8531e82a9d4ca8a0f08d678b680695292585ef8fcfd334850601ab1a628a34a0

Resubmissions

02/08/2026, 20:53

260802-zpsslsff23

02/08/2026, 20:32

260802-zbk6lsfd559

02/08/2026, 20:08

260802-ywqq6a1dlf9

Analysis

user interaction
yes
max time kernel
8s
max time network
23s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 20:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
KittytrapV3.exe
Size 95.7MB
Sample260802-zbk6lsfd55
SHA256 8531e82a9d4ca8a0f08d678b680695292585ef8fcfd334850601ab1a628a34a0
MD5 f7a368fa6307cbf94ae0aa1456f61cb8
SHA1 768f71307344eabe5a8909cc47bef5c750c244d8
SHA512 d628c5676813b143381c3a13ed2182e12ea02b792927af0e22911ef94fa33ed4d489e78723f8a1c0c918dbfaf40aab612e2d936c16fb5dfd4e960a7aebe5fd20
SSDEEP 786432:XWyHz4Y9bxjYoFxrogpIaLEGm1aJDrNwuBdM+TkvgKpn/jzVROH0zX23Gslgb:X/H0eb7xpISEGXrNNBTkvgG8Ub
TLSH
T14228CF15A7D8471AD63FC27CC5638112E6F1B86213A1D6CF8854EE8D3FA3BC16736262
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	KittytrapV3.exe

Disables Task Manager via registry modification
defense_evasion

Loads dropped DLL 18 IoCs

pid	Process
2212	KittytrapV3.exe
2212	KittytrapV3.exe
2212	KittytrapV3.exe
2212	KittytrapV3.exe
2212	KittytrapV3.exe
2212	KittytrapV3.exe
2212	KittytrapV3.exe
2212	KittytrapV3.exe
2212	KittytrapV3.exe
2212	KittytrapV3.exe
2212	KittytrapV3.exe
2212	KittytrapV3.exe
2212	KittytrapV3.exe
2212	KittytrapV3.exe
2212	KittytrapV3.exe
2212	KittytrapV3.exe
2212	KittytrapV3.exe
2212	KittytrapV3.exe

Modifies visibility of existing users in the login screen 1 TTPs 1 IoCs

A user account was hidden or made visible on the Windows login screen through a registry modification.

defense_evasion

Hidden Users

T1564.002

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\Admin = "1"	KittytrapV3.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	1.1.1.3
Destination IP	1.1.1.3
Destination IP	1.1.1.3
Destination IP	1.1.1.3

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe

Modifies WinLogon 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\HideFastUserSwitching = "0"	KittytrapV3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	KittytrapV3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	KittytrapV3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\Admin = "1"	KittytrapV3.exe

Creates a new local user account 1 TTPs 2 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
4212	net1.exe
512	net.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\Wallpaper = "C:\\KittyImages\\wall.jpg"	KittytrapV3.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Executes a command shell one-liner 1 TTPs 11 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4392	cmd.exe
2232	cmd.exe
1488	cmd.exe
2028	cmd.exe
4352	cmd.exe
3408	cmd.exe
4956	cmd.exe
5096	cmd.exe
3668	cmd.exe
2240	cmd.exe
5080	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\WallpaperStyle = "2"	KittytrapV3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\TileWallpaper = "0"	KittytrapV3.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{EBB51875-15D3-4AFD-9FE5-9F72AC308747}	wmplayer.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2588	wmplayer.exe
Token: SeCreatePagefilePrivilege	2588	wmplayer.exe
Token: SeShutdownPrivilege	5028	unregmp2.exe
Token: SeCreatePagefilePrivilege	5028	unregmp2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2588	wmplayer.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2588	2212	KittytrapV3.exe	88
PID 2588 wrote to memory of 5028	2588	wmplayer.exe	89
PID 2212 wrote to memory of 3668	2212	KittytrapV3.exe	91
PID 3668 wrote to memory of 512	3668	cmd.exe	94
PID 512 wrote to memory of 4212	512	net.exe	95
PID 2212 wrote to memory of 4392	2212	KittytrapV3.exe	96
PID 4392 wrote to memory of 1992	4392	cmd.exe	98
PID 1992 wrote to memory of 872	1992	net.exe	99
PID 2212 wrote to memory of 2232	2212	KittytrapV3.exe	100
PID 2232 wrote to memory of 4604	2232	cmd.exe	102
PID 4604 wrote to memory of 1388	4604	net.exe	103
PID 2212 wrote to memory of 1488	2212	KittytrapV3.exe	104
PID 1488 wrote to memory of 2516	1488	cmd.exe	106
PID 2516 wrote to memory of 5032	2516	net.exe	107
PID 2212 wrote to memory of 2028	2212	KittytrapV3.exe	108
PID 2028 wrote to memory of 2744	2028	cmd.exe	110
PID 2744 wrote to memory of 3100	2744	net.exe	111
PID 2212 wrote to memory of 4352	2212	KittytrapV3.exe	112
PID 4352 wrote to memory of 4204	4352	cmd.exe	114
PID 4204 wrote to memory of 4452	4204	net.exe	115
PID 2212 wrote to memory of 2240	2212	KittytrapV3.exe	116
PID 2240 wrote to memory of 3688	2240	cmd.exe	118
PID 3688 wrote to memory of 3772	3688	net.exe	119
PID 2212 wrote to memory of 3408	2212	KittytrapV3.exe	120
PID 3408 wrote to memory of 4312	3408	cmd.exe	122
PID 4312 wrote to memory of 1576	4312	net.exe	123
PID 2212 wrote to memory of 4956	2212	KittytrapV3.exe	124

