Analysis
- max time kernel
148s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 08:49
Behavioral task
behavioral1
Sample
2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win11-20260130-en
windows11-21h2-x64
13 signatures
150 seconds
General
- Target 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
- Size 4.1MB
- Sample260415-krdddah12k
- SHA256 83a389f9f1475110c7aa6e240208f693c52c2c71777eaa1bccd77fd8df76a9a5
- MD5 5cf8d0f3043f9d685b7ce602410ff233
- SHA1 b4afbcbe83b059d31b5727ab1b713349a886ddc5
- SHA512 901919b39ecfd0e6ac46cddf0155f1be746282a143b0297d574ebab07587debaf5c6ce6df276fcb548a7f995f705427b9dce2893b1a6f655d3b36bd1ffe72a37
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4E:ieF+iIAEl1JPz212IhzL+Bzz3dw/VS
- TLSH T180169D03FC9564A9C5E9F23089B583927B71B858473123D72F64ABBB2A777C41E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 2 IoCs
resource yara_rule behavioral2/files/0x000300000002a18f-4.dat family_gofing behavioral2/files/0x0002000000029263-5489.dat family_gofing - Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe - Executes dropped EXE 1 IoCs
pid Process 3104 Process not Found - Loads dropped DLL 64 IoCs
pid Process 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe - Drops desktop.ini file(s) 64 IoCs
description ioc Process File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\Downloads\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Public\Music\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Public\Pictures\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Public\Videos\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\Music\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Public\Libraries\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\Links\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Public\Downloads\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\$Recycle.Bin\S-1-5-21-3847269522-1618051987-1942096715-1000\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\Pictures\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\Videos\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Public\Documents\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Media\Desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\Favorites\Links\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\OneDrive\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Public\AccountPictures\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\Saved Games\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\Searches\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Downloaded Program Files\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\Contacts\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\Favorites\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\Desktop\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\Documents\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Public\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe - Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\lib\security\trusted.libraries 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul-oob.xrm-ms 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql120.xsl 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\vlc.mo 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.2008.32311.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GetHelpSmallTile.scale-125.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-150_contrast-black.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\CalculatorSplashScreen.scale-200_contrast-white.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\MapsAppList.targetsize-30_altform-lightunplated.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_elf.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryLog.xltx 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-black\PowerAutomateAppIcon.scale-200.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-3847269522-1618051987-1942096715-1000-MergedResources-0.pri 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_altform-unplated_contrast-black.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Theme_Photo_AutumnLeaves_Thumbnail_Dark.jpg 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-48.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\System.Private.DataContractSerialization.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-48_altform-unplated.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\MapsAppList.targetsize-72_altform-lightunplated.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\merge-styles\lib-amd\Stylesheet.js 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\msdadc.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\pt-BR_NEUTER.pak 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\BLENDS.INF 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Windows NT\Accessories\it-IT\wordpad.exe.mui 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1909.12456.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PeopleBadgeLogo.scale-125.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\move.svg 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_export_18.svg 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\FocusZone.js 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailLargeTile.scale-200.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\new_icons.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEEXCL.DLL 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\ThemeGenerator.js 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\illustrations_retina.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\pt-PT_FEMININE.pak 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GOTHICB.TTF 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Windows Mail\wabimp.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-36_altform-lightunplated.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\iheart-radio.scale-200_contrast-white.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Assets\StoreLogo.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\PresentationCore.resources.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\find-text-2x.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\NewsAppList.targetsize-16_altform-lightunplated_contrast-black.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\main-selector.css 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.DataWarehouse.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-48_altform-lightunplated_contrast-black.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\AppxSignature.p7x 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-24_altform-lightunplated.