Malware Analysis Report

2025-08-05 15:10

Sample ID 250503-sfzq8svvhw
Target 2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch
SHA256 e6a7987298df48a175d3c2358b4227c5f44d075cde23d5e419ca961bb62890b5
Tags
gofing credential_access discovery ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e6a7987298df48a175d3c2358b4227c5f44d075cde23d5e419ca961bb62890b5

Threat Level: Known bad

The file 2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch was found to be: Known bad.

Malicious Activity Summary

gofing credential_access discovery ransomware spyware stealer

Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

Gofing

Gofing family

Renames multiple (52) files with added filename extension

Drops file in Drivers directory

Manipulates Digital Signatures

Drops startup file

Credentials from Password Stores: Windows Credential Manager

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Drops Chrome extension

Drops desktop.ini file(s)

Drops autorun.inf file

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Browser Information Discovery

Unsigned PE

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies registry class

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-05-03 15:04

Signatures

Gofing family

gofing

Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-05-03 15:04

Reported

2025-05-03 15:07

Platform

win10v2004-20250502-en

Max time kernel

150s

Max time network

112s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe"

Signatures

Gofing

ransomware gofing

Gofing family

gofing

Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\gm.dls C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\uk-UA\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\afunix.sys C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Credentials from Password Stores: Windows Credential Manager

