Malware Analysis Report

2025-08-10 20:09

Sample ID 250518-r8rqnafj4y
Target 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch
SHA256 6e285adb69def0f37eb2a6cb3742d3f8d012f98bce958a369a1316478b10ba56
Tags
gofing credential_access discovery ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6e285adb69def0f37eb2a6cb3742d3f8d012f98bce958a369a1316478b10ba56

Threat Level: Known bad

The file 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch was found to be: Known bad.

Malicious Activity Summary

gofing credential_access discovery ransomware spyware stealer

Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

Gofing family

Gofing

Manipulates Digital Signatures

Drops file in Drivers directory

Credentials from Password Stores: Windows Credential Manager

Reads user/profile data of web browsers

Drops startup file

Loads dropped DLL

Drops desktop.ini file(s)

Drops Chrome extension

Drops file in System32 directory

Drops autorun.inf file

Drops file in Windows directory

Drops file in Program Files directory

Browser Information Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-05-18 14:52

Signatures

Gofing family

gofing

Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-05-18 14:52

Reported

2025-05-18 14:54

Platform

win10v2004-20250502-en

Max time kernel

150s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"

Signatures

Gofing

ransomware gofing

Gofing family

gofing

Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\gm.dls C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\uk-UA\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\afunix.sys C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Manipulates Digital Signatures

Description Indicator Process Target
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Credentials from Password Stores: Windows Credential Manager

credential_access stealer

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Drops Chrome extension

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\$Recycle.Bin\S-1-5-21-3674642747-2260306818-3009887879-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Media\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Downloaded Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\dlnashext.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\en-US\NetworkExplorer.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\InstallShield\setupdir\0804\_setup.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management\Microsoft.PowerShell.Management.psd1 C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetLbfo\MSFT_NetLbfoTeamMember.format.ps1xml C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\NetFirewallSecurityFilter.cmdletDefinition.cdxml C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\structureTable.xsd C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\cnvfat.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\en-US\authfwgp.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\AcLayers.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\AccountsRt.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Configuration\BaseRegistration\de-DE\MSFT_MetaConfigurationExtensionClasses.Schema.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\SyncCenter.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Windows.Graphics.Display.BrightnessOverride.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\EventTracingManagement\MSFT_EtwTraceProvider_v1.0.cdxml C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\hh.exe.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\winmsipc.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Com\mtsadmin.tlb C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\CoreShellAPI.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\EditionUpgradeManagerObj.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\OneDrive.ico C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\SubRange.uce C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WerEnc.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\uk-UA\MSFT_RegistryResource.schema.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Provisioning\provcommon.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Dism\en-US\AppxProvider.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PKI\pki.psd1 C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\audiodev.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\biwinrt.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\cryptxml.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\dinput8.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Dism\fr-FR\GenericProvider.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\WinSATAPI.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\downlevel\api-ms-win-service-core-l1-1-1.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\DefaultAccountTile.png C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Dism\ja-JP\DmiProvider.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Licenses\neutral\_Default\Professional\license.rtf C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\UserAccountControlSettings.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WinMetadata\Windows.Devices.winmd C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WinTypes.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\AppvClient.psd1 C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetConnection\NetConnection.psd1 C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Dism\fr-FR\ImagingProvider.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Dism\ja-JP\SmiProvider.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\F12\it-IT\F12Platform.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.xls C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\MSFlacDecoder.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\ja-JP\MSFT_ProcessResource.strings.psd1 C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\ProcessSet\ProcessSet.Schema.psm1 C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Storage\ResiliencySetting.cdxml C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\InstallShield\setupdir\0005\_setup.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\de-DE\MSFT_RoleResourceStrings.psd1 C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\da-DK\quickassist.exe.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ddraw.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\MFC40u.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\Windows.ApplicationModel.Store.TestingFramework.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\joy.cpl.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\pots.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Dism\DismCorePS.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\MUI\0411\mscorees.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WinMetadata\Windows.Data.winmd C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\gptext.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\secinit.exe.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Dism\TransmogProvider.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\DatabaseCompare_col.hxc C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireSmallTile.scale-100.jpg C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\MicrosoftAccount.scale-100.png C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_targetsize-16.png C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsSmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\bg_get.svg C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\ResiliencyLinks\vk_swiftshader_icd.json.DATA C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\VideoEditor.Common\Resources\ResourceDictionary.xbf C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubStoreLogo.scale-200_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClient.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-100.png C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.bundle C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MixedRealityPortalMedTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\Microsoft.PackageManagement.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\QRCode.pmp C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.43\msedgeupdateres_fa.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmirror_plugin.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_2019.125.2243.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\import_google_contacts\googleImportNoResults.png C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-72.png C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Xaml.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\new_icons_retina.png C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag.png C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_setid_plugin.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Beta.msix.DATA C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\Microsoft.PackageManagement.MetaProvider.PowerShell.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr\default.jfc C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL077.XML C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\VideoFrameExtractor\UserControls\RangeSelector.xbf C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\SmallTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.EventBasedAsync.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\System.Windows.Forms.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\LibrarySquare150x150Logo.scale-125.png C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-80.png C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\wintlim.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-si\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsBase.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\7-Zip\Lang\ug.txt C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\gstreamer-lite.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\management\management.properties C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-il\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Windows Media Player\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-64_altform-unplated_contrast-high.png C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\mraut.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreLargeTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-60.png C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ja\System.Runtime.WindowsRuntime.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Utilities.v4.0.resources\v4.0_4.0.0.0_it_b03f5f7f11d50a3a\Microsoft.Build.Utilities.v4.0.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\de-DE\nca.adml C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\vgasysr.fon C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\hidspi_km.PNF C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\spaceport.PNF C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\webengine.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\Microsoft.JScript.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Workflow.VisualBasic.Targets C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.Appx.PackageManager.Commands.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\Appx.psd1 C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\0000\PerfCounters_d.ini C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\cht4vx64.PNF C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\netnb.inf C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\System.Configuration.Install.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\es\system.data.sqlxml.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\PERFLIB\0407\perfh.dat C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\mdmgen.inf C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Application.aspx.resx C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\findUsers.aspx.ja.resx C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\de\SqlWorkflowInstanceStoreLogic.sql C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\System.ComponentModel.Composition.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\System.Xml.Linq.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Accessibility.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_filter.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\en-US\MicrosoftEdge.adml C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\es-ES\UserExperienceVirtualization.adml C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\fr-FR\FileRecovery.adml C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\iSCSI.admx C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\Inkfree.ttf C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-black_scale-400.png C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardAddUser.ascx.ja.resx C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Build.Conversion.v4.0.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Management.Instrumentation.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\System.Data.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets.Resources\v4.0_1.0.0.0_fr_31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.Resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100esn_x86 C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\ja\UIAutomationClient.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\migration.dat.LOG1 C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\fr-CA_BitLockerToGo.exe.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\corbelb.ttf C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\es\sysglobl.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\System.Activities.DurableInstancing.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\CEIPEnable.admx C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\es-ES\Handwriting.adml C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Installer\SourceHash{64A3A4F4-B792-11D6-A78A-00B0D0180381} C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Security.aspx C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\System.RunTime.Serialization.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ja\sysglobl.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\OCR\it-it\MsOcrRes.orp C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\de-DE\EventViewer.adml C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\es-ES\PeerToPeerCaching.adml C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\ja-JP\AVSValidationGP.adml C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\eaphost.inf C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\netwew00.inf C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\libcef.dll.15EE1C08_ED51_465D_B6F3_FB152B1CC435 C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clretwrc.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Cursors\aero_link_im.cur C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\ARIALNB.TTF C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Installer\SourceHash{90160000-008C-0000-1000-0000000FF1CE} C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfdll.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\Microsoft.Build.Conversion.v4.0.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\de-DE\Printing.adml C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Boot\EFI\es-ES\bootmgr.efi.mui C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Browser Information Discovery