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "FEMDOM LOSER"	KittytrapV3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "really? click on this?? ;3 ur pass 123"	KittytrapV3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\dontdisplaylastusername = "0"	KittytrapV3.exe

C:\Users\Admin\AppData\Local\Temp\KittytrapV3.exe
"C:\Users\Admin\AppData\Local\Temp\KittytrapV3.exe"
1⤵
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies visibility of existing users in the login screen
- Modifies WinLogon
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2212
- C:\Program Files\Windows Media Player\wmplayer.exe
  "C:\Program Files\Windows Media Player\wmplayer.exe" /fullscreen "C:\Users\Admin\AppData\Local\Temp\intro.mp4"
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\System32\unregmp2.exe
    "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:5028
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user KittyOwner /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Windows\system32\net.exe
    net user KittyOwner /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:512
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user KittyOwner /add
      4⤵
      Creates a new local user account
      PID:4212
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user KittyOwner mPov8jE3Ao0ZLaPN
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\system32\net.exe
    net user KittyOwner mPov8jE3Ao0ZLaPN
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user KittyOwner mPov8jE3Ao0ZLaPN
      4⤵
      PID:872
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net localgroup "Administrators" KittyOwner /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Windows\system32\net.exe
    net localgroup "Administrators" KittyOwner /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup "Administrators" KittyOwner /add
      4⤵
      PID:1388
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user "Admin" 123
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\system32\net.exe
    net user "Admin" 123
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2516
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "Admin" 123
      4⤵
      PID:5032
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user "Admin" /passwordchg:yes /expires:never
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\system32\net.exe
    net user "Admin" /passwordchg:yes /expires:never
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2744
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "Admin" /passwordchg:yes /expires:never
      4⤵
      PID:3100
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user "Admin" /active:yes
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\system32\net.exe
    net user "Admin" /active:yes
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "Admin" /active:yes
      4⤵
      PID:4452
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net localgroup "Administrators" "Admin" /delete
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Windows\system32\net.exe
    net localgroup "Administrators" "Admin" /delete
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3688
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup "Administrators" "Admin" /delete
      4⤵
      PID:3772
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net localgroup "Users" "Admin" /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Windows\system32\net.exe
    net localgroup "Users" "Admin" /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup "Users" "Admin" /add
      4⤵
      PID:1576
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh interface ip set dns name=Ethernet source=static addr=1.1.1.3
  2⤵
  - Executes a command shell one-liner
  PID:4956
- - C:\Windows\system32\netsh.exe
    netsh interface ip set dns name=Ethernet source=static addr=1.1.1.3
    3⤵
    PID:696
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh interface ipv6 set dns name=Ethernet source=static addr=2606:4700:4700::1113
  2⤵
  - Executes a command shell one-liner
  PID:5096
- - C:\Windows\system32\netsh.exe
    netsh interface ipv6 set dns name=Ethernet source=static addr=2606:4700:4700::1113
    3⤵
    PID:4644
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c shutdown /r /t 0 /f
  2⤵
  - Executes a command shell one-liner
  PID:5080
- - C:\Windows\system32\shutdown.exe
    shutdown /r /t 0 /f
    3⤵
    PID:760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:2324

