75fab6f6fd5bf7ace2d2330c127f074d9be735d746b44ebafc847d96a7c025eb | Triage™

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Femboy Hunter.exe
Size 198.2MB
Sample260727-wtaaaayakb
SHA256 75fab6f6fd5bf7ace2d2330c127f074d9be735d746b44ebafc847d96a7c025eb
MD5 05989fcc1785d10336aceef6c7d4f901
SHA1 55f1149cc25b09f8382a7336ccc0e90be21f1337
SHA512 689bc731d24b881ce00f4b589630b2cc1a54e5f353cb186599770a685bb9651ce4c40d5746658485499bf09d24790b07b62485c58c8b0726406eb683f19cd3ce
SSDEEP 3145728:7cXIOlpRLeHOD7KoE2q9Ns+tNxWIjQnSBXD6QCUyXwit53sQyAeW8:lOlpRKHO3Kozq9N/xWW5YQYXHsQyAX8
TLSH
T14FA8BF53E27370ECC467C13092DBA633FA73BC5951386E6AD6A4DB742F21E506329E24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	Femboy Hunter.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2980	Femboy Hunter.exe
2980	Femboy Hunter.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2980	Femboy Hunter.exe
2980	Femboy Hunter.exe
2980	Femboy Hunter.exe

C:\Users\Admin\AppData\Local\Temp\Femboy Hunter.exe
"C:\Users\Admin\AppData\Local\Temp\Femboy Hunter.exe"
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

funplay_mcp_runtime_bridge.json

Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
Size 43KB
SHA256 0cc6a4d83d9938a1961d5b159152f01cfd2848bbcf760e38301343ac51af8bb2
MD5 c6635706c94b46762e24035ee7139fed
SHA1 1d38c7e8a60145d249976d543f5efcd7dde33e26
SHA512 22017cbb92ff3c670cb17becd70b040d9cc192f14c68848e379098839ed03d6d37863d9bbe440adff526aad5e05bfad4161348a404c9ecaf83840759ad52a17a
SSDEEP 768:WDMltlwlTlilvlclsl9lSlplwlTl7lulVl1l4lzlil5l1lN4lRjlXlwclFUlplGU:WDMb+lwZCmLoHCBlsnfGNIDHH4Lj9qcy
TLSH
T12A13C987EB2C6DF3FE086A5C142C94C78D2C2B3586B45CFAF641A835C58C5690BB3796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

funplay_mcp_runtime_bridge.json

Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
Size 43KB
SHA256 43dfbea9fa1549d67f1769ed8e5dea2605474ba65f5c5ae95ca52bc6afb4d209
MD5 1e897cc26dbfe61f02533fe8059abaef
SHA1 ff3d5a65c4e37eb88d34b93359c84221a2784ad2
SHA512 c078a09ef603b140301501dc65ba36d39cf48251e1d225f5503e1a82f8908e20328b70ac56776c4a53d1ee9e29ad61291a93671390743978ad512faff1a4cc72
SSDEEP 768:W2MltlwlTlilvlclsl9lSlplwlTl7lulVl1l4lzlil5l1lN4lRjlXlwclFUlplGO:W2Mb+lwZCmLoHCBlsnfGNIDHH4Lj9qco
TLSH
T17C13C987EB2C6DF3FE086A5C142C94C78D2C2B3586B45CFAF641A835C58C5690BB3796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

funplay_mcp_runtime_bridge.json

Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
Size 43KB
SHA256 c6056bce48201828123d0ef36de35c21faeda4bb921f6fa4b1a81822200c884e
MD5 51045b3d8cf2fb844f2b4aa7c56543ef
SHA1 260432ab225e557b50a27e1d83ca157d86dce345
SHA512 8e7da32db045ea2dadf41e0281e413efc59f324815789d03e3082c12830e33179041c6f10c2f2e7aab7f691ee1f8d7999da79bb5ca3519a5ea843c01e4b6a426
SSDEEP 768:WwMltlwlTlilvlclsl9lSlplwlTl7lulVl1l4lzlil5l1lN4lRjlXlwclFUlplGJ:WwMb+lwZCmLoHCBlsnfGNIDHH4Lj9qcz
TLSH
T10313C987EB2C6DF3FE086A5C142C94C78D2C2B3586B45CFAF641A835C58C5690BB3796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