credential_access stealer

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Drops Chrome extension

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Offline Web Pages\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\$Recycle.Bin\S-1-5-21-3690492401-2005096563-3427069815-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\ExplorerFrame.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\KBDA2.DLL C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetworkTransition\MSFT_NetNatTransitionConfiguration.cdxml C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\en-US\StorageContextHandler.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\en-US\XInput9_1_0.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\es-ES\cli.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\webauthn.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetEventPacketCapture\MSFT_NetEventVFPProvider.format.ps1xml C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\PhoneUtilRes.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\mbsmsapi.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\nb-NO\quickassist.exe.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\uk-UA\themeui.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\uk-UA\hbaapi.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\d3d9on12.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ja-JP\jscript9.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wmpdxm.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-ApplicationGuard-Shared-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.153.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\de-DE\nlmcim_uninstall.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\MSHEIF.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\PhoneutilRes.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\SettingSyncHost.exe C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsClient\DnsClientPSProvider.Format.ps1xml C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\nshipsec.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\uk-UA\htable.xsl C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WerFaultSecure.exe C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.WSMan.Management\Microsoft.WSMan.Management.psd1 C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\urlmon.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ja-JP\rsop.msc C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\kbdlk41a.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\srmscan.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\de-DE\hbaapi.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\fr-FR\MSFT_WindowsOptionalFeature.schema.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ir50_qcx.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\KBDPL.DLL C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\uk-UA\uicom.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\ja-JP\MSFT_FileDirectoryConfiguration.Schema.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\fr-FR\wlgpclnt.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\it-IT\SMBHelperClass.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\vss_ps.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\@WirelessDisplayToast.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Dism\IBSProvider.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetworkConnectivityStatus\MSFT_NCSIPolicyConfiguration.format.ps1xml C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\KBDPASH.DLL C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\fr-FR\MSFT_EnvironmentResource.strings.psd1 C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\auditpolcore.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\en-US\wcnwiz.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\it-IT\spp.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\uk-UA\pcaui.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\en-US\xml.xsl C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\InputMethod\CHS\ChsIFEComp.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\fr-FR\MSFT_LogResource.schema.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\PSDesiredStateConfiguration.psm1 C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\srms-apr-v.dat C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\mapistub.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\kbd101b.DLL C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\en-US\storagewmi_uninstall.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\fr-FR\mofd.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WSClient.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\it-IT\MSFT_UserResource.strings.psd1 C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\msorc32r.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Dism\en-US\WimProvider.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\ja-JP\l2gpstore.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Com\en-US\comrepl.exe.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ortcengine.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\resources.pri C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Dtmf_pound_Loud.m4a C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-64_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Windows NT\Accessories\en-US\wordpad.exe.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteMedTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-24_altform-colorize.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSplashLogo.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\contrast-white\AboutBoxLogo.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\AppxManifest.xml C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe\AppxManifest.xml C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\StopwatchLargeTile.contrast-black_scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_scale-100.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\circle.cur C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\BLANK.ONE C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Scientific.targetsize-32_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\de-de\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\skchui.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\ResiliencyLinks\MEIPreload\preloaded_data.pb.DATA C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Locales\ml.pak C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Light\IsoRight.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-16.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\_Resources\4.rsrc C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-core-xstate-l2-1-0.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedWideTile.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Dtmf_5.m4a C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.AppContext.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_plugin.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-40_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleAppAssets\Videos\people_fre_motionAsset_p2.mp4 C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarSmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymt.ttf C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Content\SaturationGradient.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\desktop-tool-view.css C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\PLANNERS.ONE C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_av1_plugin.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Dark.scale-100.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailWideTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Describe.ps1 C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Input.Manipulations.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ms-MY\View3d\3DViewerProductDescription-universal.xml C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\BIBUtils.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sk-sk\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-si\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-180.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-256_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\System.Windows.Input.Manipulations.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\INF\.NET Memory Cache 4.0\0411\netmemorycache_d.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\System.Security.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v3.5\fr\DataSvcUtil.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Logic.sql C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\es\aspnet.mfl.uninstall C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\System.ServiceModel.Discovery.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Speech_OneCore\Engines\TTS\es-ES\NUSData\M3082Pablo.keyboard.unt C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Boot\PCAT\lv-LV\bootmgr.exe.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\sere1257.fon C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\svgafix.fon C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\hdaudio.PNF C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v3.5\ja\EdmGen.Resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\locale.nlp C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationBuildTasks.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\.NET CLR Networking 4.0.0.0\_Networkingperfcounters.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\intelpep.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\mdmtdkj4.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\UninstallRoles.sql C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\Regasm.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Internals.aspx C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config.comments C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq.resources\v4.0_4.0.0.0_ja_b77a5c561934e089\System.Data.Linq.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\vga852.fon C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\CreateAppSetting.aspx C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\System.Net.Http.WebRequest.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.ComponentModel.resources\v4.0_4.0.0.0_de_31bf3856ad364e35\System.Workflow.ComponentModel.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PLA\Rules\Rules.System.Finale.xml C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Panther\setupinfo C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Globalization\ELS\SpellDictionaries\Fluency\uk-UA\punctuation.json C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Installer\6237.msi C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\Microsoft.Build.Tasks.v4.0.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\TaskScheduler.admx C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\it-IT\StorageHealth.adml C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Help\mui\0411\msorcl32.chm C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\wsearchidxpi\0000\idxcntrs.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WorkflowServiceHostPerformanceCounters.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\App_GlobalResources\GlobalResources.resx C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v3.5\SQL\ja\SqlPersistenceProviderSchema.sql C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Presentation.resources\v4.0_4.0.0.0_es_b77a5c561934e089\System.Windows.Presentation.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\en-US\GroupPolicy.adml C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\pci.PNF C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\sisraid4.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\home0.aspx.fr.resx C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\System.configuration.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\1033\alinkui.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\ja-JP\ControlPanel.adml C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Prefetch\POWERSHELL.EXE-920BBA2A.pf C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Resources\Themes\aero.theme C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v3.5\1041\vbc7ui.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\de-DE\Globalization.adml C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\en-US\IIS.adml C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\en-US\SharedFolders.adml C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Speech\Common\it-IT\sapisvr.exe.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Code\WebAdminPage.cs C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v3.5\3082\vbc7ui.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\SMDiagnostics.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\System.Activities.DurableInstancing.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\System.DirectoryServices.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\legacy.web_hightrust.config.default C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\Software\Microsoft\Internet Explorer\GPU C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Internet Explorer\GPU C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\Software\Microsoft\Internet Explorer\GPU C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Internet Explorer\GPU C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "881" C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\MuiCache C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "904" C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "0" C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23" C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "937" C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\MuiCache C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "0" C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe

"C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe"

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

Network

Country Destination Domain Proto
GB 88.221.135.16:443 www.bing.com tcp
US 8.8.8.8:53 c.pki.goog udp
DE 142.250.184.195:80 c.pki.goog tcp

Files

C:\Program Files\7-Zip\7z.dll

MD5 843b4a8a2ea71680486a8a0cc0b0246b
SHA1 46ffefd5c934418e53535a9185fbecfeabaacebc
SHA256 cb31b96a6ed836843496c61165d66523b511469776d30d0fb213c818ac28c1be
SHA512 b7a6d5ad6239951e7cd824c32cd97e50c0e341771497e6386f0c6883f1f79f00a5b2553adda26253b567d71ef1f053af2335d0dfda2f12e45512caa5f7501e0f

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll

MD5 9c3863c29215bfbdb6c03ede328de430
SHA1 65cebc36b8280d19db97fe5d96a461e98a8beb90
SHA256 fb9356214ec3d127f31da2540a3262c5df106a0aad17f3618fd8b68880fd9b13
SHA512 73ffd3090dd15944de6b0cf4a6c9636fc3e34fc622c059e27d93893e2d7caa1251e4c87d8ad039b519abbd53d31c737c1059dafe454ea802f1f6e281135ab0d7

C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL

MD5 b1e352f8e51bd97e8a9c5056a668f85d
SHA1 564cc8f14dcc5abc1ef108f3eea32b74cb408764
SHA256 00e4e4e0f75f4ad3dd38c20d76f0b9b77a14302fbaa99aab353a3e256ea6dd5a
SHA512 d0c2702a61c90b6e22c57f0095211ebeb004764658a1e90a2779aedc7f8cfc066b9d37e29567c17815d36cae66965af25a9aa6a9677a77403cd7feeeb8783e94

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat

MD5 394eee57a915956e69aaa3924ec4a53a
SHA1 d3f15274f0f9bc5c407e9216b920e5e3d3fd634a
SHA256 772c41e3c193e9be30336afdecf3a786d204e3e5f2e11ce30111943ab2fc0678
SHA512 584ed5d6ac53f06a9acb67705810739292b337ae819fe92657c355429621e87782eccf74c592b1a8a8fa88954431ddc6c5d1fc28c22836c02ac6fe7781ed7101

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133907583938810782.txt

MD5 0a76974129193d00227730f435b97075
SHA1 7709b89673808cce19cead6cbefa4ba6f032ca74
SHA256 e7a085f54174b4b38b61835c90ca9afa0f618c2c9030b4c3f5f540d5c69e23af
SHA512 b08c0da848421e384f77c039259cc8288d900bf2610a27c55d0c15af09ef5f9dec5582b2b8ace18cc83abb32c9231de2ba4334a73b04c77ef1ee2a7adc1b76d4

memory/3120-5747-0x000002289D760000-0x000002289D860000-memory.dmp

memory/3120-5746-0x000002289D760000-0x000002289D860000-memory.dmp

memory/3120-5745-0x000002289D760000-0x000002289D860000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133907583967356263.txt

MD5 aaabd569f8458096c85f02092eece5aa
SHA1 ad838436d0250be0c7520a1cbc7c72ac9365fe5b
SHA256 d1e73bf1854ebd1a75ac8267c868fc124b3fab9b500596e6ddc784d60eaa2b79
SHA512 70909a99c225efccc030c5f76176e2efe071518fc6a1317bdb2da6732609e6eef08a3ad9cc9b0daf42d5ce678f3ac2584ec4162c7afe019ea7aef158a184ecdc

