1456539851&Signature=ENQEEQxYd58EgQjshIdZosvmKQP6UWhnss-wDrLe2~CdG15wcuRABBOY4qwFhfXU-M70m-InC-7o5BU6305ukFI5MFHWEkOwX-OXQBzd5YW8JodanCaZ5BG2jODNUdbRibJm-SP4AWWJW7R5Cwmp0Er36DTzWTMjPBZWVXE9Gy4_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=fpplus.exe

http://gsf-cf.softonic.com/890/993/.../file?SD_used=0&channel=WEB&fdh=no&id_file=40710&instance=softonic_en&type=PROGRAM&Expires=1450173639&Signature=QXAuZGxApyk~A8-hQEfIl~YzuLkAg3y-ZHbsH7OQWSw88IaqFNzkRgAk~~QxHIjRV~FoJRSv~5XnuQLfIcouCq-ZQbnmClH-grNOh1wRuQdyAgLz3tBb6k3o~CYSiburgQt6fx9qmyIpeE~dTEMhF7LXqTuGXhetOVIXSnZLcZA_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=fpplus.exe

http://gsf-cf.softonic.com/890/993/.../file?SD_used=0&channel=WEB&fdh=no&id_file=40710&instance=softonic_es&type=PROGRAM&Expires=1455436850&Signature=awXHEpP5YfHBfq~6c82W0U1hc1IIlajWnYHZpzDSeo8J~X9FFOtxwF8X~kCkvwY0ueQEbryWdkc4rN-AUPJjEYKlUGyc6TTfNxswt-QS3UJDz-wxuQX6XaP1Ph0RlNmcK5QdTvDJrsvI0r3s2LwO7IiXbI-Nk4IXznVJlOsY4uo_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=fpplus.exe

http://software-files-a.cnet.com/s/software/10/38/84/.../fpplus.exe

Scan fpplus.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.