funplay_mcp_runtime_bridge.json

Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
Size 43KB
SHA256 33f701ff8633e73c81b421f7c622fb39ef3f7e7848d209820f85e338eed47c94
MD5 01c7a6e4da26643d1c3c808578d7e215
SHA1 e55eae71a7374ce2aaf93a3d2b3d0c5fbec76029
SHA512 18c031d4790ddfd7757a5b4a521e72e71e766fcae697e9841c1df4aa3fc699e1eea3f0a7ca756e1d7801849ba6a372b971c86dc2b9992bdeae631cc24721b876
SSDEEP 768:WcMltlwlTlilvlclsl9lSlplwlTl7lulVl1l4lzlil5l1lN4lRjlXlwclFUlplG1:WcMb+lwZCmLoHCBlsnfGNIDHH4Lj9qcj
TLSH
T16B13C987EB2C6DF3FE086A5C142C94C78D2C2B3586B45CFAF641A835C58C5690BB3796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

funplay_mcp_runtime_bridge.json

Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
Size 43KB
SHA256 62f8230233ebf77407c30d781492857eab2c2b1f2df75b7774c4d3d01fd1aba1
MD5 296a143df72e1698bf7d89f3d6033a3f
SHA1 afbaaa0e08be563e5468277119135a2e631dc2d5
SHA512 d35d2fefa84c28257e47ba125cd4d3bcb2fff9bce11f3d9a3441c3637c251629f8027c0b52a87df7bd874c5ba09e2e9ad4b8a0b77aec16aaf9765202bb7cd2cb
SSDEEP 768:WAMltlwlTlilvlclsl9lSlplwlTl7lulVl1l4lzlil5l1lN4lRjlXlwclFUlplGr:WAMb+lwZCmLoHCBlsnfGNIDHH4Lj9qct
TLSH
T12E13C987EB2C6DF3FE086A5C142C94C78D2C2B3586B45CFAF641A835C58C5690BB3796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

funplay_mcp_runtime_bridge.json

Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
Size 43KB
SHA256 e4f75145cb0429c92f3135e836fe25009b52ac8ad8bbaf04905faf7a874dc1d7
MD5 b1fa968f94cd538e383d1abadee152c4
SHA1 8270eea2bc245b190ab65c891f462d32a29fa8de
SHA512 7f6de10cfa7d295fab219e26385cc334cf187bc4e95acaac7615de3c149ccc200fce27aa5c93f656a4a58b2f15c5d3dbd60e6b58bbaad4fb127ed6201315375d
SSDEEP 768:W2MltlwlTlilvlclsl9lSlplwlTl7lulVl1l4lzlil5l1lN4lRjlXlwclFUlplGK:W2Mb+lwZCmLoHCBlsnfGNIDHH4Lj9qc8
TLSH
T11F13C987EB2C6DF3FE086A5C142C94C78D2C2B3586B45CFAF641A835C58C5690BB3796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

funplay_mcp_runtime_bridge.json

Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
Size 43KB
SHA256 b5c4cc6c8e679e3b45d550b9d14780d7f5011f5c93ab8b8e6099ca2bcec60455
MD5 a1051ae14bf3534497b57895c661921a
SHA1 c2879a56e86017afc8de6aaa74aee4b4e2e3f7de
SHA512 b1347dcd49ac3c0d51347f2f996040f799258ff4e69f58f9c4528325af518d57b0de90348f33903d50027a37e2204b06ce00b17d63400eba2a4c06a8540216c9
SSDEEP 768:WXMltlwlTlilvlclsl9lSlplwlTl7lulVl1l4lzlil5l1lN4lRjlXlwclFUlplGe:WXMb+lwZCmLoHCBlsnfGNIDHH4Lj9qcY
TLSH
T19D13C987EB2C6DF3FE086A5C142C94C78D2C2B3586B45CFAF641A835C58C5690BB3796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

