Malware Analysis Report

2025-08-05 15:05

Sample ID 250519-rkzrcsyr17
Target 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch
SHA256 47a7bc388abe591e33fc5626fd252c42dd4835d021c24a313ad1ff2ac9605f83
Tags
gofing credential_access discovery ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

47a7bc388abe591e33fc5626fd252c42dd4835d021c24a313ad1ff2ac9605f83

Threat Level: Known bad

The file 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch was found to be: Known bad.

Malicious Activity Summary

gofing credential_access discovery ransomware spyware stealer

Gofing family

Gofing

Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

Renames multiple (52) files with added filename extension

Drops file in Drivers directory

Manipulates Digital Signatures

Reads user/profile data of web browsers

Credentials from Password Stores: Windows Credential Manager

Executes dropped EXE

Loads dropped DLL

Drops startup file

Drops Chrome extension

Drops desktop.ini file(s)

Drops autorun.inf file

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Browser Information Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-05-19 14:15

Signatures

Gofing family

gofing

Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-05-19 14:15

Reported

2025-05-19 14:18

Platform

win10v2004-20250502-en

Max time kernel

150s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"

Signatures

Gofing

ransomware gofing

Gofing family

gofing

Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\uk-UA\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\gm.dls C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\afunix.sys C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Manipulates Digital Signatures

Description Indicator Process Target
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Credentials from Password Stores: Windows Credential Manager

