File name:

2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer

Full analysis: https://app.any.run/tasks/4f2d4c76-03b1-4454-89c1-92a2c61ff317
Verdict: Malicious activity
Analysis date: May 25, 2025, 12:47:32
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 15 sections
MD5:

33B7085DDCE164EAE0E0FD35FB7ADD1A

SHA1:

1A12722B726D1B8C583D3C5919B9ECD25C298C70

SHA256:

CCB1B2AB1E95FC3DC95812CFF3A57C307659DAC9155418250BBEC3860D2E4105

SSDEEP:

98304:Ew98OUuVMlCBZ1cfyhbNvuHdLQzptQKkkko4p1kluNmacQXcs6E3CO3KPlrWvhBx:WVt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the date of Windows installation

      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7576)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7956)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 1912)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 3100)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 4424)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7516)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7860)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 1012)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7960)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 8108)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 6700)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 4008)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7156)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7052)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 5596)

    • Reads security settings of Internet Explorer

      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7576)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7956)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 1912)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 3100)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 4424)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7516)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7860)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 1012)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7960)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 8108)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 6700)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 4008)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7156)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7052)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 5596)

    • Starts CMD.EXE for commands execution

      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7576)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7956)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 3100)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 1912)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 4424)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7516)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7860)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 1012)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7960)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 8108)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 6700)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 4008)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7052)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 5596)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7156)

    • Executing commands from a ".bat" file

      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7576)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7956)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 3100)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 1912)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 4424)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7516)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7860)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 1012)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7960)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 8108)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 6700)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 4008)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7156)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7052)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 5596)

    • Starts application with an unusual extension

      • cmd.exe (PID: 7696)
      • cmd.exe (PID: 8052)
      • cmd.exe (PID: 5956)
      • cmd.exe (PID: 1276)
      • cmd.exe (PID: 1180)
      • cmd.exe (PID: 7568)
      • cmd.exe (PID: 6632)
      • cmd.exe (PID: 856)
      • cmd.exe (PID: 3332)
      • cmd.exe (PID: 7460)
      • cmd.exe (PID: 7332)
      • cmd.exe (PID: 5776)
      • cmd.exe (PID: 6300)
      • cmd.exe (PID: 7856)
      • cmd.exe (PID: 7428)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 7696)
      • cmd.exe (PID: 8052)
      • cmd.exe (PID: 5956)
      • cmd.exe (PID: 1180)
      • cmd.exe (PID: 7568)
      • cmd.exe (PID: 1276)
      • cmd.exe (PID: 6632)
      • cmd.exe (PID: 856)
      • cmd.exe (PID: 3332)
      • cmd.exe (PID: 7460)
      • cmd.exe (PID: 7332)
      • cmd.exe (PID: 5776)
      • cmd.exe (PID: 6300)
      • cmd.exe (PID: 7428)
      • cmd.exe (PID: 7856)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 2196)

  • INFO

    • Create files in a temporary directory

      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7576)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7956)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 1912)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 3100)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 4424)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7516)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7860)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 1012)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7960)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 8108)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 4008)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 6700)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7052)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7156)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 5596)

    • Reads Environment values

      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7576)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7956)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 1912)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 3100)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 4424)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7860)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7516)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 1012)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7960)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 8108)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 4008)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 6700)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7052)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7156)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 5596)

    • Reads the computer name

      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7576)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7956)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 1912)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 3100)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 4424)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7860)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7516)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 1012)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7960)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 8108)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 4008)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 6700)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7052)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7156)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 5596)

    • Reads the machine GUID from the registry

      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7576)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7956)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 1912)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 3100)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 4424)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7516)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7860)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 1012)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7960)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 8108)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 4008)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 6700)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7052)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7156)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 5596)

    • Process checks computer location settings

      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7576)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7956)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 1912)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 3100)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 4424)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7516)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7860)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 1012)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7960)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 8108)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 6700)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 4008)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7156)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7052)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 5596)

    • Checks supported languages

      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7576)
      • chcp.com (PID: 7752)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7956)
      • chcp.com (PID: 8112)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 1912)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 3100)
      • chcp.com (PID: 4976)
      • chcp.com (PID: 516)
      • chcp.com (PID: 7420)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 4424)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7516)
      • chcp.com (PID: 7592)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7860)
      • chcp.com (PID: 6512)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 1012)
      • chcp.com (PID: 8024)
      • chcp.com (PID: 672)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7960)
      • chcp.com (PID: 4868)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 8108)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 6700)
      • chcp.com (PID: 6036)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 4008)
      • chcp.com (PID: 3032)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7052)
      • chcp.com (PID: 4056)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 7156)
      • chcp.com (PID: 1760)
      • 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe (PID: 5596)
      • chcp.com (PID: 664)

    • Changes the display of characters in the console

      • cmd.exe (PID: 7696)
      • cmd.exe (PID: 8052)
      • cmd.exe (PID: 5956)
      • cmd.exe (PID: 1180)
      • cmd.exe (PID: 7568)
      • cmd.exe (PID: 1276)
      • cmd.exe (PID: 6632)
      • cmd.exe (PID: 3332)
      • cmd.exe (PID: 856)
      • cmd.exe (PID: 7460)
      • cmd.exe (PID: 7332)
      • cmd.exe (PID: 5776)
      • cmd.exe (PID: 6300)
      • cmd.exe (PID: 7428)
      • cmd.exe (PID: 7856)

