Malware Analysis Report

2025-08-05 15:05

Sample ID 250519-rdz4jsyrw2
Target 2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch
SHA256 70d289cf197d637a1a93a979de56cf776622993a827feb74ac139f15ba2d8985
Tags
gofing credential_access discovery ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

70d289cf197d637a1a93a979de56cf776622993a827feb74ac139f15ba2d8985

Threat Level: Known bad

The file 2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch was found to be: Known bad.

Malicious Activity Summary

gofing credential_access discovery ransomware spyware stealer

Gofing

Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

Gofing family

Renames multiple (52) files with added filename extension

Manipulates Digital Signatures

Drops file in Drivers directory

Credentials from Password Stores: Windows Credential Manager

Drops startup file

Loads dropped DLL

Reads user/profile data of web browsers

Drops Chrome extension

Drops desktop.ini file(s)

Drops autorun.inf file

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Browser Information Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-05-19 14:05

Signatures

Gofing family

gofing

Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2025-05-19 14:05

Reported

2025-05-19 14:07

Platform

win11-20250502-en

Max time kernel

145s

Max time network

102s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"

Signatures

Gofing

ransomware gofing

Gofing family

gofing

Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

Description Indicator Process Target
N/A N/A N/A N/A

Renames multiple (52) files with added filename extension

ransomware

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\gm.dls C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\afunix.sys C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\uk-UA\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Credentials from Password Stores: Windows Credential Manager