credential_access stealer

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Drops Chrome extension

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Media\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\$Recycle.Bin\S-1-5-21-3920234085-916416549-2700794571-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\default.help.txt C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\g711codc.ax.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\iyuv_32.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\dmenrollengine.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\eventcreate.exe C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\fr-FR\cmdl32.exe.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\ja-JP\MSFT_GroupResource.strings.psd1 C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\boot.sdi C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\en-US\jscript.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\rpcnsh.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\PaymentMediatorServiceProxy.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\chartv.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\en-US\netcenter.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\en-US\rstrui.exe.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\IndexedDbLegacy.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\InstallShield\setup.exe C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\bthprops.cpl C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\en-US\eapsimextdesktop.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Windows.Internal.UI.Shell.WindowTabManager.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\en\Microsoft.Dism.Powershell.Resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\listsvc.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\AuthFWWizFwk.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Dism\es-ES\CbsProvider.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\sxs.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\en-US\mmc.exe.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetworkConnectivityStatus\MSFT_DAConnectionStatus.types.ps1xml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\MSFT_WindowsOptionalFeature.schema.mof C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\WindowsOptionalFeatureSet\WindowsOptionalFeatureSet.psd1 C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\iSCSI\iSCSISession.cdxml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\at.exe.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\DDORes.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Com\en-US\comrepl.exe.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Dism\ja-JP\ProvProvider.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Windows.Media.Protection.PlayReady.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\downlevel\API-MS-Win-Security-Lsalookup-L2-1-1.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\dxtrans.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\MFC40u.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\appmgr.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Nlsdl.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Printing_Admin_Scripts\ja-JP\pubprn.vbs C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Speech\SpeechUX\sapi.cpl C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Storage\FileServer.cdxml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\es-MX\windows.ui.xaml.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Dism\it-IT\VhdProvider.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetEventPacketCapture\MSFT_NetEventVmNetworkAdatper.cdxml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\g711codc.ax.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Dism\ja-JP\CbsProvider.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\MSFT_EnvironmentResource.schema.mof C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\cmstp.exe C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\DevicePairing.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\fr-FR\perfhost.exe.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\TestDtc.psm1 C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\uk-UA\MSFT_ScriptResource.schema.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\winmsipc.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\en-US\html.iec.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\KBDSYR2.DLL C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\en-US\DeviceDisplayStatusManager.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\SyncHost.exe C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\msmpeg2enc.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\SCardDlg.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\XPSViewer\es-ES\XPSViewer.exe.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\netcenter.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\fr-FR\els.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyView.scale-100.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationCore.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\AdeModule.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Client.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubSplashWideTile.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-200_contrast-high.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Yahoo-Dark.scale-100.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-180.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewCommentRTL.White.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\LargeTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookLargeTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-40.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.Upgrade.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\System.Xaml.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\index_poster.jpg C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\132.0.2957.140.manifest C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\seqchk10imm.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Microsoft.PackageManagement.MetaProvider.PowerShell.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_lg.gif C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\core_icons_retina.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Trust Protection Lists\Sigma\Other C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-400_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLogoExtensions.targetsize-63.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\DSMESSAGES.XML C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\db2v0801.xsl C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-72_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\SpotlightMail_2017-09.gif C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Shims.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\GKWord.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\InstallerMainShell.tlb C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.VisualElementsManifest.xml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\Maple.gif C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\MsEdgeCrashpad\metadata C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SimpleProgressBarTheme.xbf C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\microsoft.system.package.metadata\S-1-5-21-3920234085-916416549-2700794571-1000-MergedResources-0.pri C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-200_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-96.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\officons.ttf C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Dark.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-multibyte-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\rhp_world_icon.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Stable.msix.DATA C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\FindRename.kix C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\MedTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\24.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square150x150Logo.scale-125.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\SplashScreen.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\DebugAndTrace.aspx C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\caspol.exe.config C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ja\System.Security.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDCommon\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDCommon.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Core.Presentation.resources\v4.0_4.0.0.0_fr_31bf3856ad364e35\System.Activities.Core.Presentation.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.Activities.resources\v4.0_4.0.0.0_es_31bf3856ad364e35\System.Workflow.Activities.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Boot\PCAT\zh-CN\memtest.exe.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\.NET CLR Networking\0411\_Networkingperfcounters_v2_d.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\.NET Data Provider for SqlServer\0407\_dataperfcounters_shared12_neutral_d.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\es\DropSqlPersistenceProviderSchema.sql C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.DurableInstancing.resources\v4.0_4.0.0.0_ja_31bf3856ad364e35\System.Activities.DurableInstancing.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Entity.resources\v4.0_4.0.0.0_es_b77a5c561934e089\System.Web.Entity.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\en-US\DmaGuard.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Cursors\size2_rm.cur C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100chs_x64 C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Drawing.tlb C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\es-ES\Programs.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\it-IT\LeakDiagnostic.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Resources\Themes\aero\fr-FR\aerolite.msstyles.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\arialbd.ttf C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\mdmaiwat.inf C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ImmersiveControlPanel\images\logo.scale-150.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\home1.aspx.resx C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Data.Services.Design.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\ja\UIAutomationClientsideProviders.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\it\System.DirectoryServices.Resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.log C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\MSDTC\0410\msdtcprf.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\App_LocalResources\chooseProviderManagement.aspx.ja.resx C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ThirdPartyNotices.txt C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\fr\mscorrc.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\es\System.Web.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\System.Xml.Linq.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Client.resources\v4.0_4.0.0.0_it_b77a5c561934e089\System.Data.Services.Client.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\SOS.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\Browsers\winwap.browser C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Internals.aspx.fr.resx C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.ComponentModel\v4.0_4.0.0.0__31bf3856ad364e35\System.Workflow.ComponentModel.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\it-IT\Netlogon.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\ja-JP\WindowsColorSystem.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\navigationBar.ascx.ja.resx C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\Browsers\ie.browser C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.rsp C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\normnfc.nlp C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\es-ES\DCOM.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\es-ES\Reliability.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\it-IT\OOBE.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\srm-fci.admx C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\npsvctrig.inf C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\termmou.PNF C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\3082\cscompui.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\System.ServiceModel.Discovery.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\System.Numerics.Vectors.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\it-IT\Logon.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Speech_OneCore\Engines\TTS\en-US\M1033Eva.ACL C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Speech_OneCore\Engines\TTS\es-ES\MSTTSLocEsES.dat C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Cursors\person.svg C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\fr\InstallUtil.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.Overlapped.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\System.RunTime.Serialization.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Browser Information Discovery

discovery

Processes

C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe

"C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
GB 2.21.6.169:443 www.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 c.pki.goog udp
GB 216.58.201.99:80 c.pki.goog tcp

Files

C:\Program Files\7-Zip\7-zip.dll

MD5 76da82ad2c387ed31854eb7e72d6a5d6
SHA1 ec921c3d069a21fdcbb6bb8b342f9bc8caecabd2
SHA256 0dc55064c684c4c510e3281c6422fb61563c63be36d02ca06e28e8bf3b6cc23e
SHA512 8d79e57abfbd22200b8becb79937a9d5037bd07cbb34fc116c8a832981c235f2061d3bd9b8b47c306fcc29ad7f50fcd638ae69538015a0687e1b4fde40d0bab1

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll

MD5 60f48ceea14b67780412e9cd2d8417aa
SHA1 2f26cd516874f27d49305e829086db651dda3745
SHA256 ce0ec48522a6c657de02f1795ae6e1969e2d5a90fd2e12658062fecfee07d040
SHA512 9ce31011d1ed4c1c5bb7161a037d16294d5829d458ecf3c2d8ddaf7190cf29c8401af28321c0513ba65ee84cb0e1786d389a75cd32e5a0b713710485f1eeb1f7