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa391c855 /state1:0x41c64e6d
1⤵
PID:3316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create Account

T1136

Local Account

T1136.001

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Users

T1564.002

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 896KB
SHA256 6b4d027c0f39a9a91cafe97caa0b954cd7a8ddd8f39703f5a0fdf1bb432b38e4
MD5 79657020bfa956dbe53a24d018e1d77d
SHA1 8ba9f5985fe6bce0c0887b7500591b3694955fa9
SHA512 248947be007de46d881df0bf4a32606268e6c720ac1b3c87c4043cb3d675492632799b2a6d7bb89899449d91619e1be59d2271bab574c13fc37888fc12bdffdc
SSDEEP 768:Rf0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdb5:RRZP2tFPuNnY4UmqEMioTaBacg
TLSH
T1D1152037D150A085CF2C75B1E5AD5F0CBE23A10B12E052465FB4A67FBA633C98D1B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 b06b3aa49d8a90988e0ade92a5b4f2299a043a0338f9ed547183fd55a95d2171
MD5 97c521fc5c7fe8146c3bf468c55c1222
SHA1 e0a932a6d4d14b71a1f3826ff4cd82cbd92c49a5
SHA512 c3c052558817dfcd58325c263b333eaf4d77a26f945a8059d558f72f637e286d7c546f0a767d4c9388c8201561510bb67348865f96435cf10f2bd39de0cd8cfb
SSDEEP 768:90aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaw:rZP2tFP3vqY8AqEMQTaBacg
TLSH
T152258337D190B0C5CE2C7071E9ED8F09BA63A10B11A052465FF8A57E7A633D99D0B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kittytrap.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\Kittytrap.dll
Size 25.1MB
SHA256 3193e475acd232716cae86ae9e731ca3f50743c43618629e605d7f669a312ff1
MD5 64d78647c6f3d7795114e93188aaf025
SHA1 e4f61187bb18cfe572acda06bdb0399823bc01ed
SHA512 bc1d03ea677576b0d5f26bdd93ac480a349b99273bafb2436b5b6bcdcabe714193c01d9d8492a051be2b4cdd0e10f2c4ab4e9133a3d1a9df496c4025c89b6d50
SSDEEP 393216:G1Am4Y9azm4Hix9bSEY3tNSneALt0cnmvFgpBz6QcDYLEG4NR1aJDr1a38wVlW/T:04Y9bxjYoFxrogpIaLEGm1aJDrNwuBd
TLSH
T1E14723D16F148A9CE7A023B85CF042C065E9B93DE1E4E686EC015F9FFCB534568427BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Win32.Registry.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\Microsoft.Win32.Registry.dll
Size 114KB
SHA256 31f5a1cb2046a26c7be2e3a0a18770d8445f0c9d7213ed7365a8403fcca77ab5
MD5 4aac66cd0c4ace7cffcd3773243b0803
SHA1 c525964d67dd354d5220b8293a62bfb45b410801
SHA512 d536ee1e36e424294a9110c384d6e9a55f5fcd7bb75882cfaeee34cd4a20865949cfdf356d1521312a705ac4c88ba4e3026910dcf1e0cd69d7be0eb7d86d4339
SSDEEP 3072:E8Qwrfx6bAYMteaJSvEdy7IViadv5uatHi+Thi:BJVteaJSvEdE8RI+TU
TLSH
T188B36B20BBC4410FEA7E41B89C734846E232F5A65741ABDF4695C0DD2FA3BC6F632562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Collections.dll
Size 290KB
SHA256 11de530ddce2c99a0be5fcefa0e040062860cd41824834f42e06761a949af957
MD5 75c00f6f6113d35e475b9a1ec166186b
SHA1 ffb8a304155d9c13f58d5cc18c4a7aeceb51701d
SHA512 9234b7521192c44471416d61a2c31b4fc12bb54d36d2ab1d91fc1d4ad02466b7c88e22164264464b4d930592907eb3b8db71ba8c43a88ca57a6a8acd758e2669
SSDEEP 6144:rtH48sjvCSCDLEFCL8ph2wqXh0PRbHkbtXcD:rrUvCS8qCL9wqx2bHkbtC