credential_access stealer

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops Chrome extension

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Offline Web Pages\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Media\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Downloaded Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Keywords\{A5A7C794-3D59-41DF-915F-19ACDA526FC9}2052.bin C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\capiprovider.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ja-JP\mapistub.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Offline-Common-Package~31bf3856ad364e35~amd64~it-IT~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DirectPlay-OC-Opt-WOW64-Package~31bf3856ad364e35~amd64~ja-JP~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\Dism\it-IT\DismProv.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\ja-JP\netvwifimp.inf_loc C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\de-DE\MSFT_GroupResource.schema.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\mscpxl32.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ja-JP\ncpa.cpl.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\mycomput.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-PAW-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\LE_CTL_ar6320_3p0_NFA344a_highTX_M.bin C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\it-IT\SimAuth.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0113~31bf3856ad364e35~amd64~en-US~10.0.22000.318.cat C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\adrclient.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\cnvfat.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\de-DE\DAMM.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\de-DE\raschapext.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\framedynos.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\AppxApplicabilityEngine.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-DisposableClientVM-Package~31bf3856ad364e35~amd64~uk-UA~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-VmBus-Host-merged-Package~31bf3856ad364e35~amd64~es-ES~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\UevAgentPolicyGenerator.exe C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\de-DE\BTAGService.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Keywords\{A5A7C794-3D59-41DF-915F-19ACDA526FC9}16393.bin C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Printing_Admin_Scripts\es-ES\pubprn.vbs C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\stdprov.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\RemovableMediaProvisioningPlugin.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\control.exe C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\de-DE\ykinx64.inf_loc C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\it-IT\nete1e3e.inf_loc C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\HalExtIntcPseDMA.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\SettingsHandlers_PCDisplay.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\SortServer2003Compat.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\fr-FR\wecutil.exe.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\it-IT\rpcnsh.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ja-JP\XInput9_1_0.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\ja-JP\mf.inf_loc C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\SyncController.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\fr-FR\appmgr.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\mfvfw.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-ApplicationGuard-Package~31bf3856ad364e35~amd64~~10.0.22000.493.cat C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\PCShellCommonProxyStub.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\PerceptionSimulation\SimulatedThumbstickControl.xbf C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\SettingsHandlers_ManagePhone.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Pnp-PlatformServices-Package~31bf3856ad364e35~amd64~de-DE~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Telephony-PhoneOm-Package~31bf3856ad364e35~amd64~~10.0.22000.120.cat C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Desktop-BCDTemplate-Client-Package~31bf3856ad364e35~amd64~it-IT~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\Dism\es-ES\VhdProvider.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\en-US\msclmd.inf_loc C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\es-ES\iaLPSS2i_GPIO2_GLK.inf_loc C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\NDKPing.exe C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\cero.rs C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\spp\tokens\legacy\spc-generic-private.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\wpdmtp.mof C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\fr-FR\dc1-controller.inf_loc C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\en-US\MSFT_RegistryResource.strings.psd1 C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\msvidc32.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wpnclient.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\es-ES\RunAsHelper.strings.psd1 C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\vss_ps.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\de-DE\usbstor.inf_loc C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\en-US\rtwlanu_oldIC.inf_loc C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\REFINED.INF C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Management.Instrumentation.Resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_1.0.38.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderAppList.scale-200_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\BadgeLogo.scale-100.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-black\NotepadSmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.Algorithms.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\rsod\wordmui.msi.16.en-us.boot.tree.dat C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.Uri.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-left-pressed.gif C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\cs-cz\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-256.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Theme_Photo_GreenClovers_Background.jpg C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.pdf C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\nn.pak C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.43\msedgeupdateres_pt-BR.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PaintSmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-80_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\IRectangle.js C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\MSFT_PackageManagement.schema.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Microsoft.VisualBasic.Forms.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\th.pak C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\Divider.js C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\share.svg C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-30_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Xbox_SplashScreen.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\PeopleAppList.targetsize-32_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\MSFT_PackageManagementSource.schema.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Common Files\System\Ole DB\msdatl3.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.2008.32311.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.28604.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\JSByteCodeCache_64 C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-80_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-32_altform-lightunplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-64_altform-lightunplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Console.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.targetsize-24_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreSplashScreen.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\Image.js C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\ReachFramework.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_editpdf_18.svg C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Resources\et-ee\Resources.resw C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Theme_Photo_SunlitForest_Thumbnail.jpg C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\sample-thumb.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsSmallTile.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\getId.js C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\componentAs\composeComponentAs.js C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailMediumTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\cloud_secured_lg.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Trust Protection Lists\Mu\Entities C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\onnxruntime.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\Other C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-256_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\x64\msvpxenc.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosWideTile.contrast-black_scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\Standard.targetsize-64_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\mscorlib.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\rsod\onenote.x-none.msi.16.x-none.boot.tree.dat C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.UltraWinStatusBar.v11.1.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\App_LocalResources\manageSingleRole.aspx.de.resx C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\fr-FR\ActiveXInstallService.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.Serialization.Json.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\System.Data.Entity.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\System.Runtime.DurableInstancing.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\v4.0_4.0.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Boot\EFI\fi-FI\bootmgr.efi.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\courfr.fon C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild\Microsoft.Build.Core.xsd C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\ja-JP\DmaGuard.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\big5.nlp C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\System.Web.Entity.Design.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscordbi.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\de-DE\Printing2.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\ja-JP\tcpip.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Boot\EFI\lt-LT\bootmgfw.efi.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\audioendpoint.PNF C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\defltwk.inf C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\net7500-x64-n650f.inf C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\ManageAppSettings.aspx.it.resx C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp.aspx.fr.resx C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\UIAutomationClientsideProviders.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\System.ServiceModel.Discovery.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ImmersiveControlPanel\images\logo.targetsize-256_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_difr.x3d C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\home0.aspx.es.resx C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Providers\App_LocalResources\providerList.ascx.it.resx C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe.config C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Tpm.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\microsoft.tpm.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics.resources\v4.0_4.0.0.0_de_b77a5c561934e089\System.Numerics.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig.resources\v4.0_4.0.0.0_ja_b03f5f7f11d50a3a\WsatConfig.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\.NET Data Provider for SqlServer\0410\_dataperfcounters_shared12_neutral_d.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\netr7364.inf C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework-SystemXml.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.Linq.resources\v4.0_4.0.0.0_ja_b77a5c561934e089\System.Xml.Linq.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\XsdBuildTask.resources\v4.0_4.0.0.0_es_31bf3856ad364e35\XsdBuildTask.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Cursors\help_il.cur C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\prnms002.inf C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\sensorsalsdriver.inf C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.CSharp.targets C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\en\DropSqlWorkflowInstanceStoreLogic.sql C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\SMDiagnostics.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\it-IT\WorkflowServiceHostPerformanceCounters.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\System.Configuration.Install.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\c_apo.inf C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\Regasm.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations.resources\v4.0_4.0.0.0_fr_31bf3856ad364e35\System.ComponentModel.DataAnnotations.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\wvid.inf C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\SecStoreFile.ico C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\SmtpSettings.aspx.resx C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Core.Presentation.resources\v4.0_4.0.0.0_de_31bf3856ad364e35\System.Activities.Core.Presentation.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel.resources\v4.0_4.0.0.0_de_b77a5c561934e089\System.IdentityModel.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Cursors\pen_il.cur C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\GARAIT.TTF C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100cht_x86 C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\Browsers\gateway.browser C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\Microsoft.Build.Utilities.v4.0.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.ApplicationServices.resources\v4.0_4.0.0.0_ja_31bf3856ad364e35\System.Web.ApplicationServices.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\it-IT\OOBE.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Boot\EFI\ru-RU\bootmgr.efi.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\EPDF_RHP.aapp C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Browser Information Discovery

discovery

Processes

C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe

"C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"