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\SplashScreen.scale-150.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\concrt140.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmdp32.msi 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\PaintLargeTile.scale-100.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PaintMedTile.scale-100.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Dark.scale-250.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\hr-hr\ui-strings.js 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ro-ro\ui-strings.js 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceProcess.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\UIAutomationProvider.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\fr\System.Windows.Controls.Ribbon.resources.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\ImmersiveControlPanel\ConstraintIndex\ConstraintIndex.cab 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Media\Alarm03.wav 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\addUser.aspx.it.resx 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ES\System.Design.Resources.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.CompilerServices.VisualC.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\mscorrc.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\big5.nlp 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Cursors\wait_m.cur 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\_ServiceModelEndpointPerfCounters.h 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\INF\c_smartcardfilter.inf 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\INF\urssynopsys.inf 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\JSByteCodeWin.bin 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Code\ApplicationConfigurationPage.cs 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Internals.aspx.fr.resx 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\fr\System.Design.Resources.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Boot\Fonts\wgl4_boot.ttf 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\DiagTrack\Scenarios\windows.diag_ondemand.xml 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Fonts\85855.fon 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Fonts\framdit.ttf 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\INF\netvf63a.inf 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\home2.aspx.resx 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework\3082\admin.chm 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\home0.aspx.fr.resx 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Cursors\help_im.cur 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Help\mui\0409\sqlsoldb.chm 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\INF\acpi.inf 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\App_LocalResources\chooseProviderManagement.aspx.it.resx 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardFinish.ascx.es.resx 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-white_scale-125.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Security.Claims.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\aspnet.mfl 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\findUsers.aspx.es.resx 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\DE\System.Windows.Forms.Resources.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\INF\.NET CLR Networking\_Networkingperfcounters_v2.ini 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\INF\prnge001.inf 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\error.aspx.resx 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\PerfCounter.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp.aspx.resx 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Fonts\seguisli.ttf 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\INF\ykinx64.inf 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-black_scale-200.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\ImmersiveControlPanel\images\logo.targetsize-36.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroPDFImpl64.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Media\Alarm09.wav 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationHostDLL.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\ja\Microsoft.Build.Tasks.v3.5.resources.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ComponentModel.Primitives.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\DebugAndTrace.aspx 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\INF\wfplwfs.inf 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\System.Runtime.Serialization.Formatters.Soap.Resources.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Application.aspx.ja.resx 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\Microsoft.VisualBasic.resources.dll 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Boot\DVD\PCAT\de-DE\bootfix.bin 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\INF\errata.inf 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-black_scale-100.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-white_scale-400.png 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100enu_x64 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Windows\Media\Windows Menu Command.wav 2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"1⤵
- Drops startup file
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1544
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.dll
- Size 5.9MB
- SHA256 5b5631747ce7a7b0fbcca2018093647710d25d08083748ef59800edd443aaa53
- MD5 8a8228bae14dc4face19a898c7cdcc94
- SHA1 bbd03b258509f23579ff2de3c0bb88fe640411f8
- SHA512 00190b13f172661cbbe1c14e1141a155cc1b4adbe0e7c9b6f59848355f8ba2c5ae19504dc22bdb5e3c72f66aff5ea28ca1f40e63106e57f58f7482fbe69893ba
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/V6+lqMpMrKzj22B:pWvSDzaxztQV6+lmKzj22B
- TLSH T19D56C003BC9550A9E9E9F33089B543627A757818873527E32F50BABB2F767D41E38390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 5.8MB
- SHA256 422bdbc20a3724045328fc582430e8fe46d32c9de1dc3df4aed3c1d69cbc97b5
- MD5 1faaa9c6d95b5c1dc4bc62f1edd6de2a
- SHA1 5b041f7a680573836da3c58989dbbf42d416b9ec
- SHA512 80b33210d387948c78cb70b54d5ec2d3bef4ac1df4229ab30fa9fb46f55698552cd46c0b8d93ae68d78c93f65e29d5b7e2cbfaa1ee052541165a62c4e94ad228
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VRZtdWJz6W3liyAl4cx:pWvSDzaxztQVntdWR6Wyx
- TLSH T17C56AE13FCB5A4ABC5EEE6358565925276717858873123D33B64EABF3A727C00E78380
- MD5 SHA1 SHA512 SSDEEP TLSH