    • Checks proxy server information

      • slui.exe (PID: 7672)

    • Reads the software policy settings

      • slui.exe (PID: 7672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 3
CodeSize: 726016
InitializedDataSize: 3350528
UninitializedDataSize: -
EntryPoint: 0x71860
OSVersion: 6.1
ImageVersion: 1
SubsystemVersion: 6.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
198
Monitored processes
77
Malicious processes
1
Suspicious processes
29

Behavior graph

Click at the process to see the details
start 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe no specs svchost.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs slui.exe 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs 2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
516chcp 65001C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
664\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
664chcp 65001C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
672chcp 65001C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
856C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\ZA6oouJb6oGT.bat" "C:\Windows\System32\cmd.exe—2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
920\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1012"C:\Users\admin\Desktop\2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe" C:\Users\admin\Desktop\2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
1180C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\TYKphxdoH5FA.bat" "C:\Windows\System32\cmd.exe—2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
1276C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\RaHJfuc1irEc.bat" "C:\Windows\System32\cmd.exe—2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
1452ping -n 10 localhost C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\mswsock.dll
Total events
19 465
Read events
19 465
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
15
Unknown types
0

Dropped files

PID
Process
Filename
Type
75762025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exeC:\Users\admin\AppData\Local\Temp\Y7MKMK3hGHvC.battext
MD5:70E6EAD2D1B8869CD737445895DCD78D
SHA256:D64D9448157BE8CEF0280A72741EB47625C9D00DBBD920E7E8745E1D94A0CE6A
19122025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exeC:\Users\admin\AppData\Local\Temp\37Im5ONCWZkM.battext
MD5:148E20271F7F3D44C164574114850598
SHA256:0C9CF75C219621FAADD7E8D83D5471C3C92C65A7DD74886F1CC033F0D5F3E0FA
44242025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exeC:\Users\admin\AppData\Local\Temp\RaHJfuc1irEc.battext
MD5:92A27D481337E87587E248D08149FFE6
SHA256:2062BB62B57F947405C50D5A604090DA6B1A5FD5FCB30F77FD47A23B45ED5F25
79562025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exeC:\Users\admin\AppData\Local\Temp\mg17xz5Qfljr.battext
MD5:0281931383B6CB4620BD3684FC093E3B
SHA256:744CE28C511203F54E7F563DD302A96C689FB03FB4712CC73A85D409C52621AB
78602025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exeC:\Users\admin\AppData\Local\Temp\JLP0s5884lSD.battext
MD5:EB6027C59384363DFAAA0B7ED19C280A
SHA256:062F43AFA3B55A2DE83F3485863341FEFBBC05DAE35FD2BEC8D6DD347E1864DA
79602025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exeC:\Users\admin\AppData\Local\Temp\ug89IGuVvD7e.battext
MD5:0E6D26F14CF7E41809248717B84C54DF
SHA256:95DCECED11BABC16A6D7F2DD5653EE99066DD6FCEBD5658200812934E6488AFD
31002025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exeC:\Users\admin\AppData\Local\Temp\TYKphxdoH5FA.battext
MD5:23D884CA3128834B8010A8CED3092D38
SHA256:17608374CD93DD6DF4FE01E8CB8A14CF754D45271D3332DEF55105A0E00329DB
10122025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exeC:\Users\admin\AppData\Local\Temp\ZA6oouJb6oGT.battext
MD5:0F230C29CB68E4699498FA7D50CE2267
SHA256:D37329C8C5628753F5C895D156C11A33602BE44890088253A0AFDFE702C1355B
67002025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exeC:\Users\admin\AppData\Local\Temp\dXAqXZTZxvtH.battext
MD5:EFD7918FC596A6B70A7EF326609C87C3
SHA256:0D2AD5FE2662FE0CB32504384ADE8750FDAAF628C758DF2E9C420E3648DCE7EC
81082025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer.exeC:\Users\admin\AppData\Local\Temp\4c6FDwM8i0sk.battext
MD5:8D3E786E9E05CE102FECAFF12AE43F39
SHA256:AC2C4DC198E8CBEE3BBA93CE83D8F6CFFD6CDC74BE543964E04A310B3F05E6EA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
21
DNS requests
24
Threats
30

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
2104
svchost.exe
2.16.253.202:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7360
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7672
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 172.217.23.110
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 2.16.253.202
whitelisted
Ramsadaye-38594.portmap.io
  • —
malicious
activation-v2.sls.microsoft.com
  • 20.83.72.98
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potential Corporate Privacy Violation
ET INFO DNS Query to a Reverse Proxy Service Observed
2196
svchost.exe
Misc activity
ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .io)
2196
svchost.exe
Misc activity
ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .io)
2196
svchost.exe
Potential Corporate Privacy Violation
ET INFO DNS Query to a Reverse Proxy Service Observed
2196
svchost.exe
Potential Corporate Privacy Violation
ET INFO DNS Query to a Reverse Proxy Service Observed
2196
svchost.exe
Misc activity
ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .io)
2196
svchost.exe
Potential Corporate Privacy Violation
ET INFO DNS Query to a Reverse Proxy Service Observed
2196
svchost.exe
Misc activity
ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .io)
2196
svchost.exe
Potential Corporate Privacy Violation
ET INFO DNS Query to a Reverse Proxy Service Observed
2196
svchost.exe
Misc activity
ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .io)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-05-25_33b7085ddce164eae0e0fd35fb7add1a_frostygoop_ghostlocker_knight_luca-stealer