Network

Files

C:\Program Files\7-Zip\7z.dll

MD5 b714a1750d204d0a7e09fed3e52cd607
SHA1 b502d99d7d4b87ed61d59de28e646136c4675556
SHA256 38d6da4752aace0211ba266133b799751ccc02cc08abc5a27b0207bae5eafbfd
SHA512 2ed32a88a49f3740b2e6fa7b489275223cea2c4926223b33312eeeccf0e1f86b3fcc700d119fa5370ff4421aa2236cb565a0ce74d0b8b70e3f3d9daa733b4c16

Analysis: behavioral1

Detonation Overview

Submitted

2025-05-19 14:05

Reported

2025-05-19 14:07

Platform

win10v2004-20250502-en

Max time kernel

150s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"

Signatures

Gofing

ransomware gofing

Gofing family

gofing

Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\uk-UA\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\afunix.sys C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\gm.dls C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Credentials from Password Stores: Windows Credential Manager

credential_access stealer

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Drops Chrome extension

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Downloaded Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Media\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Offline Web Pages\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Hello-Face-Migration-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_c62e9f8067f98247\Amd64\TTFSUB.GPD C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\spaceport.inf_amd64_6383331cfa0a32be\spaceport.sys C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\ja-JP\storagewmi.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DirectPlay-OC-Opt-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Printing-WFS-FoD-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\ja-JP\mdmbtmdm.inf_loc C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\KBDJAV.DLL C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\fr-FR\mimofcodec.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ja-JP\urlmon.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\uk-UA\ncpa.cpl.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\it-IT\ialpssi_gpio.INF_loc C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Dism\LogProvider.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\winrm\0409\winrm.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WindowsSearchEngineSKU-Group-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\SHCore.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\msvidc32.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\wlanutil.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\de-DE\wsp_fs_uninstall.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Storage-VSP-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.985.cat C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Vpci-VirtualDevice-DDA-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\ja-JP\netrtwlane_13.inf_loc C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\AppVTerminator.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\rasplap.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\fr-FR\bootcfg.exe.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\de-DE\PolicMan.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\RemoteDesktopServices-Base-Package~31bf3856ad364e35~amd64~~10.0.19041.84.cat C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Keywords\ti_cnn_zh-CN.table C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\msdelta.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\es-ES\uefi.inf_loc C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ja-JP\aeevts.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ja-JP\dot3dlg.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Http-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DesktopFileExplorer-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\de-DE\netmscli.inf_loc C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\tapi3.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\AarSvc.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Lxss-Optional-merged-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\de-DE\SmartSAMD.inf_loc C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\de-DE\cht4nulx64.inf_loc C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\ja-JP\microsoft_bluetooth_hfp_hf.inf_loc C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\Microsoft.Uev.CabUtil.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\onex.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\en-US\slc.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mchgr.inf_amd64_399f04975a0af112\examc.sys C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\de-DE\urssynopsys.inf_loc C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\EapTeapConfig.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Dism\it-IT\WimProvider.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetAdapter\MSFT_NetAdapterPowerManagement.Format.Helper.psm1 C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ir41_qcx.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ja-JP\sxproxy.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\shellExecute.xsd C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ja-JP\mdminst.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\mycomput.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\sdbinst.exe C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\wsp_health_uninstall.mof C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-IntegrationComponents-VirtualDevice-Server-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\de-DE\hiddigi.inf_loc C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Dism\fr-FR\DmiProvider.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\sscore.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-KernelInt-VirtualDevice-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\MultiPoint-Connector-Opt-Package~31bf3856ad364e35~amd64~~10.0.19041.746.cat C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\es-ES\netnwifi.inf_loc C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\eeprom_ar6320_3p0_NFA344a_highTX_LE_9.bin C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsFormsIntegration.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.scale-400.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\kb-locked.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ONBttnPPT.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_2019.716.2316.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\security\java.security C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\LargeTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Programmer.targetsize-24_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\excluded.txt C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\vcruntime140.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Xml.Linq.Resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-48_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\Ratings\Yelp5.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\AddressBook2x.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square310x310Logo.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GARA.TTF C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libcrystalhd_plugin.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreMedTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\_Resources\11.rsrc C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarBadge.scale-150.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailWideTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_Safety_NoObjects.jpg C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteLargeTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\download.svg C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.SapClient.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-locale-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-20_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\file_info2x.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Common Files\System\Ole DB\msdaer.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Doughboy.scale-250.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Outlook.scale-300.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_133.0.3065.69_neutral__8wekyb3d8bbwe\SmallLogo.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Globalization.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sk-sk\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Windows Media Player\Media Renderer\DMR_120.jpg C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreLogo.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailLargeTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageStoreLogo.scale-150_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-GoogleCloudCacheMini.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarBadge.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Configuration\config.xml C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-40.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\bs.pak.DATA C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libaraw_plugin.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_sse2_plugin.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.Common.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-fr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ja-jp\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\fi.pak C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.White.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\AppTiles\StoreLogo.scale-150.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Fonts\serf1256.fon C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Help\mui\040C\cliconf.chm C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\DE\System.Data.Resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ja\System.xml.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\v4.0_3.0.0.0_fr_31bf3856ad364e35\Microsoft.WSMan.Management.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\de-DE\sdiageng.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\en-US\Power.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\it-IT\AppPrivacy.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\c_fsquotamgmt.inf C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CP1253.TXT C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\1031\dv_aspnetmmc.chm C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\ManageAppSettings.aspx.fr.resx C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\ja\SqlWorkflowInstanceStoreSchemaUpgrade.sql C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Net.Http.WebRequest.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationUI.resources\v4.0_4.0.0.0_de_31bf3856ad364e35\PresentationUI.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\App_LocalResources\security0.aspx.ja.resx C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\confirmation.ascx.fr.resx C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\home1.aspx.es.resx C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\System.Web.RegularExpressions.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.GroupPolicy.AdmTmplEditor.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.resources\v4.0_4.0.0.0_ja_b77a5c561934e089\System.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Speech\Engines\TTS\en-US\M1033ZIR.Keyboard.NUS C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\BOOKOSI.TTF C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\apps.inf C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\hidinterrupt.inf C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\mdmracal.inf C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activities.resources\v4.0_4.0.0.0_de_31bf3856ad364e35\System.ServiceModel.Activities.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\de-DE\ServiceControlManager.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Prefetch\RUNTIMEBROKER.EXE-06226CEB.pf C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\web_hightrust.config.default C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\it\Microsoft.Transactions.Bridge.Resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\WebAdminWithConfirmationNoButtonRow.master C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\en-US\ReAgent.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\wingding.ttf C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\ESENT\esentprf.hxx C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ES\System.DirectoryServices.Protocols.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\System.Numerics.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v3.5\SQL\ja\DropSqlPersistenceProviderLogic.sql C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v3.5\3082\vbc7ui.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\System.Security.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v3.5\SQL\EN\DropSqlPersistenceProviderSchema.sql C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\XamlBuildTask.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\es\aspnet_rc.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.tlb C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\Microsoft.Build.Tasks.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr-FR\ServiceModelPerformanceCounters.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\addUser.aspx C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing.resources\v4.0_4.0.0.0_ja_b03f5f7f11d50a3a\System.Drawing.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.XPath.XDocument\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Xml.XPath.XDocument.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\it-IT\PushToInstall.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Text.RegularExpressions.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\System.Runtime.WindowsRuntime.UI.Xaml.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\Taskbar.admx C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Provisioning\CountryTable.xml C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Speech_OneCore\Engines\TTS\es-ES\M3082Pablo.TBT.NUS C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\UGTHRSVC\0C0A\gthrctr.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\mdmcodex.inf C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_vcomp100_x64 C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v3.5\de\Microsoft.Data.Entity.Build.Tasks.Resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\ja-JP\UserProfiles.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Browser Information Discovery