C:\WINDOWS\FONTS\ARIALNB.TTF

MD5 b0d588160eef96618868dc05a98cd438
SHA1 b12b5bb43a08832fa29287d863ea980fd568e9eb
SHA256 316909fb9b2ed8760f06bac6f5f854f973f9113f86cabbfdb67a4df085868066
SHA512 0e0285e746a90d09438525f3c3cea16ac40647608a9370b55835a45c7804f36b70ff45a861689e21f7c47f19253e4243fe115afa329997d1bc7bd8b4b6d64727

C:\WINDOWS\FONTS\CENTURY.TTF

MD5 596f7361b40aed19cbf694caedf50c39
SHA1 bbac7f6396a36ff3475b1deb8aa2bd13c2e2cc3e
SHA256 90628dcd60fdc3e21d0b0fac070af0bf670797a9f5be73be345280243159f512
SHA512 0723c2f32f5d0cb374e4711de70a29cb96fda962f18306d090c88dcd6d900f10effcb8e8826a8a7545e85f271ca0e54473e821abdece04af6736c30cfd15d325

C:\WINDOWS\FONTS\ARIALN.TTF

MD5 a03738cde963398009a5c7ff80fcc518
SHA1 5c93b8fc0ccbd8e97a8eaa262cc58c52a19a5958
SHA256 0c24a128f310a8e5dcaad7e496e9765b2638e6da03e3af1a5ab6a345335641f6
SHA512 0b53e8b6df24be6a757bbf907c804ef4b5f57cf7bbe455f6c4cb9eec36e11a2d5ded5d7bb663db9237809f91666c6d373b7b06fffee550b482bd8ec7e914225f

C:\WINDOWS\FONTS\ANTQUAI.TTF

MD5 632df92d62e55b968804cc4e3ef8c562
SHA1 f3fd7d14610e4d77b674c713f84e20e4deaa8483
SHA256 136c12603fa82f5a26f6548b7c77422581717703508e1938810b2b5138e5ac33
SHA512 fb689bc32909663aa121b7b87822b9ca7618c59d5772aceddbcf70107e7be2f007491c27aef1febbceb2b310ca159fc5a0bb925ed4f555c47d2abf9d62522892

C:\WINDOWS\FONTS\ANTQUABI.TTF

MD5 6a149a60838bc98d302a20c79b28bff3
SHA1 0bb0f1a42ce679db07218339e3bfdb55c7a04b3a
SHA256 b721ecb5dd802f8494af9695eea465da496f99d67f356604ea29aaf283526c45
SHA512 9041cb4edfe6a2027aba2f882b0329adca2b832a9097638f082032a371241ec6f8c5787f6b0b56338c21f5b416dae12a40deee1142835b9285c4f1d2a4a76ac3

C:\WINDOWS\FONTS\ANTQUAB.TTF

MD5 bb2ac23d27b96c339395a4cef4f03eb4
SHA1 0ef69f6b3ca1a365094161a8b5f5ccdb4f93bc7e
SHA256 b06fa4f610244e657e17de4ec73b57a0f0bf5fe0a2779753a7c893d161de9cad
SHA512 edb3faca66330abb7a2d36b231aa3e8890993c60a33ee54e59e692689c2acb74ce0a1a0cddcbcd071bc92d0f9dc82167727c63f9b5fb15452a7e35f5b23ac3b6

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b2d0c4ac-2283-4504-b721-a737a711420d}\apps.schema

MD5 1659677c45c49a78f33551da43494005
SHA1 ae588ef3c9ea7839be032ab4323e04bc260d9387
SHA256 5af0fc2a0b5ccecdc04e54b3c60f28e3ff5c7d4e1809c6d7c8469f0567c090bb
SHA512 740a1b6fd80508f29f0f080a8daddec802aabed467d8c5394468b0cf79d7628c1cb5b93cf69ed785999e8d4e2b0f86776b428d4fa0d1afcdf3cbf305615e5030

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b2d0c4ac-2283-4504-b721-a737a711420d}\apps.csg