TLSH
T1CC54392873CC2711FDBE41BAE693C042E3799152435082EB46BDF6519F9BFC12ABB025
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.ComponentModel.Primitives.dll
Size 78KB
SHA256 85485dd7639c9449b7d90e305e66612bcd46d14bfb2c216eb6b5c1572ddec1c4
MD5 75f0a60be7fd71384940695df296fb95
SHA1 c4abd4a812e95893945c7c5f1806193678fa7cff
SHA512 c174437cd631eb157eaffc46e93a0f76644a90aa6d6175a372fba08f389bb101ed384cbaecbd7b355eda4bf93e39a7422188c8c9311346faa0a173c5bfc8671c
SSDEEP 1536:e5a9l7Z7h4qjUzMJVLvrYu2nCXK5tZgpcBzd:e+l7Z7h4BIrLvr52CXKOgh
TLSH
T151733A1813E8431AEAAD567C96B399109574F5971313D9CF85E0DA0E2F8F7C2F231A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.Process.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Diagnostics.Process.dll
Size 322KB
SHA256 786e7825067b48fd2cb9e10b1c971f547a0e83814a1a9b7951b8b64ca1e0b808
MD5 2930cf2c21066ff277510b83d2d3de06
SHA1 cadbccd74d06c4689b083fb0f7de46c8e703f8b6
SHA512 521a6add5987e7b91e95a1ed0a9e3648d5a1ecacb63615e8459cdc2ce01a9176264190a58d95e2e05aed83ad163964665363d32f0943b7d55d5a57a711f4ac98
SSDEEP 6144:uaTnBsJOyjlS+LeRqWwxov9jb3bG1PjdlfOGiHn4LFh:uarBAOyjYqeROxhFIHn4Zh
TLSH
T1DF648E24AB88850DFBAD82788463C402E1BDB443378DD7DB4A54DD992F7B7C6A7311B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Linq.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Linq.dll
Size 682KB
SHA256 5e36874e08bb3579aba965097ac9d3b2462ac5d631e8b095ead53289b10074e8
MD5 3057e704f0168bd150cc656b99efcf06
SHA1 936cf6e5ecdd872209dc6068a33e1668ca965272
SHA512 11f1b96477915266b2fca699a14613470fbcdc3014e43beaaebe700bbfda43857a9ae5cf40bca54328af89afd6ea5d8d4f16c85755b70143163db9f5b48b8162
SSDEEP 12288:HSa5IvfEbReykb2SNb5i8y2Nt9N7u3esbH:HSR6R7kb2SNb7PjK3esr
TLSH
T103E46C28E39CCB22C62E4A7AB5235135D36153D26792C9CB964CED442FE3BC1667D32C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Memory.dll
Size 158KB
SHA256 a8e1263bfb450d029562302f3784fd91106d8c67f28008a5104faf91503bba3e
MD5 7f3359b8377b530459f45160d7fe87a5
SHA1 3db9da69f5f819e64678385321cfe55ffd8c72ee
SHA512 2068fd6f756ebb6c32816cf35fb0eab482d20a8c9ef022bf15a0b335e97a9981b921b0e948900c8d5fd657021496906bcb3e5514bfbeb845dffe5780f1c00bb4
SSDEEP 3072:Yabfv1/38goVRXZ1isc8JyyKhpwaGrpXki4T/hSGd:Bd383by3vwaGraiw5SE
TLSH
T16DF35A1BD3980257DA2FD6BA8796C202EF336001D711A1CB48D4DA44AF53BE1BF76936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.NetworkInformation.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Net.NetworkInformation.dll
Size 154KB
SHA256 8a0e7156004e255b7f94d397bfb3f646c3fd0f8c3a286d3f7005ef49da453750
MD5 04795c5e3ef4a41e9c391ed9ca9b3ab4
SHA1 c0c2e913de91016e77e4351828f8668b033c7d55
SHA512 8c15e2676ab787b3466f08f2dfbf1f1b3e7b19cba7c758d9c772b1e2589e3de41d7f5eb9d4dbfc8124bb53363e48be5f95db46effe8ecffda334930d3b812385
SSDEEP 3072:BFqySgUx6wLv3mqP6ub8VkDLVXyVwaVGT9O5xlMmkH:xSgUx6ux5bWJRPlo
TLSH
T1C7F35C1193940216EA9BC23AB1E76E03953BE6C16323D6DB1588ADDC2EF37D0B731652
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Net.Primitives.dll
