Malware Analysis Report

2025-08-10 20:49

Sample ID 250502-l5yf5sbj8w
Target 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch
SHA256 78b0a0f2ba9434a0c5fbadf2026f7f354f1b1a78992c8187963f6689d3817c02
Tags
gofing credential_access discovery ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

78b0a0f2ba9434a0c5fbadf2026f7f354f1b1a78992c8187963f6689d3817c02

Threat Level: Known bad

The file 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch was found to be: Known bad.

Malicious Activity Summary

gofing credential_access discovery ransomware spyware stealer

Gofing family

Gofing

Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

Renames multiple (52) files with added filename extension

Reads user/profile data of web browsers

Credentials from Password Stores: Windows Credential Manager

Drops startup file

Loads dropped DLL

Drops desktop.ini file(s)

Drops Chrome extension

Drops file in System32 directory

Drops autorun.inf file

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Browser Information Discovery

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-05-02 10:07

Signatures

Gofing family

gofing

Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-05-02 10:07

Reported

2025-05-02 10:10

Platform

win10v2004-20250314-en

Max time kernel

150s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe"

Signatures

Gofing

ransomware gofing

Gofing family

gofing

Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Renames multiple (52) files with added filename extension

ransomware

Credentials from Password Stores: Windows Credential Manager

credential_access stealer

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Drops Chrome extension

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Media\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Downloaded Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\$Recycle.Bin\S-1-5-21-3975168204-1612096350-4002976354-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Offline Web Pages\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\AppVTerminator.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\CapabilityAccessManagerClient.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ARP.EXE C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\AcGenral.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\AcWinRT.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\AppInstallerPrompt.Desktop.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ClipboardServer.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Com\comrepl.exe C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Configuration\BaseRegistration\uk-UA\MSFT_MetaConfigurationExtensionClasses.Schema.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\AppointmentActivation.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\BamSettingsClient.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\BrowserSettingSync.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\CallHistoryClient.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Configuration\BaseRegistration\BaseResource.Schema.mof C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\C_ISCII.DLL C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Configuration\BaseRegistration\es-ES\BaseResource.Schema.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\MSFT_FileDirectoryConfiguration.Registration.mof C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\de-DE\MSFT_FileDirectoryConfiguration.Schema.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\uk-UA\MSFT_FileDirectoryConfiguration.Schema.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ConfigureExpandedStorage.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ChatApis.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Clipc.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\@AppHelpToast.png C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\AboveLockAppHost.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\AppIdPolicyEngineApi.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\C_IS2022.DLL C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ComputerDefaults.exe C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Configuration\BaseRegistration\MSFT_DSCMetaConfiguration.mof C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\AcLayers.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\AuthBrokerUI.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\BcastDVRBroker.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Configuration\BaseRegistration\de-DE\MSFT_DSCMetaConfiguration.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Configuration\BaseRegistration\it-IT\BaseResource.Schema.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\es-ES\MSFT_FileDirectoryConfiguration.Registration.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\AuthBroker.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\AuthFWGP.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\AzSqlExt.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Com\de-DE\comrepl.exe.mui C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\CompPkgSup.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Configuration\BaseRegistration\en-US\MSFT_DSCMetaConfiguration.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\it-IT\MSFT_FileDirectoryConfiguration.Schema.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\CertEnrollUI.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\12520850.cpx C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\AarSvc.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\AdmTmpl.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\AudioSes.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\AuthExt.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Com\comempty.dat C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\fr-FR\MSFT_FileDirectoryConfiguration.Schema.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ActionCenter.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\AssignedAccessRuntime.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\BitsProxy.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\CPFilters.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ComposableShellProxyStub.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Configuration\BaseRegistration\es-ES\MSFT_DSCMetaConfiguration.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\@WirelessDisplayToast.png C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\APHostClient.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\BcastDVRClient.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\BingMaps.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\CallButtons.ProxyStub.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Configuration\BaseRegistration\MSFT_MetaConfigurationExtensionClasses.Schema.mof C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Configuration\BaseRegistration\en-US\MSFT_MetaConfigurationExtensionClasses.Schema.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Configuration\BaseRegistration\fr-FR\MSFT_DSCMetaConfiguration.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\AppResolver.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\dxil.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Sockets.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationBuildTasks.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\PSGet.Resource.psd1 C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-150_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SuperSlowMotionCheckbox.xbf C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\W6.png C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\SmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailLargeTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Common Files\System\msadc\de-DE\msadcor.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_patterns_header.png C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmmui.msi.16.en-us.xml C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\SplashScreen.scale-125.png C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\stickers\word_art\sticker17.png C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.Editors.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\selector.js C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\share_icons2x.png C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Microsoft.Office.Interop.Excel.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GameBar_LargeTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\welcome.png C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\SaveAsRTF.api C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\PackageManagementDscUtilities.strings.psd1 C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\FileSystemMetadata.xml C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\16.png C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileWide.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Locales\mi.pak C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Windows Media Player\uk-UA\mpvis.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-400_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-256_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\resources.pri C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.NonGeneric.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\TextIntelligence.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\AppxManifest.xml C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24.png C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\UnblockPop.xls C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libposterize_plugin.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\mk.pak C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\MSFT_PackageManagementSource.strings.psd1 C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\Microsoft.PackageManagement.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\office.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\smsconnect\torch1x.png C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\Retail\guest.png C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\css\main.css C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Fonts\BroMDL2.2.33.ttf C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageWideTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\LargeTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\resources.pri C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Security.Principal.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\SMDiagnostics.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Activities.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\System.IdentityModel.Selectors.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\System.Runtime.Serialization.Formatters.Soap.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PLA\Rules\Rules.System.Configuration.xml C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PLA\Rules\ja-JP\Rules.System.Common.xml C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\LanmanWorkstation.admx C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\en-US\PerformancePerftrack.adml C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\ja-JP\Printing2.adml C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Speech\Engines\SR\de-DE\l1031.ngr C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Installer\35dc.msi C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorpe.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\de\System.DirectoryServices.Protocols.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\normnfkc.nlp C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\v4.0_10.0.0.0_es_b03f5f7f11d50a3a\Microsoft.VisualBasic.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_perf2.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Xml.XPath.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\System.Data.Services.Client.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\webengine.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\es\Microsoft.VisualBasic.Compatibility.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Speech\Engines\SR\en-US\l1033.dlm C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Cursors\size2_il.cur C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\.NET Memory Cache 4.0\netmemorycache.ini C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state_perf.h C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallRoles.sql C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PenIMC_v0400.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\it\ReachFramework.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\migration.dat C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-black_scale-125.png C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\EditAppSetting.aspx.es.resx C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Providers\App_LocalResources\manageProviders.aspx.es.resx C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\es\XsdBuildTask.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\Microsoft.GroupPolicy.AdmTmplEditor.Resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Utility.Activities.Resources\v4.0_3.0.0.0_fr_31bf3856ad364e35\Microsoft.PowerShell.Utility.Activities.Resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\DebugAndTrace.aspx.resx C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v3.5\fr\Microsoft.Data.Entity.Build.Tasks.Resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\aspnet.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\es\System.Data.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-white_scale-125.png C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ES\System.Web.Mobile.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\es\PresentationBuildTasks.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions.resources\v4.0_4.0.0.0_fr_b77a5c561934e089\System.Data.DataSetExtensions.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\fr-FR\Passport.adml C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\microsoft_bluetooth_a2dp.inf C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ImmersiveControlPanel\images\TileSmall.scale-100.png C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\System.WorkflowServices.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\es\ComSvcConfig.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ShellExperiences\JumpViewUI.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\mdmnttd2.inf C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Media\Ring07.wav C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\System.Data.DataSetExtensions.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorpehost.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClientsideProviders.resources\v4.0_4.0.0.0_es_31bf3856ad364e35\UIAutomationClientsideProviders.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\it-IT\DeviceCredential.adml C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Provisioning\Packages\Power.Settings.Sleep.ppkg C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CertificateServices.PKIClient.Cmdlets.Resources\v4.0_10.0.0.0_en_31bf3856ad364e35\Microsoft.CertificateServices.PKIClient.Cmdlets.Resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\it-IT\ControlPanelDisplay.adml C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\ssef1256.fon C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\fr\Microsoft.Build.Tasks.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\1041\Microsoft.VisualBasic.Activities.CompilerUI.dll C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\es\DropSqlPersistenceProviderLogic.sql C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Browser Information Discovery