MD5 5475132f1c603298967f332dc9ffb864
SHA1 4749174f29f34c7d75979c25f31d79774a49ea46
SHA256 0b0af873ef116a51fc2a2329dc9102817ce923f32a989c7a6846b4329abd62cd
SHA512 54433a284a6b7185c5f2131928b636d6850babebc09acc5ee6a747832f9e37945a60a7192f857a2f6b4dd20433ca38f24b8e438ba1424cc5c73f0aa2d8c946ff

memory/4300-5826-0x000001AB37C00000-0x000001AB37D00000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\3FESS8ZQ\microsoft.windows[1].xml

MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

memory/4300-5832-0x000001AB38BD0000-0x000001AB38BF0000-memory.dmp

memory/4300-5828-0x000001AB37C00000-0x000001AB37D00000-memory.dmp

memory/4300-5827-0x000001AB37C00000-0x000001AB37D00000-memory.dmp

memory/4300-5863-0x000001AB38B90000-0x000001AB38BB0000-memory.dmp

memory/4300-5864-0x000001AB39120000-0x000001AB39140000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json

MD5 a7e94ea256980afae0f7f79556a1a363
SHA1 b1bb784216975892b917f907a826ffa2c2efc280
SHA256 630979529234fb316f48dbada720ce17d017a4c3996bb0bb866989261f4cc39b
SHA512 87dbddd7d50716405252b5cebf05470ea518fcd9718d38bda49d565cdf9dace3fc4a62762e692f8a390c25aff8580aa4d1ccaa1fb97f790a8ef663619e92e4f9

Analysis: behavioral2

Detonation Overview

Submitted

2025-05-03 15:04

Reported

2025-05-03 15:07

Platform

win11-20250502-en

Max time kernel

150s

Max time network

107s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe"

Signatures

Gofing

ransomware gofing

Gofing family

gofing

Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Renames multiple (52) files with added filename extension

ransomware

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\drivers\afunix.sys C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\gm.dls C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\uk-UA\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Credentials from Password Stores: Windows Credential Manager

credential_access stealer

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Drops Chrome extension

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Downloaded Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Offline Web Pages\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\themeui.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~uk-UA~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-DeviceUpdateCenter-Package~31bf3856ad364e35~amd64~es-ES~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-UtilityVM-Containers-Shared-merged-Package~31bf3856ad364e35~amd64~~10.0.22000.282.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Notepad-System-FoD-Package~31bf3856ad364e35~wow64~fr-FR~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-TabShellExperience-Package~31bf3856ad364e35~amd64~ja-JP~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\Dism\fr-FR\UnattendProvider.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\Dism\it-IT\OSProvider.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WofUtil.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\fr-FR\PrintManagementProvider.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-UtilityVM-Containers-Setup-Shared-merged-Package~31bf3856ad364e35~amd64~fr-FR~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\Dism\de-DE\CbsProvider.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\avc.inf_amd64_117356baf8fb8e40\avc.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmcom1.inf_amd64_32b8d1c2c827f4fb\mdmcom1.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-DynamicMemory-VirtualDevice-Package~31bf3856ad364e35~amd64~es-ES~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Host-Compute-PowerShell-Module-Package~31bf3856ad364e35~amd64~ja-JP~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Media-Format-Package~31bf3856ad364e35~amd64~it-IT~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-MediaPlayer-Payload-Package~31bf3856ad364e35~amd64~uk-UA~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Multimedia-MF-Package~31bf3856ad364e35~amd64~en-US~10.0.22000.184.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmtdkj6.inf_amd64_ed5dc5c0d7a73a6a\mdmtdkj6.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\LaunchTM.exe C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\NetFirewallDynamicKeywordAddress.cmdletDefinition.cdxml C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\Configuration\BaseRegistration\de-DE\MSFT_MetaConfigurationExtensionClasses.Schema.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mshidkmdf.inf_amd64_d55bad1fa4b303c5\mshidkmdf.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\eeprom_qca9377_1p1_NFA425_olpc_A_T103HAF.bin C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_x86_69e8e0efb212ba16\ntprint.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\DiagnosticInvoker.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\PSEvents.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\da-DK\SyncRes.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\cmcfg32.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\winver.exe.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\Apphlpdm.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ja-JP\PeerDistSh.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Lxss-merged-Package~31bf3856ad364e35~amd64~es-ES~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\KBDSYR1.DLL C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PrintManagement\MSFT_Printer.types.ps1xml C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\avicap32.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ntdll.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\regsvr32.exe C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-TerminalServices-MiscRedirection-Package~31bf3856ad364e35~amd64~ja-JP~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\KBDFR.DLL C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\MUI\0407\mscorees.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-KMCL-Host-Package~31bf3856ad364e35~amd64~~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Networking-Containers-Package~31bf3856ad364e35~amd64~de-DE~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\DefaultPrinterProvider.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Printing_Admin_Scripts\es-ES\pubprn.vbs C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\vfwwdm32.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\dxdiagn.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\localsec.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ja-JP\comctl32.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ja-JP\msoert2.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\msdxm.tlb C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\D3D12Core.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\mfplat.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\en-US\netdacim.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wfdprov.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\winrssrv.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-SmartCard-Drivers-Package~31bf3856ad364e35~amd64~~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-MSPaint-FoD-Package~31bf3856ad364e35~amd64~de-DE~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-RemoteFX-RemoteClient-Setup-Package~31bf3856ad364e35~amd64~en-US~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\VoipRT.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ja-JP\lpeula.rtf C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\srpapi.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ErrorReporting-Adm-Package~31bf3856ad364e35~amd64~ja-JP~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-profile-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SnipSketchAppList.targetsize-30_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\AppxManifest.xml C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-256.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\host\fxr\8.0.15\hostfxr.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\bun.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\WidevineCdm\manifest.json C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.OneDriveSync_21220.1024.5.0_neutral__8wekyb3d8bbwe\AppxManifest.xml C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\PaintSmallTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-256_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\OutOfOffice.scale-200_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-64.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-tool-view.js C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\eu-es\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_10.2.41172.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\contrast-white\FeedbackHubAppList.targetsize-48.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemCore.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ko-kr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.43\psmachine_64.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql90.xsl C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_1.0.36.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsStoreLogo.scale-125.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\Assets\Icons\StickyNotesMedTile.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-200_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\AboutAdsCoreBackgroundImage.jpg C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.AppContext.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\PlayStore_icon.svg C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\misc\libexport_plugin.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_21.21030.25003.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosSplashScreen.contrast-black_scale-125.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\Assets\Square71x71Logo.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-24_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon_hover.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\ResiliencyLinks\Locales\zh-TW.pak.DATA C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.2008.32311.