Size 206KB
SHA256 92639fa57d6ea7bbcbd47f5d108a615cafc75929f5dddda25ceae33db60e959c
MD5 d679d13e700b0f8645e2de5d1a7519f0
SHA1 53d2015142d1b9fa7cbcb6dd1841c569a9eda42a
SHA512 0a2d98055897102b68264c3f4e3b5733055a10507225f6c6126accad66d2873b1db9d0b0c19ca03b4c4fdf6d1395a8c86c7df22706c14f1ef9e7b963a629d4dc
SSDEEP 6144:i0yf5VGYBigOpZAcus4Uzz3KGY+jXHJK8:a1Bp+es5f3KGY83JK8
TLSH
T18A245B29638C460BF76F85788B13CA06E373B5425306D6DB1AA499C47FA37C4BF72192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.CoreLib.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Private.CoreLib.dll
Size 15.3MB
SHA256 bb9a91b896447b666487d7c6538d0e1a79dbed3604ed913315a59a7c0ec6e7c6
MD5 acfd2ad4337d0efcc734098d70a04e2d
SHA1 f60108139a10cc492daa93491478611c1536b097
SHA512 0b569773107d2d0910574c0ef02c487ecc332575ec5ae679fa6383249c36a0ef37d95dd5677cebb29310b2575ccc05aa2977626003b79672d87c359b82d5fcc8
SSDEEP 196608:tz8tp+2zZ5bTp7Okcl8QP7uOH0XrGGEyllZqe03:J8tp/lxTp7al8Q6OH0XrvX2N
TLSH
T1BDF69D10E3D4CB4AE53E927C8153C225EAB5F8926326C2C70158EA493F63FD9673B761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Xml.Linq.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Private.Xml.Linq.dll
Size 382KB
SHA256 c028f975e4c4487a6266efe93106b17ed0e1020a1ef802efb2c971a7cabb2ad1
MD5 06bb429392c39ea13c6e780372461094
SHA1 ae29b751e6fa9225a40353d2966a2a06017c0034
SHA512 6d81143f0512cd024ceb0f3280e1c065fc1e3395f8aeae6a96c743e8534f2f6d77075c798159592425cde0bbf8f84c055a192e0f0a2528385f914b8a38b32e24
SSDEEP 6144:hgRQPsxlsLJpYKcscCx8tYSqLiViCDPuA:hg6PsxexmYSV3v
TLSH
T17C847C24E3C80A12DF6F92BCC153C941E1B1D25243DAD6CB8538EFE55E8B7C4A67216B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Xml.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Private.Xml.dll
Size 7.4MB
SHA256 9380bd61bfb15a0066cbf5c10f9a50729c8020d72c84a8eb37fb0074c582b392
MD5 2be1447da6983713c5b246904aa248c8
SHA1 5e076da5fc82b6ef91c98a179fcb813e72c8b273
SHA512 96c7cdc1861c76ef4b1656bf63bc2ab9673a92f3db5c2badc523cbacf92ae2e9a47bf6253dc3a1e691d5ae1da3997ef8f91b3b347f09c07aea4b12792e33a648
SSDEEP 98304:Smv4nygnKe+85ykjHD0x5TSJqjfAF31DMsrUA:LvEMoyGHeTSAE3xM8V
TLSH
T1C3767C14B3C40A19D32FC27D92238611E6F9B8933356EAEF0458DAC51F937C18A7766B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.InteropServices.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Runtime.InteropServices.dll
Size 110KB
SHA256 500ba5ed075420e8d6857bf38c79708a062f855d1ce87d505b3f1df9357806c6
MD5 dfa380da21f3ae64310eee6918df2ef2
SHA1 34af7a2ce82c6e5482478a08a11d339b9cf193f8
SHA512 d795a7f7ab82926804616258a5c67e0d53d766f970c1d17d3cdbf38d7cf72b081353aa21e9bb0a860e203da61e9346404609d77dfcbfccae56b6e52bf21b71a6
SSDEEP 1536:up2RQtNQMAyNBKTerzicKDq5t4udNY/w2yVvONugk94RHPeF20gB8qzT7:upAiNQMAIKTVC2udNY42ypAuSmcaqX7
TLSH
T1C6B34A207B98863ACA5A473898336D04CEB3FEC69322E6CF9544C49D0FD77C066757A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Claims.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Security.Claims.dll