discovery

Processes

C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe

"C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"

Network

Country Destination Domain Proto
GB 2.18.27.82:443 www.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.178.3:80 c.pki.goog tcp

Files

C:\Program Files\7-Zip\7-zip.dll

MD5 c75cff4c50e998014ee71f3796118dc7
SHA1 1132cec24ad31be0e52a7670c42ed6879ac02d7e
SHA256 513c90019d720c39b65ffb5749f8cce1b7904b2911592cce07f3ec5796198839
SHA512 5d6e0e4857a722dc87d96429b7a8ad489b45c32370c801b54ba8ffc4b0e4c6d3aa16e801acf76fc564867b74a31daa4c5bf27faafafc717f6ef87107b96ffa5b

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll

MD5 14d8c97debc772d4c0b11d27271a74d7
SHA1 b5755f64ed0e9fa744311e26c633ff484e989f9c
SHA256 451d4826a93736b23adc4605eb1ee066ac90493eec77de261fbff512e437f55e
SHA512 8e582281bd3abfeb19de6d76e1d854cea331102dcf6df8589daecf8e76ed5fbf3c7fe0d205b0df3fe81c69bd46e5b58a5155cbd4fe275249fab5374a7fc8c9f8

C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL

MD5 abb4eea3878fbe935fd963d5fb4086aa
SHA1 4fa217e37752778ef04e09b2f11095d9e444a973
SHA256 2acc16e9bcfec425fa59f91c64359b75cc87131f8d79c6c6f6ded1e4b1544983
SHA512 dab14e5a3b00d37926bd0e9824bcfa1fec7a993b3d1bad6d337a7b4e129d615b4cab9f525eb75f2b76e17351576b8eaab69a5744e4eee25eb6e54f0ba90d0e67