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\GetHelpAppList.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\NewsStub.exe C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140_1.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-fr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE2.POTX C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.2012.21.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\CalculatorStoreLogo.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Resources\Fonts\SegMVR2.ttf C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\EmptyView-Dark.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Adobe.Reader.Dependencies.manifest C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\Other C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsBase.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_1.0.6.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\WeatherAppList.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\core_icons_retina.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pl-pl\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Trust Protection Lists\Mu\Entities C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\AdSelectionAttestationsPreloaded\manifest.json.DATA C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\PaintMedTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\GetHelpBadgeLogo.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldContain.snippets.ps1xml C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\da-dk\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\webviewBoot.min.js C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Speech_OneCore\Engines\SR\en-US-N\r1033sr.lxa C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Cursors\size2_l.cur C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\urschipidea.PNF C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\App_LocalResources\manageSingleRole.aspx.fr.resx C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\home0.aspx.es.resx C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe.config C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.TypeConverter\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ComponentModel.TypeConverter.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WindowsBase.resources\v4.0_4.0.0.0_de_31bf3856ad364e35\WindowsBase.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\LeelaUIb.ttf C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\AppSetting.ascx C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardInit.ascx.fr.resx C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Resources.Reader.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\es\aspnet.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Prefetch\RUNDLL32.EXE-FFAD4E3B.pf C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Cursors\aero_ns_xl.cur C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\TAPISRV\0C0A\tapiperf.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\wvmic_guestinterface.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardInit.ascx.es.resx C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Resources\Themes\aero\uk-UA\aerolite.msstyles.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\netwtw08.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfcm100_x64 C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja-JP\ServiceModelPerformanceCounters.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Provider.aspx.de.resx C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SrpUxSnapIn.resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\SrpUxSnapIn.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Messaging.resources\v4.0_4.0.0.0_es_b03f5f7f11d50a3a\System.Messaging.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xaml.Hosting.resources\v4.0_4.0.0.0_de_31bf3856ad364e35\System.Xaml.Hosting.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\ufxsynopsys.PNF C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\CreateAppSetting.aspx.fr.resx C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\fr\DropSqlPersistenceProviderLogic.sql C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\System.Data.Linq.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\MiguiControls.Resources\v4.0_1.0.0.0_en_31bf3856ad364e35\MIGUIControls.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SecurityAuditPoliciesSnapIn.resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\SecurityAuditPoliciesSnapIn.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ObjectModel\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ObjectModel.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\ja-JP\Printing2.adml C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\DE\aspnet_compiler.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\en-US\FeedbackNotifications.adml C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\ja-JP\Thumbnails.adml C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\wdmaudioapo.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\SecureBoot.psd1 C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\.NET CLR Data\0407\_DataPerfCounters_d.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\msgpiowin32.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\SharedReg12.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Permissions\App_LocalResources\managePermissions.aspx.resx C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq.resources\v4.0_4.0.0.0_fr_b77a5c561934e089\System.Data.Linq.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Help\mui\0409\odbcinst.chm C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\fr\PresentationBuildTasks.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.Interop\v4.0_2.0.0.0__31bf3856ad364e35\Microsoft.GroupPolicy.Interop.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Edit_R_RHP.aapp C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\peverify.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\DeviceCompat.admx C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\mdmvdot.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UnInstallProfile.SQL C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\confirmation.ascx C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state_perf.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\Microsoft.Workflow.Compiler.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.resources\v4.0_4.0.0.0_de_31bf3856ad364e35\System.Activities.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Services.resources\v4.0_4.0.0.0_ja_b03f5f7f11d50a3a\System.Web.Services.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\UninstallSqlState.sql C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\Microsoft.Transactions.Bridge.Dtc.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\Microsoft.SecureBoot.Commands.Resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData.resources\v4.0_4.0.0.0_ja_31bf3856ad364e35\System.Web.DynamicData.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v1.0.3705\regsvcs.exe.config C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\ManageAppSettings.aspx.it.resx C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Browser Information Discovery

discovery

Processes

C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe

"C:\Users\Admin\AppData\Local\Temp\2025-05-03_2aa6a01aacb78594f27a081de95ffd2d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe"

Network

Files

C:\Program Files\7-Zip\7-zip.dll

MD5 634af7f5f9c776e046c22b2e9e112579
SHA1 11192c5a8a49a7a3b8780ed70c963cbe6584b49d
SHA256 2195a244ecbb1d1d9a53c8484dfc7c344c48ad6f25907c19d96deefb6aca9410
SHA512 f3f29f8d79e93ff63c33ac78f5cc031302ac8a388ae33c79bafc36ee7793352a49b69fc226052332701c961cd881243138edba09eb89a0dca5b571557572dbf6

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll

MD5 354706351a6204f5240f6113e31db923
SHA1 f5325bd976b653251a3de3550ddb34a1ae321f9d
SHA256 60fd58c7d9b8a37d202723c0b539ea24b060902a1042a35a07414c3f8b244610
SHA512 859ee9a7decdeec15d3e0c0a654ff0f5abc7459da1e138f41eded626de4f957c34f50fb1951c79c18edfb7e68bb25e945eecf6e0cc3a5540035c2652ec59c721