FPSpy is a Windows backdoor used by Sparkling Pisces, also known as Kimsuky, and observed since at least 2022. The analyzed DLL is named sys.dll, exports MazeFunc, and is dropped by a custom loader into a WPSOffice directory. It stores configuration and system-survey data in local files, enumerates drives, folders, and files with PowerShell, executes arbitrary commands, and downloads and runs encrypted modules. Separate threads handle module retrieval and data upload to command-and-control infrastructure. Its naming conventions, logs, and capabilities resemble the group’s KGHSpy backdoor, and its compilation timestamp may have been falsified.