C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL

MD5 302751612475c6e873168cca677f37a2
SHA1 5a7120f28e6997312ae6f993f99cd8ba410b2c25
SHA256 a5267ce107436c740fcc63ef84c03746330544d9eb9e38908e6150a8fe9a95aa
SHA512 7210f3d178345d2aef880a230de915ce57ceeee7e78794c5058f25b305b90a1b95d3610124605ffdd6543eee78b8772d19e93af621d6ce65401dada3bac6fb93

Analysis: behavioral2

Detonation Overview

Submitted

2025-05-19 14:15

Reported

2025-05-19 14:18

Platform

win11-20250502-en

Max time kernel

150s

Max time network

105s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"

Signatures

Gofing

ransomware gofing

Gofing family

gofing

Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Renames multiple (52) files with added filename extension

ransomware

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\drivers\gm.dls C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\afunix.sys C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\uk-UA\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Credentials from Password Stores: Windows Credential Manager

credential_access stealer

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Drops Chrome extension

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Downloaded Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Media\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Offline Web Pages\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\$Recycle.Bin\S-1-5-21-779059454-4269757009-3780780039-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Configuration\BaseRegistration\es-ES\BaseResource.Schema.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\Windows.ApplicationModel.Store.TestingFramework.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetAdapter\MSFT_NetAdapter.cmdletDefinition.cdxml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\wevtfwd.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\en-US\nlmcim.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-Server-HNS-Package~31bf3856ad364e35~amd64~uk-UA~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Windows.Web.Diagnostics.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\fr-FR\hgcpl.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\DiagSvcs\KernelTraceControl.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\IME\SHARED\imecfm.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\Startupscan.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\kbdarmph.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\scripto.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\fr-FR\netnccim_uninstall.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\de-DE\MSFT_GroupResource.strings.psd1 C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\it-IT\srm.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\kbd101a.DLL C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\fr-FR\storagewmi_passthru.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\NetIPsecPhase1AuthSet.cmdletDefinition.cdxml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\uk-UA\VAN.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\it-IT\csv.xsl C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\it-IT\storagewmi_passthru_uninstall.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\rdpendp.mof C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\fi-FI\APHostRes.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ttdplm.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\uk-UA\htable.xsl C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wlanpref.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\fr-FR\msftedit.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetEventPacketCapture\MSFT_NetEventSession.cdxml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\fr-FR\MSFT_EnvironmentResource.strings.psd1 C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ddraw.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\main.cpl C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\pegi.rs C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\DWrite.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\MapConfiguration.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\cmgrcspps.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\lipeula.rtf C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\webcheck.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\iashlpr.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ipsmsnap.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\dot3cfg.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\srmshell.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\KBDROST.DLL C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsClient\MSFT_DnsClientDohServerAddress.cdxml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\default.help.txt C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\clb.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\de-DE\dot3svc.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\msftedit.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\es-ES\PrintManagementProvider.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\es-ES\msfeedsbs.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PnpDevice\PnpDevice.Format.ps1xml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\en-US\adsldpc.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\odbccu32.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\de-DE\cli.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\hu-HU\windows.ui.xaml.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wlanutil.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wuapi.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\AUDIOKSE.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-Server-SDN-Package~31bf3856ad364e35~amd64~fr-FR~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\TextShaping.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\fr-FR\MSFT_WindowsOptionalFeature.schema.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\en-US\netdacim.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\wbemprox.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Speech\Engines\SR\srloc.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_10.2.41172.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TipsMedTile.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-64_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\Dropdown\Dropdown.types.js C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\zlibwapi.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_dirac_plugin.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PaintAppList.targetsize-32.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\resources.pri C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\edge_feedback\mf_trace.wprp C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\System.ServiceModel.Primitives.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Certificates_R.aapp C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-32_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\System.Data.Common.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PaintAppList.targetsize-36_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-32_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-96_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\OutlookMailWideTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\NotepadAppList.targetsize-60_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-Toolkit\Images\dash.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Primitives.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\progress.gif C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\pa.pak.DATA C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\clrcompression.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\KnownGameListRS4.bin C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-80_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\Shimmer.js C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationCore.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\theme-2x.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\show_third_party_software_licenses.bat C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.DataSetExtensions.Resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\STSUCRES.DLL C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_1.0.36.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsStoreLogo.scale-125.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\components\GroupedList\GroupSpacer.js C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\edit_pdf_poster2x.jpg C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\SnipSketchWideTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-16_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\contrast-white\CameraAppList.targetsize-20_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_avi_plugin.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Design.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Primitives.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_editpdf_18.svg C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\scan_poster.jpg C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2020.503.58.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\CameraLargeTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\de-de\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\ResiliencyLinks\Locales\tr.pak.DATA C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\MapsAppList.targetsize-60_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Logo.scale-100.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\compat\Button.js C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\DocumentCard\DocumentCardActivity.base.js C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_opencarat_18.svg C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\VisualElements\SmallLogoDev.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.SqlServer.Configuration.SString.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-24_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\PeopleAppList.targetsize-40_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\registry.png C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\GroupedList\GroupSpacer.types.js C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Reflection.Context.resources\v4.0_4.0.0.0_it_b77a5c561934e089\System.Reflection.Context.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\es-ES\Programs.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\iaLPSS2i_I2C_BXT_P.inf C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe.config C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\v4.0_10.0.0.0__31bf3856ad364e35\AuditPolicyGPManagedStubs.Interop.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.MemoryMappedFiles\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.IO.MemoryMappedFiles.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\ja-JP\ErrorReporting.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\app775.fon C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Help\mui\0409\mmc.CHM C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\wvmic_ext.inf C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\JA\mscorrc.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardAddUser.ascx.resx C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\Browsers\netscape.browser C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Activities.Build.resources\v4.0_4.0.0.0_de_31bf3856ad364e35\Microsoft.Activities.Build.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\JA\system.data.sqlxml.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\manageSingleRole.aspx C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.ConfigCI.Commands.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\1040\alinkui.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\es-ES\AutoPlay.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\1033\CvtResUI.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\Microsoft.ApplicationId.RuleWizard.Resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Presentation\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Presentation.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\es-ES\PushToInstall.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\ntprint4.inf C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Media\Ring04.wav C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\System.IO.Compression.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Providers\App_LocalResources\providerList.ascx.fr.resx C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DataVisualization.resources\v4.0_4.0.0.0_it_31bf3856ad364e35\System.Web.DataVisualization.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\sseriffe.fon C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\Browsers\ericsson.browser C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\it-IT\AppxPackageManager.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\App_LocalResources\createPermission.aspx.de.resx C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\it\SqlPersistenceService_Schema.sql C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\System.Device.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\home0.aspx.de.resx C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXmlLinq\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXmlLinq.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.RegularExpressions\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PLA\Reports\ja-JP\Report.System.Wireless.xml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Permissions\App_LocalResources\managePermissions.aspx.resx C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\couree.fon C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\0410\PerfCounters_d.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ES\System.Runtime.Serialization.Formatters.Soap.Resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\System.Configuration.Install.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Boot\DVD\PCAT\it-IT\bootfix.bin C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\_ServiceModelEndpointPerfCounters.reg C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.Appx.PackageManager.Commands.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\Appx.psd1 C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.resources\v4.0_4.0.0.0_fr_b77a5c561934e089\System.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\it-IT\Sensors.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Provisioning\Packages\Power.Settings.Battery.ppkg C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardInit.ascx.ja.resx C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\mlx4_bus.inf C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\.NET CLR Data\0C0A\_DataPerfCounters_d.ini C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Internals.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\de\System.Runtime.Caching.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\it-IT\DataCollection.adml C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Speech_OneCore\Engines\TTS\en-US\M1033Mark.SPEECHUX.NUS C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Installer\SourceHash{01B2627D-8443-41C0-97F0-9F72AC2FD6A0} C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Provider.aspx.es.resx C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\Browsers\ucbrowser.browser C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Browser Information Discovery