funplay_mcp_runtime_bridge.json

Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
Size 43KB
SHA256 a62a19599af730ca6ba1e3c83851e7286f529015b81290136f147991225b1a14
MD5 2a40060c9f075a084e5502c15a93643a
SHA1 767f8356b50cb6c466ceab479a489f23ba53d24e
SHA512 59600d6e2712fc950f904f2caad020fdb55934351bc279a284893ff2c8d46498ca09d5c29df562f8261b3b1b1644c25eedea37dc674759b4b341ea8bb71ea370
SSDEEP 768:WTMltlwlTlilvlclsl9lSlplwlTl7lulVl1l4lzlil5l1lN4lRjlXlwclFUlplG9:WTMb+lwZCmLoHCBlsnfGNIDHH4Lj9qcf
TLSH
T10313C987EB2C6DF3FE086A5C142C94C78D2C2B3586B45CFAF641A835C58C5690BB3796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

funplay_mcp_runtime_bridge.json

Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
Size 43KB
SHA256 9de6a00cfeab1f70f10330c249a559837488d815d6db33b048b61a553e7bedd5
MD5 82c75fad742099a37cbadc1e3e2ed334
SHA1 96b933ee7d37812ef121383c2cba6251cc04a2b5
SHA512 843f079469a3e8e8a698fef4dbad3a09997aaa4397f3f16716202f8ce505c64a81a65334fde0820cae9cd293be520c1f00f5d77421e711738c875082299c8d91
SSDEEP 768:WNMltlwlTlilvlclsl9lSlplwlTl7lulVl1l4lzlil5l1lN4lRjlXlwclFUlplGF:WNMb+lwZCmLoHCBlsnfGNIDHH4Lj9qcT
TLSH
T1ED13C987EB2C6DF3FE086A5C142C94C78D2C2B3586B45CFAF641A835C58C5690BB3796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

funplay_mcp_runtime_bridge.json

Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
Size 43KB
SHA256 e75fc97495a3c9c5ca9e42e1f6194cb682407f12a2e51c4a7749783826d003e6
MD5 9811ab0899ed3100f8fa0b8bdb67f4e2
SHA1 85620c2884299f02ce521add1bebf3ebc17a8e91
SHA512 d9c1eda15e195aa109b561bc8470276fa9e9e6e14209d4cdc7920d45b4a77ec88e3012a991c0da2e36e9b199019a1199193d08fee0c2ab2cd20aefeddd50be3f
SSDEEP 768:WBMltlwlTlilvlclsl9lSlplwlTl7lulVl1l4lzlil5l1lN4lRjlXlwclFUlplGU:WBMb+lwZCmLoHCBlsnfGNIDHH4Lj9qcG
TLSH
T1C313C987EB2C6DF3FE086A5C142C94C78D2C2B3586B45CFAF641A835C58C5690BB3796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

funplay_mcp_runtime_bridge.json

Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
Size 43KB
SHA256 3ca3eeafa4bf4da4cb326aefefc296010c5248793552c25f65457ac3dd0d917f
MD5 2623337d3058ceb7e08c018157208770
SHA1 96a49a839241abc115c434c1dc3fab5d81cb6e71
SHA512 1e8a4857f34160d2ceedc289df48a79e440c5a8634459b832d59d943d221c9b5106c9514257a00dc0069792e452086bb14da4a740f247d1601c4aabe33286ce2
SSDEEP 768:WGMltlwlTlilvlclsl9lSlplwlTl7lulVl1l4lzlil5l1lN4lRjlXlwclFUlplGY:WGMb+lwZCmLoHCBlsnfGNIDHH4Lj9qcq
TLSH
T14F13C987EB2C6DF3FE086A5C142C94C78D2C2B3586B45CFAF641A835C58C5690BB3796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

funplay_mcp_runtime_bridge.json

Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
Size 43KB
SHA256 b43c4716cc2c17c7c55ba2e07a4f189208c5a24e358c93b441a705b8a5cc5f52
MD5 becff762143b653deb0983c8686b78af
SHA1 96debb7f36e5e1fd46b7649e6dc66ce9a97796a3
SHA512 b33db148a8a5349813298e9e947fa0e4b439e36078b21bbf2b122b7fcd9a0cd223e622477d126716808421d9defb32f659153d6ff3c6866bbe698c868b2ce54e
SSDEEP 768:WcMltlwlTlilvlclsl9lSlplwlTl7lulVl1l4lzlil5l1lN4lRjlXlwclFUlplGF:WcMb+lwZCmLoHCBlsnfGNIDHH4Lj9qcH
TLSH
T1E413C987EB2C6DF3FE086A5C142C94C78D2C2B3586B45CFAF641A835C58C5690BB3796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

funplay_mcp_runtime_bridge.json

Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
Size 43KB
SHA256 a819adfcb5d88706c0cf89ad61f9bb7effcc3f4b20812c2fa37cf694a7711c40
MD5 b867cf11d204b5e2fc6095bcb2b556ee
SHA1 6252f7a094aefaa720ca844babce9f67401ffd47
SHA512 71390d91a762f55d0625dfcb275d044a97e72cb99a7dae5b19e74aa3d427912337b9f9123dc2934edea9937de1be9081d673b24909c09cc0bce0def076569b0e
SSDEEP 768:WPMltlwlTlilvlclsl9lSlplwlTl7lulVl1l4lzlil5l1lN4lRjlXlwclFUlplGw:WPMb+lwZCmLoHCBlsnfGNIDHH4Lj9qcW
TLSH
T19E13C987EB2C6DF3FE086A5C142C94C78D2C2B3586B45CFAF641A835C58C5690BB3796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

funplay_mcp_runtime_bridge.json

Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
Size 43KB
SHA256 382e4921b74362e1f72f0d582f545c92f6f3b7503fbdfddfe991f81de7557083
MD5 a0ebda25edd402f6698ec968cdd49ed7
SHA1 297e9f7bb59ba814efb46cb6a4c0cc5fd523a40f
SHA512 0ed2f3ad3cc09307ed3c9ede3188d13baeee3d1496c2d7b821c10428ef64182287a1512471c4b84edf2fc685e7f3f9e4d5a661c2070cb1ceace1668ca39f41c6
SSDEEP 768:WeMltlwlTlilvlclsl9lSlplwlTl7lulVl1l4lzlil5l1lN4lRjlXlwclFUlplGL:WeMb+lwZCmLoHCBlsnfGNIDHH4Lj9qcV
TLSH
T17913C987EB2C6DF3FE086A5C142C94C78D2C2B3586B45CFAF641A835C58C5690BB3796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

funplay_mcp_runtime_bridge.json

Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
Size 43KB
SHA256 f2097f5c3e2407baef9048b647ecb01ab79717b44ee60b3d7089b36d2c1aa8b3
MD5 24139b3bcbca07be7d9867e68860d9b5
SHA1 7c564c7b0de49efb691c0cde23e086d855146d2e
SHA512 5ca9afedc84d5818fa61724d723f1da0c5bbc04f61fa32e8f68d7749eaf6e81596e9ac49ac4794e7443417f34e39479942209a242b0ab72cf8ee19134972a3d3
SSDEEP 768:WiMltlwlTlilvlclsl9lSlplwlTl7lulVl1l4lzlil5l1lN4lRjlXlwclFUlplGZ:WiMb+lwZCmLoHCBlsnfGNIDHH4Lj9qcj
TLSH
T15313C987EB2C6DF3FE086A5C142C94C78D2C2B3586B45CFAF641A835C58C5690BB3796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