discovery

Processes

C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe

"C:\Users\Admin\AppData\Local\Temp\2025-05-19_7bbc90bb762b031f62f1a56871a6a5ce_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"

Network

Country Destination Domain Proto
NL 88.221.24.89:443 www.bing.com tcp
NL 88.221.24.89:443 www.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 c.pki.goog udp
GB 216.58.201.99:80 c.pki.goog tcp

Files

C:\Program Files\7-Zip\7-zip.dll

MD5 75550d4e7219303c63e565c92b5bcab4
SHA1 cab9daccb11d3a1f5b28354da2ed09a6317fd7ae
SHA256 5a1d2716898e209b8beab310f1d62d9e7a5951549dcd24b8527f844e2647d4db
SHA512 0b2bf0a56c4fd4393dfebe1706e59e8d8393c1b1767de5983b3dda13d9e14644c35c3cd89d6c958a6a07b7da6eaa56670378a416d8a50bcd10217237e7fe7175

C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL

MD5 91f37c1fd4b0b79fa0689f8486d0526d
SHA1 236ac91a53d0235d3bb5efde6bf0d3a6f05819de
SHA256 9bd4160f1abf2f9cdf81768773c2e529f430c4b4e6e30dca20075379ef7662c1
SHA512 622a016ad8822b4f4fe03853316487218aa16ad31a51a542ba1f6a16078154a5535b777414b0e27b34c16cc7eb4c4173bde52b49eed9051347b423d6ff45ebf4

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll

MD5 2ca84ec33c5b6ff5090e91e1316a8fd9
SHA1 76a31f0d2c24777181ceac2ef16ea02591126089
SHA256 756509fca9b3a5271f159ae3745b983d7bc98ae07059aa1ba855f6c05cf07f85
SHA512 a814ae785d19920e1a4e11f16686329b59eb1790b9d08ac334df68a2f8db74540af748e6650abc7ab7eb90ccf079e1da96ef99cbc5514ee5b403dd3fac955374