discovery

Processes

C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe

"C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"

Network

Files

C:\Program Files\7-Zip\7z.dll

MD5 1aa1dcb405a98f67daee4100829e7661
SHA1 905f16eba5f7296539d4440ee4194775fd8ccbaf
SHA256 fad1289f2423690404bda56aeaaad319302a419b570354575adc63061c1f1a6b
SHA512 7618fec6b18d7cdf9f15e479d92325a14619b950a5e97c63a922485852f12e51912c616698d1c87b1c34284f1ab78d9edbf6c2772e8104fa39683b830e5ff499

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll

MD5 382c7f62da4fe2bf0f948a127209c6cc
SHA1 f564c9b3ed33f66e224137f4c00f778d1182421a
SHA256 24670d8a44090a4ceadb898da27e107f6b31f69937aa0a5152df328c42acdd23
SHA512 3da50ff565465b3b19356405fb003ec7384201b402ff25a97a4a0cc66a6e68ee0b623e99b9cc3661780ca7d81f28d034f427128898c07d09e8d6592e703956b5

C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL

MD5 419378cfe9ae1de931b6ce1616f3a867
SHA1 5747dbb033f6376658032f0f3cd3053eb7be530d
SHA256 4f9c899238f02518caf9b2666a6baa7bbe4630db078235005e9cf464204405d7
SHA512 8c55d21930bcace121b0e223095ce8689d153bc7c83efe6d05d559b34c0baa97a1506521238c56fc2d36c2237a4abd60d35f123159c61714df5584bd4292b414