Overview

overview

3

Static

static

3

Femboy Hunter.exe

windows10-2004-x64

1

Femboy Hunter.exe

windows11-ltsc_2024-x64

3

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/07/2026, 18:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Femboy Hunter.exe
  • Size 198.2MB
  • Sample260727-wtaaaayakb
  • SHA256 75fab6f6fd5bf7ace2d2330c127f074d9be735d746b44ebafc847d96a7c025eb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
discovery

Malware Config

Signatures

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Femboy Hunter.exe
    "C:\Users\Admin\AppData\Local\Temp\Femboy Hunter.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:52
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://succubus-lair.itch.io/femboy-hunter
      2⤵
        PID:2792
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffc4b38c188,0x7ffc4b38c194,0x7ffc4b38c1a0
          3⤵
            PID:3156
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,13042488275592233502,8187641551522761360,524288 --field-trial-handle=2204,i,17870603956777919433,11428708940724050089,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:11
            3⤵
            • System Time Discovery
            PID:4760
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,13161464457354519820,9674764397382548097,262144 --field-trial-handle=2204,i,17870603956777919433,11428708940724050089,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
            3⤵
              PID:2612
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2668,i,14543657523015490202,15773222813685945296,524288 --field-trial-handle=2204,i,17870603956777919433,11428708940724050089,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:13
              3⤵
                PID:4724
          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
            1⤵
              PID:5712

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  2ca05497-4bb9-4141-b024-d74faa532084.tmp
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2ca05497-4bb9-4141-b024-d74faa532084.tmp
                  • Size 38KB
                  • SHA256 f2227ba1bf898bd0d9bd399412c50d15d4b9387a705d5c6a2d8b399fe337b08f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  settings.dat
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                  • Size 280B
                  • SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  settings.dat
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                  • Size 280B
                  • SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  funplay_mcp_runtime_bridge.json
                  • Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
                  • Size 45KB
                  • SHA256 52ae54d28d40610d9668abd6c556a20e2085aa91cbfbb6cbcb2dc65406fdbbc3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  funplay_mcp_runtime_bridge.json
                  • Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
                  • Size 45KB
                  • SHA256 76e6fa0bc20f118023f614fea1f0e0a6a5db21fc6ecdcd0766e5825bd14d5d56
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  funplay_mcp_runtime_bridge.json
                  • Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
                  • Size 45KB
                  • SHA256 55349b1dccfb16f9c213226c339722dd072fe5ea38ef742d4cff422655ef1261
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  funplay_mcp_runtime_bridge.json
                  • Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
                  • Size 45KB
                  • SHA256 9bc15b043b918c8cf7cb1eb5c235a5a52ac8280bca66aabc35454d58a4d809da
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  funplay_mcp_runtime_bridge.json
                  • Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
                  • Size 46KB
                  • SHA256 51e93bfced4d7e4a9141b2c0c79b28d5540fad08415edc7d92727b67e536384f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  funplay_mcp_runtime_bridge.json
                  • Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
                  • Size 46KB
                  • SHA256 ed380028af72aa681bf84e9affd4f9d9d1d7983f614af6b8c5037a81a3f23d3b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  funplay_mcp_runtime_bridge.json
                  • Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
                  • Size 46KB
                  • SHA256 fd9a9d93e2e9ee120d58230e80fa5c71f438dfda31dfb34d6aa05f08d8de7631
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  funplay_mcp_runtime_bridge.json
                  • Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
                  • Size 46KB
                  • SHA256 40df1ad81b317945729988f93b9b3ff8453424094dd941f358ac391dd11a09ae
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  funplay_mcp_runtime_bridge.json
                  • Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
                  • Size 46KB
                  • SHA256 e9908b5c3a19c9bc967cf7af1a8d344439bf3cad264f914d7a41fcd6e3fa1dbf
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  funplay_mcp_runtime_bridge.json
                  • Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
                  • Size 46KB
                  • SHA256 e227000ee3cc55705c88b657337d388ed25f3461a43b06020d809183dafb37dc
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  funplay_mcp_runtime_bridge.json
                  • Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
                  • Size 46KB
                  • SHA256 6ebb67dc0f126ee5baa1af821008e0f8214356c86436e3e6938ad325261e4592
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  funplay_mcp_runtime_bridge.json
                  • Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\funplay_mcp_runtime_bridge.json
                  • Size 43KB
                  • SHA256 3931e51b284f0bbf032362eecfed1e804678936f9f8499a7088b53a9c2acd278
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  settings.cfg
                  • Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\settings.cfg
                  • Size 51B
                  • SHA256 2b8751836592e9ac60f4b2e7c61ef4c9d0b49a2bef25a2cc90922e08a88ed57b
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  save.bak
                  • Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\slot_1\save.bak
                  • Size 239B
                  • SHA256 4f903fb5a6281c24c3405c5f460f6752f48b8f8c080e6dce1ffc56b19fbea547
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  save.json
                  • Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\Femboy Hunter\slot_1\save.json
                  • Size 756B
                  • SHA256 b4e1fcf96f587bb16ea78a4d29bd7e73d3eeacc729e838a60d20d8741b3f5c2b
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  memory/52-49-0x00007FF7B1C30000-0x00007FF7B2C30000-memory.dmp
                  Download