funplay_mcp_runtime_bridge.json

Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
Size 36KB
SHA256 2d5c39b97d21b5705e9a4a201cd747cc071d76eb7ce5b59b71d99c42909c6e17
MD5 4af223bbe7b2bd9a5460ae40ddd3fb27
SHA1 85ce12f5c4c1e838f8e49982d4b1948edd0ed91c
SHA512 574bfce16f248070cccb12277ad1ba8824716ed05b1cbbb26a2c13db286cb30c89c61901402a0dcd83a1d309fefae1c836f7561e865b5151c772ea8466d585df
SSDEEP 192:WkE/oDTYfLDj51x8ZFf4m2286X8oUuODc:WkERLN4Ffrz
TLSH
T1E203CE87C76C7CF7DE583E5C182CA1C79D2C263684B4ACFBF9025826C98C56506B67E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

funplay_mcp_runtime_bridge.json

Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
Size 36KB
SHA256 4953f0431e99ebb698fe897c71b1b0638acbe26768ec2e4b18731375be869308
MD5 4f16037351d165e89dcbea3b3f627fa6
SHA1 9d280409e2f4756650b254ea4d2c9cb216907c6e
SHA512 767ea54ceedbc0f9d264c8e6fdc75d04b3567b4125e6d9a1abf189f82d1ec20a56659d81ba8d7d52be70025904528f76bc9d630f98a17ddd8ba8652cc202cbfc
SSDEEP 192:W1E/oDTYfLDj51x8ZFf4m2286X8oUuODC:W1ERLN4FfrB
TLSH
T1C003CE87C76C7CF7DE583E5C182CA1C79D2C263684B4ACFBF9025826C98C56506B67E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

funplay_mcp_runtime_bridge.json

Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
Size 36KB
SHA256 7b5b0e1465cf1186e3f50eef56be1a4caef099344c062f19968d7332ec8df4d5
MD5 5f91e459fe16e3fbe984587d365ee602
SHA1 c6a398f633c19ac429cfad26a520b768e4e5a32e
SHA512 ff3c7947e375b09e4e4ef823649a8b433276d6388c949e4c3c0c4256baa48ebcc62a0a3245a661e32963808d168fa4b9d552400f6844879c71aa949c82af9855
SSDEEP 192:WrE/oDTYfLDj51x8ZFf4m2286X8oUuODX:WrERLN4Ffrc
TLSH
T1CE03CE87C76C7CF7DE583E5C182CA1C79D2C263684B4ACFBF9025826C98C56506B67E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.cfg

Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\settings.cfg
Size 51B
SHA256 2b8751836592e9ac60f4b2e7c61ef4c9d0b49a2bef25a2cc90922e08a88ed57b
MD5 f69d56abd72d4d20774f3221e72b87a4
SHA1 a5b49e3edb015e834e6d1626af0667ec74ea834e
SHA512 8dcb87e8baedf9156824982cbdad53e962c66fe9cb3be2b44cec69ca99adf7e8ba8d791c9171383a0664d1f252dc5d88e084afa34cce5a40b1810a034cb5ab2d
TLSH
T1319004D3405FCC13110D4541D3005D0D55C557C05337D4C45D53411DD1D4FCDC5D514D
MD5 SHA1 SHA512 TLSH

Submit Download

save.bak

Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\slot_1\save.bak
Size 239B
SHA256 d5db001ffb371a5395a615c912c34e818d4dd0ea97ee48c22a3fa2f8e090a777
MD5 043fccd3faf4326a081138c1b610d0d8
SHA1 5f9668d364737b8e5302f77315809e6a3eee5982
SHA512 4650533a15132e7e9dc9924f796c45411114915acf83d9f33d64f976303838a419fe6c902d0ab2e8ac422b1c8b9b27d036e1829661c386542926f96a54301c6d
TLSH
T115D0A794E01588138ADC1EBD0D5DD3A0D7B153075773D05B9E11302AD7256164047647
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2980-59-0x00007FF609580000-0x00007FF60A580000-memory.dmp

Download