discovery

Processes

C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe

"C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 c.pki.goog udp
DE 142.250.185.131:80 c.pki.goog tcp

Files

C:\Program Files\7-Zip\7-zip32.dll

MD5 6ef6a3830a6729ab9f620785a843e49f
SHA1 54f39a1d0dc32b6eaaaa6f931f7f9bbcf3e06c06
SHA256 66dc93daca350cf4381a473c4e31a3dd4df515766205ad9cebe461e4e12e58c4
SHA512 6ebeeb7b6bd69ac6867695c002e0b8245d0bec55934947905d53958d2aace48f3d16e0aaa1d69457b5a1ddeec6d301981bc9bdd1b24196fca6e7108e512fa2b8

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll

MD5 2b5fe291adec8a3e4b22d8e88c0a1c5f
SHA1 968b6a02d93345cc7d329701203f688dcb45dae6
SHA256 62786e48db8e2b8c44ca778eeced3c331797e26f48072b0ca7a6c8e0ef31ea9c
SHA512 e6ddde91e078a71b842f73f3cd95b693db7d4a4bdf3901e48781d129a21af68e13c5789c1a9f94a407630eda10e8095b07d0bafa3ed21a427ccb05545f416380

C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL

MD5 587f2836341f341971b2ed6fce765eaa
SHA1 d3a9d2a8d9f2e506640547ebee254269c2685148
SHA256 81ab89211535fa83d0a478311c2fc4f430936aff3456d9b66ee5344865834274
SHA512 10a623ffaa51f929fb1f69229a99630ae1845152cd08b810bbcf6c6b0866f91235a3e9d749bb8bca5811e5ca04ceedb05d15c43054af33ec2c7925df8dbb601f