Size 98KB
SHA256 a57dc1dfd3d2cb774e517e826c05d3e81098d09cee868de4104cf6f1a8a7c4c5
MD5 3c4e6509e453012fef309a02781ffe30
SHA1 01b134f0357c97d121d172da5ee3bf2a98ea382f
SHA512 203f20a1726dd0ec4bb8682ef22fb340312c6107feabb8bc363a48b9c3f7bca799961195d823a08d9584d6ee6fa135a225f7fe8f2d43c42d35dd87b3c3946ef2
SSDEEP 1536:mhAUIoA3VU8GPjLLWNYcIfc/H31IMrOQwQ7rzUU3q2bP6mBvjrvzs:m2doGVU8GbLLaYcIfc/hNRI
TLSH
T1BBA34A1877EC0316D6BB0E3D85F28009D5B5F9822722C6EF09399A0D5E97BC1D631E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Cryptography.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Security.Cryptography.dll
Size 2.4MB
SHA256 b11f291573c6dbd6b3d1cadcd0e7a4f7eced94ff009e4061981d91f1315f721a
MD5 5a099f2c157948a4871084b653eccb7d
SHA1 3756cce480c3c95d55e567a0542a8c1a98aa098e
SHA512 c5985ea44c654d1d07c7d2214285a52339acd80d28cf42a6e30d7f51d8f70c1258e8763486cf23b7e1d1652713596146f8cd07d77935d575b38288fb42d2d5c1
SSDEEP 49152:k+eiPVGpQ+nlM82RPOmtx/VBmNDx+62tlDzn:BeD9llmT
TLSH
T1CEC57C04B3C4064AD1AEDAFEC1174956D5B0F44693C29BEF46C9CE482FA37C2977226B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Principal.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Security.Principal.Windows.dll
Size 174KB
SHA256 972a50bb0fb2569e1b77c20465ce8783fc53dba9c2132a33a749ef72977a4c23
MD5 f06d5b5f7d0e57ef8079cde389a1a0df
SHA1 d4ea8fb46777c85eb0be012f69501fd88d856c8c
SHA512 644e00c18e4f88b12d0686c1d193758f0abe31b1dac904000949eccea54c087e50ad3139d197618af05267286a87b687381d1ba418dd97e0a368c06afc1f9dd0
SSDEEP 3072:tA6a2mRkHtntehhzNUxmbr/3rsd1MVbXpWwsh6aH:O6a2l1tscmbr/w88VH
TLSH
T1C0044B265B880643E76F8A7C81E3664597B3A45707819BCB14C0C9E91F97BC3FB32267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Threading.dll
Size 82KB
SHA256 7175ac06b5908412692d2c2e124cb79f58aaee61ade19bb81118d14a92bb7694
MD5 ccb30dd6940a1943b8129bfe5da67d63
SHA1 e0d7d2cc0e425bc401b51b3148cc708ed6c2452c
SHA512 77e73d93df00ab1cbdb1d66a68ea886c89f11201be491136c0cb39fe6e986a94450a608d9b73d29f91f0db011a7009834d378e2e17202edc7eedea4ad0b2bd7d
SSDEEP 1536:cLVlwV2H8OyQwXeisjb9Rpd5bTF9o6zionNozn:cZlJH8OxwXdsf9RpHHF9o6GonKT
TLSH
T19F834B11B3E8090AF67B1779D6B75905C172FEE22B01D6CF4069D20D2FA77C096B226B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

intro.mp4

Path C:\Users\Admin\AppData\Local\Temp\intro.mp4
Size 19.4MB
SHA256 c4ff48a58f4c30d7c69d8e8f4271dda1a9738c452836c0687f56e3d185f44b22
MD5 3066f2ec5bff3df08fba01fa371fe521
SHA1 b630ab112ec22c082c800054b6c8223c739f5bdf
SHA512 c7a400a33a712de3062b249a8b622f9e13cfd36bb9d6f0e6121d64512087d7ba496a045b517eadc4adb450e29b71fa8c764ba7d002a6927e445d9065038c88d8
SSDEEP 393216:J1Am4Y9azm4Hix9bSEY3tNSneALt0cnmvFgpBz6QcDYLEG4NR1aJDr1w:v4Y9bxjYoFxrogpIaLEGm1aJDrq
TLSH
T1012733893319681DD77483BCCBE44354BAF2C649DA86D70BF926878C88F17964D83EC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2588-259-0x00000265DADE0000-0x00000265DB509000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads