Overview
overview
7Static
static
3Ghostly_1....up.exe
windows10-2004-x64
7Ghostly_1....up.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3binaries/A...pi.dll
windows10-2004-x64
3binaries/A...pi.dll
windows11-ltsc_2024-x64
3binaries/A...pi.dll
windows10-2004-x64
3binaries/A...pi.dll
windows11-ltsc_2024-x64
3binaries/adb.exe
windows10-2004-x64
3binaries/adb.exe
windows11-ltsc_2024-x64
3ghosty-ios...C4.dll
windows10-2004-x64
1ghosty-ios...C4.dll
windows11-ltsc_2024-x64
1ghosty-ios...20.dll
windows10-2004-x64
1ghosty-ios...20.dll
windows11-ltsc_2024-x64
1ghosty-ios...20.dll
windows10-2004-x64
1ghosty-ios...20.dll
windows11-ltsc_2024-x64
1ghosty-ios...de.dll
windows10-2004-x64
1ghosty-ios...de.dll
windows11-ltsc_2024-x64
1ghosty-ios...es.dll
windows10-2004-x64
1ghosty-ios...es.dll
windows11-ltsc_2024-x64
1ghosty-ios...ni.dll
windows10-2004-x64
1ghosty-ios...ni.dll
windows11-ltsc_2024-x64
1Analysis
- user interaction
yes - max time kernel
179s - max time network
185s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/08/2026, 16:24
Behavioral task
behavioral1
Sample
Ghostly_1.0.5_x64-setup.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Ghostly_1.0.5_x64-setup.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral15
Sample
binaries/AdbWinApi.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
binaries/AdbWinApi.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
binaries/AdbWinUsbApi.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
binaries/AdbWinUsbApi.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
binaries/adb.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
binaries/adb.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
ghosty-iosd/_internal/Crypto/Cipher/_ARC4.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
ghosty-iosd/_internal/Crypto/Cipher/_ARC4.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
ghosty-iosd/_internal/Crypto/Cipher/_Salsa20.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
ghosty-iosd/_internal/Crypto/Cipher/_Salsa20.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral25
Sample
ghosty-iosd/_internal/Crypto/Cipher/_chacha20.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
ghosty-iosd/_internal/Crypto/Cipher/_chacha20.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral27
Sample
ghosty-iosd/_internal/Crypto/Cipher/_pkcs1_decode.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
ghosty-iosd/_internal/Crypto/Cipher/_pkcs1_decode.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral29
Sample
ghosty-iosd/_internal/Crypto/Cipher/_raw_aes.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral30
Sample
ghosty-iosd/_internal/Crypto/Cipher/_raw_aes.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral31
Sample
ghosty-iosd/_internal/Crypto/Cipher/_raw_aesni.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral32
Sample
ghosty-iosd/_internal/Crypto/Cipher/_raw_aesni.dll
Resource
win11ltsc2024-20260709-en
General
- Target Ghostly_1.0.5_x64-setup.exe
- Size 57.1MB
- Sample260801-twdpdade25
- SHA256 7246f76cedaf13023b6010c3d9a3aa6f5f4903880c1797f9c952ae813173b5ff
- MD5 26224b8d3b8db52897e55ccf3b72e0b5
- SHA1 d46542c600abcad33f0a5756876e10c1a3f9499a
- SHA512 442a4dc3d8af9e545bc3c507bcf888168bc92ae2dfcb4923b63b1f26a11d55a1ffe1335ef9d16b587079ca36d84d5f89fc93da3be554ec60f481814ecd72b7e9
- SSDEEP 1572864:L10w/SNIIHf86tdYbRJlStfZXDk233btPJxNSL3XV:L10MSII3WIZdHbtRO3l
- TLSH T151D7334C1E7C4C6ADA0AFFFBA9C8D3E895E179EB740BF4C2D31B6624D1809EC2405965
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation ghosty.exe - Executes dropped EXE 53 IoCs
pid Process 1636 ghosty.exe 1432 ghosty-iosd.exe 3212 adb.exe 4672 adb.exe 4484 adb.exe 2340 adb.exe 2396 ghosty-iosd.exe 3808 adb.exe 3876 adb.exe 204 adb.exe 4444 adb.exe 1716 Ghostly-1.0.7-installer.exe 4244 ghosty.exe 3888 adb.exe 1268 ghosty-iosd.exe 3548 adb.exe 4740 adb.exe 1344 adb.exe 5016 ghosty-iosd.exe 1624 adb.exe 5036 adb.exe 1092 adb.exe 3564 adb.exe 3056 adb.exe 4940 adb.exe 4460 adb.exe 2920 adb.exe 3024 adb.exe 1268 adb.exe 2976 adb.exe 1760 ghosty-iosd.exe 2540 adb.exe 5036 adb.exe 3856 ghosty-iosd.exe 1652 adb.exe 2784 adb.exe 4232 ghosty-iosd.exe 2328 adb.exe 1624 ghosty-iosd.exe 1416 adb.exe 2668 adb.exe 4652 ghosty-iosd.exe 4672 adb.exe 572 ghosty-iosd.exe 1652 adb.exe 3856 adb.exe 2056 ghosty-iosd.exe 4476 adb.exe 3276 ghosty-iosd.exe 2148 adb.exe 4732 adb.exe 4804 ghosty-iosd.exe 2332 adb.exe - Loads dropped DLL 64 IoCs
pid Process 1188 Ghostly_1.0.5_x64-setup.exe 1188 Ghostly_1.0.5_x64-setup.exe 1188 Ghostly_1.0.5_x64-setup.exe 1188 Ghostly_1.0.5_x64-setup.exe 1188 Ghostly_1.0.5_x64-setup.exe 1188 Ghostly_1.0.5_x64-setup.exe 1188 Ghostly_1.0.5_x64-setup.exe 1188 Ghostly_1.0.5_x64-setup.exe 1188 Ghostly_1.0.5_x64-setup.exe 3212 adb.exe 3212 adb.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 4672 adb.exe 4672 adb.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 1432 ghosty-iosd.exe 4484 adb.exe 4484 adb.exe 2340 adb.exe 2340 adb.exe 2396 ghosty-iosd.exe 2396 ghosty-iosd.exe 2396 ghosty-iosd.exe 3808 adb.exe 3808 adb.exe 2396 ghosty-iosd.exe 2396 ghosty-iosd.exe 2396 ghosty-iosd.exe 2396 ghosty-iosd.exe 2396 ghosty-iosd.exe 2396 ghosty-iosd.exe 2396 ghosty-iosd.exe 2396 ghosty-iosd.exe 2396 ghosty-iosd.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ghosty.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ghosty.exe - Drops file in System32 directory 18 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wkernel32.pdb adb.exe File opened for modification C:\Windows\SysWOW64\symbols\exe\adb.pdb adb.exe File opened for modification C:\Windows\SysWOW64\symbols\exe\adb.pdb adb.exe File opened for modification C:\Windows\SysWOW64\dll\wntdll.pdb adb.exe File opened for modification C:\Windows\SysWOW64\DLL\wkernel32.pdb adb.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\wntdll.pdb adb.exe File opened for modification C:\Windows\SysWOW64\DLL\wkernel32.pdb adb.exe File opened for modification C:\Windows\SysWOW64\symbols\DLL\wkernel32.pdb adb.exe File opened for modification C:\Windows\SysWOW64\adb.pdb adb.exe File opened for modification C:\Windows\SysWOW64\exe\adb.pdb adb.exe File opened for modification C:\Windows\SysWOW64\wkernel32.pdb adb.exe File opened for modification C:\Windows\SysWOW64\symbols\DLL\wkernel32.pdb adb.exe File opened for modification C:\Windows\SysWOW64\wntdll.pdb adb.exe File opened for modification C:\Windows\SysWOW64\wntdll.pdb adb.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\wntdll.pdb adb.exe File opened for modification C:\Windows\SysWOW64\adb.pdb adb.exe File opened for modification C:\Windows\SysWOW64\exe\adb.pdb adb.exe File opened for modification C:\Windows\SysWOW64\dll\wntdll.pdb adb.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\slumber\slumber\utils.pyi Ghostly-1.0.7-installer.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\websockets\server.py Ghostly-1.0.7-installer.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\django-stubs\django-stubs\contrib\sessions\backends\__init__.pyi Ghostly-1.0.7-installer.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\pony\pony\orm\examples\numbers.pyi Ghostly-1.0.7-installer.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\tabulate\tabulate\__init__.pyi Ghostly-1.0.7-installer.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\pymobiledevice3-9.33.4.dist-info\entry_points.txt Ghostly-1.0.7-installer.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\PyMySQL\pymysql\constants\SERVER_STATUS.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\aws-xray-sdk\aws_xray_sdk\core\streaming\__init__.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\flake8\flake8\style_guide.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Etc\GMT+12 Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\antlr4-python3-runtime\antlr4\atn\LexerActionExecutor.pyi Ghostly-1.0.7-installer.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\docutils\docutils\utils\math\__init__.pyi Ghostly-1.0.7-installer.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\networkx\networkx\algorithms\cluster.pyi Ghostly-1.0.7-installer.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\waitress\waitress\proxy_headers.pyi Ghostly-1.0.7-installer.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\flake8\flake8\processor.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\oauthlib\oauthlib\common.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\pmd_net_proto\protocols\ip6_dest_opts\options\ip6_dest_opts__option__padn.py Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Costa_Rica Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stdlib\_dbm.pyi Ghostly-1.0.7-installer.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\braintree\braintree\transfer.pyi Ghostly-1.0.7-installer.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\workalendar\workalendar\exceptions.pyi Ghostly-1.0.7-installer.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\pmd_pytcp\protocols\icmp\__init__.py Ghostly-1.0.7-installer.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\networkx\networkx\generators\geometric.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\aws-xray-sdk\aws_xray_sdk\core\context.pyi Ghostly-1.0.7-installer.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\av\audio\resampler.pyd Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stdlib\distutils\command\install_scripts.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\braintree\braintree\subscription_status_event.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stdlib\code.pyi Ghostly-1.0.7-installer.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\flake8-simplify\flake8_simplify\__init__.pyi Ghostly-1.0.7-installer.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\qh3-1.9.4.dist-info\sboms\qh3.cyclonedx.json Ghostly-1.0.7-installer.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\PyYAML\yaml\error.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\pmd_pytcp\protocols\icmp\icmp__error_demux.py Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\websockets-15.0.1.dist-info\top_level.txt Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\av.libs\libiconv-2-6ce5f4ff92ada49d6f23a8e413455502.dll Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\docutils\docutils\readers\__init__.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\openpyxl\openpyxl\worksheet\merge.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\python-jose\jose\constants.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\python-xlib\Xlib\XK.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\setuptools\setuptools\_distutils\command\install.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\workalendar\workalendar\europe\united_kingdom.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\pywin32\win32evtlogutil.pyi Ghostly-1.0.7-installer.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stdlib\email\charset.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\reportlab\reportlab\graphics\charts\slidebox.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\networkx\networkx\algorithms\asteroidal.pyi Ghostly-1.0.7-installer.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\s2clientprotocol\s2clientprotocol\debug_pb2.pyi Ghostly-1.0.7-installer.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\WTForms\wtforms\meta.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\docutils\docutils\parsers\rst\languages\en.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\pexpect\pexpect\__init__.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\protobuf\google\protobuf\service_reflection.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\python-xlib\Xlib\ext\composite.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\m3u8\m3u8\parser.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\websockets\speedups.cp312-win_amd64.pyd Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\django-stubs\django-stubs\db\models\options.pyi Ghostly-1.0.7-installer.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\psutil\psutil\_pssunos.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\pmd_pytcp\ipc\ipc__frame.py Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\websockets\protocol.py Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stdlib\msvcrt.pyi Ghostly-1.0.7-installer.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\click-web\click_web\resources\index.pyi Ghostly-1.0.7-installer.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\tensorflow\tensorflow\tsl\protobuf\rpc_options_pb2.pyi Ghostly-1.0.7-installer.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\Crypto\Cipher\_raw_des3.pyd Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\django-stubs\django-stubs\contrib\gis\db\__init__.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stdlib\configparser.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stdlib\importlib\__init__.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\fanstatic\fanstatic\inclusion.pyi Ghostly_1.0.5_x64-setup.exe - Detects Pyinstaller 1 IoCs
resource yara_rule behavioral1/files/0x00070000000266b5-14235.dat pyinstaller - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3808 cmd.exe - Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 ghosty.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 ghosty.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghostly_1.0.5_x64-setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghostly-1.0.7-installer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adb.exe - Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe - Kills process with taskkill 4 IoCs
pid Process 3536 taskkill.exe 1032 taskkill.exe 3768 taskkill.exe 3168 taskkill.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedgewebview2.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301344835626359" msedgewebview2.exe - Modifies system certificate store 2 TTPs 6 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 ghosty.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 ghosty.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 ghosty.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df019000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 ghosty.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c00000001000000040000008001000019000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 ghosty.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0 ghosty.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1188 Ghostly_1.0.5_x64-setup.exe 1188 Ghostly_1.0.5_x64-setup.exe 1716 Ghostly-1.0.7-installer.exe 1716 Ghostly-1.0.7-installer.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3016 msedgewebview2.exe 3732 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 3536 taskkill.exe Token: SeDebugPrivilege 1032 taskkill.exe Token: SeImpersonatePrivilege 1188 Ghostly_1.0.5_x64-setup.exe Token: SeImpersonatePrivilege 1188 Ghostly_1.0.5_x64-setup.exe Token: SeDebugPrivilege 3768 taskkill.exe Token: SeDebugPrivilege 3168 taskkill.exe Token: SeImpersonatePrivilege 1716 Ghostly-1.0.7-installer.exe Token: SeImpersonatePrivilege 1716 Ghostly-1.0.7-installer.exe - Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1188 Ghostly_1.0.5_x64-setup.exe 1636 ghosty.exe 1636 ghosty.exe 1636 ghosty.exe 4244 ghosty.exe 4244 ghosty.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1636 ghosty.exe 1636 ghosty.exe 4244 ghosty.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1188 wrote to memory of 3536 1188 Ghostly_1.0.5_x64-setup.exe 86 PID 1188 wrote to memory of 1032 1188 Ghostly_1.0.5_x64-setup.exe 89 PID 1636 wrote to memory of 3016 1636 ghosty.exe 102 PID 3016 wrote to memory of 3416 3016 msedgewebview2.exe 103 PID 3016 wrote to memory of 4472 3016 msedgewebview2.exe 104 PID 3016 wrote to memory of 4472 3016 msedgewebview2.exe 104 PID 3016 wrote to memory of 4472 3016 msedgewebview2.exe 104 PID 3016 wrote to memory of 3484 3016 msedgewebview2.exe 105 PID 3016 wrote to memory of 2188 3016 msedgewebview2.exe 106 PID 3016 wrote to memory of 2188 3016 msedgewebview2.exe 106 PID 3016 wrote to memory of 3552 3016 msedgewebview2.exe 107 PID 3016 wrote to memory of 3552 3016 msedgewebview2.exe 107 PID 3016 wrote to memory of 3552 3016 msedgewebview2.exe 107 PID 1636 wrote to memory of 1432 1636 ghosty.exe 108 PID 1636 wrote to memory of 3212 1636 ghosty.exe 109 PID 3212 wrote to memory of 4672 3212 adb.exe 112 PID 1636 wrote to memory of 4484 1636 ghosty.exe 113 PID 1636 wrote to memory of 2340 1636 ghosty.exe 116 PID 1636 wrote to memory of 2396 1636 ghosty.exe 118 PID 1636 wrote to memory of 3808 1636 ghosty.exe 120 PID 1636 wrote to memory of 3876 1636 ghosty.exe 122 PID 1636 wrote to memory of 204 1636 ghosty.exe 124 PID 1636 wrote to memory of 4444 1636 ghosty.exe 127 PID 1636 wrote to memory of 1716 1636 ghosty.exe 129 PID 1716 wrote to memory of 3768 1716 Ghostly-1.0.7-installer.exe 130 PID 1716 wrote to memory of 3168 1716 Ghostly-1.0.7-installer.exe 132 PID 4244 wrote to memory of 3732 4244 ghosty.exe 135 PID 3732 wrote to memory of 3060 3732 msedgewebview2.exe 136 PID 3732 wrote to memory of 2300 3732 msedgewebview2.exe 137 PID 3732 wrote to memory of 2300 3732 msedgewebview2.exe 137 PID 3732 wrote to memory of 2300 3732 msedgewebview2.exe 137 PID 3732 wrote to memory of 3828 3732 msedgewebview2.exe 138 PID 3732 wrote to memory of 4168 3732 msedgewebview2.exe 139 PID 3732 wrote to memory of 4168 3732 msedgewebview2.exe 139 PID 3732 wrote to memory of 3972 3732 msedgewebview2.exe 140 PID 3732 wrote to memory of 3972 3732 msedgewebview2.exe 140 PID 3732 wrote to memory of 3972 3732 msedgewebview2.exe 140 PID 4244 wrote to memory of 3888 4244 ghosty.exe 141 PID 4244 wrote to memory of 1268 4244 ghosty.exe 171 PID 3888 wrote to memory of 3548 3888 adb.exe 145 PID 4244 wrote to memory of 4740 4244 ghosty.exe 146 PID 4244 wrote to memory of 1344 4244 ghosty.exe 148 PID 4244 wrote to memory of 5016 4244 ghosty.exe 150 PID 4244 wrote to memory of 1624 4244 ghosty.exe 152 PID 4244 wrote to memory of 5036 4244 ghosty.exe 179 PID 5016 wrote to memory of 3808 5016 ghosty-iosd.exe 156 PID 4244 wrote to memory of 1092 4244 ghosty.exe 157 PID 4244 wrote to memory of 3564 4244 ghosty.exe 159 PID 4244 wrote to memory of 3056 4244 ghosty.exe 161 PID 4244 wrote to memory of 4940 4244 ghosty.exe 163 PID 4244 wrote to memory of 4460 4244 ghosty.exe 165 PID 4244 wrote to memory of 2920 4244 ghosty.exe 167 PID 4244 wrote to memory of 3024 4244 ghosty.exe 169 PID 4244 wrote to memory of 1268 4244 ghosty.exe 171 PID 4244 wrote to memory of 2976 4244 ghosty.exe 173 PID 4244 wrote to memory of 1760 4244 ghosty.exe 175 PID 4244 wrote to memory of 2540 4244 ghosty.exe 177 PID 4244 wrote to memory of 5036 4244 ghosty.exe 179 PID 4244 wrote to memory of 3856 4244 ghosty.exe 181 PID 4244 wrote to memory of 1652 4244 ghosty.exe 183 PID 4244 wrote to memory of 2784 4244 ghosty.exe 185 PID 4244 wrote to memory of 4232 4244 ghosty.exe 187 PID 4244 wrote to memory of 2328 4244 ghosty.exe 189 PID 4244 wrote to memory of 1624 4244 ghosty.exe 191
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ghostly_1.0.5_x64-setup.exe"C:\Users\Admin\AppData\Local\Temp\Ghostly_1.0.5_x64-setup.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM ghosty-iosd.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3536
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM adb.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1032
-
-
C:\Program Files\Ghostly\ghosty.exe"C:\Program Files\Ghostly\ghosty.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ghosty.exe --webview-exe-version=1.0.5 --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1636.1308.87887626730287237993⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffe6d02b078,0x7ffe6d02b084,0x7ffe6d02b0904⤵PID:3416
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --webview-exe-name=ghosty.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1732,i,8000374241634203273,7715485594341587274,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:24⤵PID:4472
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --webview-exe-name=ghosty.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2060,i,8000374241634203273,7715485594341587274,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:34⤵PID:3484
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --webview-exe-name=ghosty.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2372,i,8000374241634203273,7715485594341587274,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:84⤵PID:2188
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --webview-exe-name=ghosty.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3624,i,8000374241634203273,7715485594341587274,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14⤵PID:3552
-
-
-
C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe"\\?\C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe" list3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Program Files\Ghostly\binaries\adb.exeadb -L tcp:5037 fork-server server --reply-fd 6724⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4672
-
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4484
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340
-
-
C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe"\\?\C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe" list3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3808
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l3⤵
- Executes dropped EXE
PID:3876
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l3⤵
- Executes dropped EXE
PID:204
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l3⤵
- Executes dropped EXE
PID:4444
-
-
C:\Users\Admin\AppData\Local\Temp\Ghostly-1.0.7-updater-ZRHdde\Ghostly-1.0.7-installer.exe"C:\Users\Admin\AppData\Local\Temp\Ghostly-1.0.7-updater-ZRHdde\Ghostly-1.0.7-installer.exe" /P /R /UPDATE /ARGS3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM ghosty-iosd.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3768
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM adb.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3168
-
-
C:\Program Files\Ghostly\ghosty.exe"C:\Program Files\Ghostly\ghosty.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ghosty.exe --webview-exe-version=1.0.7 --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4244.3404.159318922755134905415⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffe6d02b078,0x7ffe6d02b084,0x7ffe6d02b0906⤵PID:3060
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --webview-exe-name=ghosty.exe --webview-exe-version=1.0.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1820,i,15707648260501030390,11160574000949365011,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1816 /prefetch:26⤵PID:2300
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --webview-exe-name=ghosty.exe --webview-exe-version=1.0.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1880,i,15707648260501030390,11160574000949365011,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:36⤵PID:3828
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --webview-exe-name=ghosty.exe --webview-exe-version=1.0.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2352,i,15707648260501030390,11160574000949365011,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:86⤵PID:4168
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --webview-exe-name=ghosty.exe --webview-exe-version=1.0.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3480,i,15707648260501030390,11160574000949365011,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:16⤵PID:3972
-
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Program Files\Ghostly\binaries\adb.exeadb -L tcp:5037 fork-server server --reply-fd 6526⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3548
-
-
-
C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe"\\?\C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe" list5⤵
- Executes dropped EXE
PID:1268
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
PID:4740
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
PID:1344
-
-
C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe"\\?\C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe" list5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
- Executes a command shell one-liner
PID:3808
-
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
PID:1624
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
PID:5036
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
PID:1092
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
PID:3564
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
PID:3056
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
PID:4940
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
PID:4460
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
PID:2920
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
PID:3024
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
PID:1268
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
PID:2976
-
-
C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe"\\?\C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe" list5⤵
- Executes dropped EXE
PID:1760
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
PID:2540
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
PID:5036
-
-
C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe"\\?\C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe" list5⤵
- Executes dropped EXE
PID:3856
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
PID:1652
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
PID:2784
-
-
C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe"\\?\C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe" list5⤵
- Executes dropped EXE
PID:4232
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
PID:2328
-
-
C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe"\\?\C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe" list5⤵
- Executes dropped EXE
PID:1624
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
PID:1416
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
PID:2668
-
-
C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe"\\?\C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe" list5⤵
- Executes dropped EXE
PID:4652
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
PID:4672
-
-
C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe"\\?\C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe" list5⤵
- Executes dropped EXE
PID:572
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
PID:1652
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
PID:3856
-
-
C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe"\\?\C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe" list5⤵
- Executes dropped EXE
PID:2056
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
PID:4476
-
-
C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe"\\?\C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe" list5⤵
- Executes dropped EXE
PID:3276
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
PID:2148
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
PID:4732
-
-
C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe"\\?\C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe" list5⤵
- Executes dropped EXE
PID:4804
-
-
C:\Program Files\Ghostly\binaries\adb.exe"\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l5⤵
- Executes dropped EXE
PID:2332
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Ghostly\binaries\AdbWinApi.dll
- Size 105KB
- SHA256 c1d653030b4bde65d3e07e4d0b0979e17be56df1436cdd15528630f27808050d
- MD5 fccdfea383a8d06fd152c2ffbd185dd0
- SHA1 68b0d91604138508770d42c6e07c24ff532177a3
- SHA512 9e3800f49ee6be49c0d85e84452003ac979284f557fba06a17d17c6723cf17ed22a391e01ba2aba7fa6c408a7a1b891f4c1cda966743356614b323177400f9eb
- SSDEEP 1536:kwqdq+3pvspmLh8SCykrpTG7kfGHuNezq02XJqo+iFi1yCPj7+/:kwqD3L8Tezq0et+ui1yYQ
- TLSH T1CCB36A227891C072C8D361B91AECF76592BEF4B10B7589C7339803DACE653C25B7529B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\binaries\AdbWinUsbApi.dll
- Size 71KB
- SHA256 0710e894d9b40f71a670c13c694079d564c92c1279da382cfe4850983aaebe1b
- MD5 ce674ec12db4255ca0fc65138f216eaa
- SHA1 6545accbf1da5c2fbceabe27ae0ae150079ae781
- SHA512 ef002691c9f11b99ae34325f127089dd20d9f19f18d8a9053351e019cf5ae7e1c522bc02d5bf4281064672f768ee57250116cc386eaa07fce297265ac8db1b3c
- SSDEEP 1536:q72doFmOiHizFbPlspcsbj5ZsP+YeTs1pT7+wY:qSSfN9+YeTs1pTe
- TLSH T190635C237990C472CC9651B819ECE621A67FBA501BB184C7779C03DBDE203D1ABB9397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\binaries\adb.exe
- Size 7.9MB
- SHA256 b4a6b455702684652cccf7b46258b29e653538904359a58fd4931cf3ef286b3f
- MD5 a800950fb8371b10f124d7be32926574
- SHA1 794bc33f872c4c6b828ff2570b86dc19691f41ca
- SHA512 fd73bd452c15e0bbda69d13714ecda67a0128032a02b4c33c9777ae7d1546df11b3d2577929ed0a5878b3ba1ae671a92f9d310a27b5bc2b4eb49a908bad9bf2d
- SSDEEP 196608:JjBE9hyMXyAwOoo+puSUIJkxLo0yCPrTuJockGHH31i:ZS9hyMXys4uSv2xLoKrs31i
- TLSH T1DF86AE02E153A17AD80310B1616EB33DAF344A1887258EFBDBD4EDB86B659E0353F719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\Crypto\Hash\_SHA224.pyd
- Size 21KB
- SHA256 773fac9a1a65b31d22f79a5e4f035ddc00301b741873d334ee9902db1d1bebfd
- MD5 f18df573602776a7449e4452aec66d99
- SHA1 28a957f3b1a738a4d10452faf867f484c2ac743c
- SHA512 ad6cd03b1ce8a01fe87ecdb403701e44c118a799e39fd36989be9997b9b29c8a4f52765a67d1cdce3bd9eeb2147020fdd898afde52a6f5855f1037e48cfae9e8
- SSDEEP 384:JKXqHGcvYHp5RYcARQOj4MSTjqgPmzIHXqBJ93c3O9zMR7kLMhgZvRv:JP/Ytswv9HXM3c3hkLMKZZv
- TLSH T137A20B19AF3884A4E40E603AB333867B7BF47600D394B7EF8A505B991C263ED563465A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\_bz2.pyd
- Size 84KB
- SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
- MD5 2be172c3086efe56c7e1d3279142295a
- SHA1 910e0d7ec11d1efda15d03ef826423834aa59fe3
- SHA512 37f84d9e6d766d8a97ccf0bd3c1a2a07f528cf45290762ef1f45e603cb513f43befec046693cf2e029366cca1682cd2753e54c53431773aba63c840bafcbf369
- SSDEEP 1536:5Qioz7CmAZG1OwJYrmbdmmv0KV06G68u+SSnrO+pIWCVeytH/9vfIZRE2:dozW2vJYanvEd3rlpIWCVWZb
- TLSH T184839E82F36857F6F49B91B986810797F770BA55071093BFF288C2992F03B816E5C35A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\_ctypes.pyd
- Size 124KB
- SHA256 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
- MD5 9314ab9707985aaf6e234b5c1fc3c3c6
- SHA1 e8ba1f40f800397e3e6a7f95ffe2b9f63bf812ed
- SHA512 a8436ccbc32dd31694d3a66072fa76933a2ecf0ef5eaa0b79380e6c53c8e8bd0bfaf7fe9341c17ced215792f3990f4ef220049da92dd4991ebc1d83ef3d41484
- SSDEEP 3072:SxVJxKqXCjbqPzMM+kffELENy/Zq4e4lIWLPhG:UHxKsCbqbffELCya4c
- TLSH T197C35B0B739410A6EBA35178C5B36F07E7B1B42B171183CF02A4C6992F637A36E6E715
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\_lzma.pyd
- Size 157KB
- SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
- MD5 7c25a079b992919cc97221955dac050c
- SHA1 d12d4e0f36bad9c578dcb69436fc2a7505feb316
- SHA512 ac7e3a3c7b8f766a0e0811718a048f0f8a4340374023fcfc7df0454e030521cd52314c23e80de118f24755046d77bac17d5abee634e7e5fe950b97f53bf5a64d
- SSDEEP 3072:tfXToXxWCKqZGOPenZCIlznfF9mNoxe6FK0GIHMJpIWZ1iW4I+:troXxSBOMvNYOxzxGIHm
- TLSH T10CF34B96B394F0D5F7328C38D6628F53E7F5785A0320929A01CC976D2B1FB759A2A313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\ada92cb5d92a588d1b93__mypyc.cp312-win_amd64.pyd
- Size 222KB
- SHA256 df5ea1b515f4e6677196f3d8c2f40a00b008d8e09152d08425f794e1b55f890d
- MD5 d66f0edb0e1bea4403c1f38fe554a620
- SHA1 3bfd2dee7da0d0641ed370e592c964e67252bbd3
- SHA512 f3a535e31fb9e5bbaa7575eef02d79029e067f24fcde0548b8fd185290fed7c09b67f5dc7034186f3345b23d8a53efadac7fac5a01d98ae03d9452a31e6eaff5
- SSDEEP 6144:ifUDesVRGeIiW1mrnHGGaxkP8VXaVlaz8fnt4HtFmiGJ/MIOM+033X+:KxsV8gW14G6le
- TLSH T14E24193662840066ED735275CC63A123DAF2B1610732A6CF05E0C7A55F2BFDAB6FDA05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-console-l1-1-0.dll
- Size 21KB
- SHA256 88ace577a9c51061cb7d1a36babbbefa48212fadc838ffde98fdfff60de18386
- MD5 9f746f4f7d845f063fea3c37dcebc27c
- SHA1 24d00523770127a5705fcc2a165731723df36312
- SHA512 306952418b095e5cf139372a7e684062d05b2209e41d74798a20d7819efeb41d9a53dc864cb62cc927a98df45f7365f32b72ec9b17ba1aee63e2bf4e1d61a6e4
- SSDEEP 192:xt/cOTWthWfWJWadJCsVWQ4OWKNVAv+cQ0GX01k9z3A1tUXj:xpcgWthW2CsjNbZR9zOtUX
- TLSH T137A219D38EAC8546F8AB9D7046E8DA437C3E6BC71950615525F8F55C2CA33C1EB20B2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-datetime-l1-1-0.dll
- Size 21KB
- SHA256 1bd81dfd19204b44662510d9054852fb77c9f25c1088d647881c9b976cc16818
- MD5 8f8eb9cb9e78e3a611bc8acaec4399cb
- SHA1 237eee6e6e0705c4be7b0ef716b6a4136bf4e8a8
- SHA512 5b10404cdc29e9fc612a0111b0b22f41d78e9a694631f48f186bdde940c477c88f202377e887b05d914108b9be531e6790f8f56e6f03273ab964209d83a60596
- SSDEEP 192:xVIWthWWWEXCVWQ4OWGwvNVAv+cQ0GX01k9z3A1tUG71A5q:xVIWthWJoNbZR9zOtUG7mq
- TLSH T1A4A218938AAC8143FCEA2D7012E8DE83BD3D63D71A40916616E4F4582D937C1EB20B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-debug-l1-1-0.dll
- Size 21KB
- SHA256 591358eb4d1531e9563ee0813e4301c552ce364c912ce684d16576eabf195dc3
- MD5 226a5983ae2cbbf0c1bda85d65948abc
- SHA1 d0f131dcba0f0717c5dea4a9ca7f2e2ecf0ad1c3
- SHA512 a1e6671091bd5b2f83bfaa8fcf47093026e354563f84559bd2b57d6e9fa1671eea27b4ed8493e9fdf4bde814074dc669de047b4272b2d14b4f928d25c4be819d
- SSDEEP 192:xqWthW8WEXCVWQ4iWUAURDoSJj+iX01k9z3A0FCH1Whf:xqWthWH/DX+iR9zHFCMf
- TLSH T194A23BD68BBCC142F9DBAEB0529CDA437C3C57C71A10D16646A5F19828D33C4EF20A6D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-errorhandling-l1-1-0.dll
- Size 21KB
- SHA256 d56ce7b1cd76108ad6c137326ec694a14c99d48c3d7b0ace8c3ff4d9bcee3ce8
- MD5 c2f8c03ecce9941492bfbe4b82f7d2d5
- SHA1 909c66c6dfea5e0c74d3892d980918251bb08632
- SHA512 7c6c85e390bbe903265574e0e7a074da2ce30d9376d7a91a121a3e0b1a8b0fffd5579f404d91836525d4400d2760cb74c9cb448f8c5ae9713385329612b074cf
- SSDEEP 192:x3XmxD3TsWthWBWJWadJCsVWQ4iWozCCtvpGX01k9z3AtYF2LkQ9:x3X0sWthWgCsJZpGR9zMlkE
- TLSH T111A229D686BC8143F9AA6DB042D9DD433C3D6BC65E5150260AE9F1581C973C1EE24F2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-fibers-l1-1-0.dll
- Size 21KB
- SHA256 91d249d7bc0e38ef6bcb17158b1fdc6dd8888dc086615c9b8b750b87e52a5fb3
- MD5 b5e2760c5a46dbeb8ae18c75f335707e
- SHA1 e71db44fc0e0c125de90a9a87ccb1461e72a9030
- SHA512 c3400772d501c5356f873d96b95dc33428a34b6fcaad83234b6782b5f4bf087121e4fd84885b1abab202066da98eb424f93dd2eed19a0e2a9f6ff4a5cfd1e4f3
- SSDEEP 192:xLWthW6WJWadJCsVWQ4KWeeLrp0KBQfX01k9z3A3WXa0Sr0:xLWthW3CsneRxB+R9zcWXJB
- TLSH T1B5A21A815A7C8187FDAB6D7042E9EA973C3D67C72E5090AA45D4F5582CD33C4AF20E2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-fibers-l1-1-1.dll
- Size 21KB
- SHA256 fc9d86cec621383eab636ebc87ddd3f5c19a3cb2a33d97be112c051d0b275429
- MD5 050a30a687e7a2fa6f086a0db89aa131
- SHA1 1484322caaf0d71cbb873a2b87bdd8d456da1a3b
- SHA512 07a15aa3b0830f857b9b9ffeb57b6593ae40847a146c5041d38be9ce3410f58caa091a7d5671cc1bc7285b51d4547e3004cf0e634ae51fe3da0051e54d8759e1
- SSDEEP 192:x8sWthWXWJWadJCsVWQ4KWqSY00pyEuX01k9z3AxzIsZ:xLWthWOCs4EpcR9zwpZ
- TLSH T130A23B829EBC4143FDABAE7043E5DA873C3D67C71D90A0A61594F59C1C973C4AB20A3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-file-l1-1-0.dll
- Size 25KB
- SHA256 1ca895aba4e7435563a6b43e85eba67a0f8c74aa6a6a94d0fc48fa35535e2585
- MD5 9f45a47ebfd9d0629f4935764243dd5a
- SHA1 86a4a0ea205e31fb73f3bfcce24945bd6bea06c7
- SHA512 8c1cdcad557bff1685a633d181fcf14ec512d322caeaeb9c937da8794c74694fe93528fc9578cb75098f50a2489ed4a5dedf8c8c2ac93eeb9c8f50e3dd690d5f
- SSDEEP 192:xWwhDPvVr8rFTsvWthWoWEXCVWQ4KW7OcADB6ZX01k9z3A5tUQv/zf:x7JPvVrhWthWjncTR9z8SQv/zf
- TLSH T10EC22A93D9A4E24BFCCF9E7161A6D9836C3453C7041480CA57D8A75C3DE3386E3A8999
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-file-l1-2-0.dll
- Size 21KB
- SHA256 4cadbc0c39da7c6722206fdcebd670abe5b8d261e7b041dd94f9397a89d1990d
- MD5 cc228ff8d86b608e73026b1e9960b2f8
- SHA1 cef0705aee1e8702589524879a49e859505d6fe0
- SHA512 17abd9e0ec20b7eb686e3c0f41b043d0742ab7f9501a423b2d2922d44af660379792d1cc6221effbd7e856575d5babf72657ae9127c87cc5cf678bd2ceb1228f
- SSDEEP 192:xPEkMRmKjoRWthW5WEXCVWQ4OWiGfmKDUX01k9z3Alh1EwsPRj:xMKRWthW2XWmpR9zqgt
- TLSH T1FAA21A928A6C8143F9EB6D7052B8EE837C3C77C7195090665AE8F5981C833C5EF24B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-file-l2-1-0.dll
- Size 21KB
- SHA256 93c624b366ba16c643fc8933070a26f03b073ad0cf7f80173266d67536c61989
- MD5 e368a236f5676a3da44e76870cd691c9
- SHA1 e4f1d2c6f714a47f0dc29021855c632ef98b0a74
- SHA512 f5126498a8b65ab20afaaf6b0f179ab5286810384d44638c35f3779f37e288a51c28bed3c3f8125d51feb2a0909329f3b21273cb33b3c30728b87318480a9ef8
- SSDEEP 192:x+SWthWjWJWadJCsVWQ4iWKjTnKIjwX01k9z3A24haD:x+SWthW6CsVjTKHR9zp4haD
- TLSH T1BFA22C86DEAC9103FDAABD7042E9D9473C3E67C72940806717A9F45C1C973C5EB20A6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-handle-l1-1-0.dll
- Size 21KB
- SHA256 39095f59c41d76ec81bb2723d646fde4c148e7cc3402f4980d2ade95cb9c84f9
- MD5 416aa8314222db6cbb3760856be13d46
- SHA1 5f28fe2d565378c033ef8eea874bc38f4b205327
- SHA512 b16ed31dc3343caea47c771326810c040a082e0ab65d9ae69946498ceb6ae0dee0a570dbcd88090668a100b952c1ff88bade148811b913c90931aa0e657cd808
- SSDEEP 192:xk1WthWUWEXCVWQ4iWNtu6OMI8HNsAX01k9z3AqMp42C8H:xk1WthW/OtTOMtHNsAR9zipbH
- TLSH T1B0A22BD2DA6C9143F9AB7EB002D8D9837C3C67C71A5094AA0699F5582CD33C5DB24B2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-heap-l1-1-0.dll
- Size 21KB
- SHA256 8f105771b236dbcb859de271f0a6822ce1cb79c36988dd42c9e3f6f55c5f7eb9
- MD5 344a09b4be069f86356a89482c156647
- SHA1 2506ffeb157cb531195dd04d11d07c16e4429530
- SHA512 4c1e616443576dc83200a4f98d122065926f23212b6647b601470806151ff15ea44996364674821afec492b29ba868f188a9d6119b1e1d378a268f1584ca5b29
- SSDEEP 192:xV4xlRWthWKWJWadJCsVWQ4KWrNwwKUWX01k9z3A6weT4:xV4xlRWthWnCsm2R9zDw/
- TLSH T178A22A89CA788247F9AF9E7063E9DA873C3D67C61900906205D8F15D2CA33D1EB35B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-interlocked-l1-1-0.dll
- Size 21KB
- SHA256 53b25e753ca785bf8b695d89dde5818a318890211dc992a89146f16658f0b606
- MD5 86023497fa48ca2c7705d3f90b76ebc5
- SHA1 835215d7954e57d33d9b34d8850e8dc82f6d09e8
- SHA512 8f8370f4c0b27779d18529164fa40cbfddafa81a4300d9273713b13428d0367d50583271ea388d43c1a96fed5893448cd14711d5312da9dfa09b9893df333186
- SSDEEP 192:xffW30WthWmWJWadJCsVWQ4OW8xNVAv+cQ0GX01k9z3A1tU:x230WthWjCsvxNbZR9zOtU
- TLSH T16CA219D28EBC9582F9FA6E7052F8DE837C3D67C61A4050660AE4E55C2D973C0EB20B1D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-kernel32-legacy-l1-1-1.dll
- Size 21KB
- SHA256 a9b13a1cd1b8c19b0c6b4afcd5bb0dd29c0e2288231ac9e6db8510094ce68ba6
- MD5 0c1cc0a54d4b38885e1b250b40a34a84
- SHA1 24400f712bbe1dd260ed407d1eb24c35dcb2ecac
- SHA512 71674e7ed8650cac26b6f11a05bfc12bd7332588d21cf81d827c1d22df5730a13c1e6b3ba797573bb05b3138f8d46091402e63c059650c7e33208d50973dde39
- SSDEEP 192:x7BYlLWthW9jWEXCVWQ4WWss5INFPKBWX01k9z3AHVkswJhNRv:x7BiWthWuA58KER9zMVwhv
- TLSH T1B2A22BC796AC8143FDAA6DB012A9D5837C3867C71A50946617E8F59C2CD33C4EB30B6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-libraryloader-l1-1-0.dll
- Size 21KB
- SHA256 7f39ba298b41e4963047341288cab36b6a241835ee11ba4ad70f44dacd40906c
- MD5 5fbcb20d99e463259b4f15429010b9cd
- SHA1 b16770f8bb53dc2bafcb309824d6fa7b57044d8a
- SHA512 7ba1ac34b3ecfbfb8252f5875be381d8ef823b50dfe0e070222175ee51191f5ee6d541eeedd1445ed603a23d200ce9ce15914c8ed3fafe7e7f3591f51f896c58
- SSDEEP 192:xZTvuBL3BBLSWthWMWEXCVWQ4qWOQyttuX01k9z3A2hpwA:xZTvuBL3BEWthW3Z1SR9z1hC
- TLSH T17DA21AC7D9ACA243FDDA6D7042A8D9436C3967C75D10D4BE46D9E29C2CA3381EB20F19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-localization-l1-2-0.dll
- Size 21KB
- SHA256 6ee44dd0d8510dc024c9f7c79b1b9fa88c987b26b6beb6653ddd11751c34e5dc
- MD5 5241df2e95e31e73ccfd6357ad309df0
- SHA1 2644cc5e86dfad1ad2140181ab2ca79725f95411
- SHA512 52cccd1dd237e764e34996c0c5f7a759a7f0eff29b61befeaf96a16d80df2ba9ee2c3615f875153198a145d68f275aea6d02187e6eee5a129e3e2ab81aaceb16
- SSDEEP 384:x4naOMw3zdp3bwjGzue9/0jCRrndbwWthWJluDtdQ5R9zY/yOC:xpOMwBprwjGzue9/0jCRrndbj5ds9zYK
- TLSH T160A22A92C6E8D303F84DD970316AD9432C3C67CA0951D8A603E6FB1835E3399EB6076D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-memory-l1-1-0.dll
- Size 21KB
- SHA256 0512a35316ec9180437f86696a84c5c06a7e4e82e050055a656e5bf9fca206f9
- MD5 8d285430e8bda6d5c9b683579adcb180
- SHA1 619dbbcff06c659e3fc48f03917a4dadbfc1c275
- SHA512 38405dd85dd62f843abb55acea1b64d7d63bb601445bf1b32078cde5bbef4861dd99f26659281fe2aea86f58cfb1725d8c63d91fb539dcbf5d98cdbe783337fc
- SSDEEP 192:xiVWthWZWEXCVWQ4OWO6xx6RMySX01k9z3Au1tQyIV:xiVWthWWn6yMR9zv1ta
- TLSH T1D6A24B8A99AC9503FCD66D7093E4DAC37C3E97C70D90946606A8F5492CD33D1EB30A6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-namedpipe-l1-1-0.dll
- Size 21KB
- SHA256 c05f1fffe3b5a2738ea54ce9485cca026fb9635f982626fba1e1dcc531897273
- MD5 4a28ca64f44b91f43945ee3971e0996a
- SHA1 45b3d8584c58e8d6ae507fdbd772feeb1886c8b0
- SHA512 862a0428f08d447cd1ee0431969e0fbcb182f4c46418c26d26fa33e586e686d9c093c1ca5781f544ce9276195ce973850719636e39e465f059607f455ecfdd93
- SSDEEP 192:xeWthWlWJWadJCsVWQ4iWlWd9qLrRGhFKeX01k9z3Atos/orz3hj:xeWthWECsmWTu0R9zwpgfxj
- TLSH T1A0A22A9686AC8143F99EAE7002ECD5437C3D67CE5950842A57E9F89D1C933D0DB34B2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-processenvironment-l1-1-0.dll
- Size 21KB
- SHA256 c4eca98c3c67b6395d5b005b00ac1eb0318b86b23aa71035a44c2b1602befba9
- MD5 7fd4a71085783ccfe9c289c07bcf9b04
- SHA1 bb6ffdb5c069dbba06998dc877d24f72dad6298d
- SHA512 a96c5b90b8384b239be111d90caa3b947651ad73382ab9e5dbe4a4b6ad30921876545331d37c8d5a8f669e39d71bf60983c4ba39c479e23015c2f7579c5e55cd
- SSDEEP 192:xq8Fg9WthW1WJWadJCsVWQ4OWXQM6Bm+0U8X01k9z3AfMeyujDqgjP:x1FKWthW0CszBBmo8R9zmyujWgj
- TLSH T12EA21AC68ABC6103FD9A6D70029DD6A73C3D67E71C40807546E8E65C2CE7391E720A6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-processthreads-l1-1-0.dll
- Size 21KB
- SHA256 5ccb89e93d67bc3288d4e84649c5346e66e15e3d7cd65d989daf3f4cb584be9a
- MD5 c123f2c161884fbff4f00ef1e1391266
- SHA1 7db3055da53916bea2b85b159491a0772fb620ce
- SHA512 dac5616320b9052254b5687959e67126c4a938e79173d8245675a9651674384c36cc856f996ef88ae621ec67afc6616626657585d92bb5d14602a7cc9fc0f669
- SSDEEP 384:xock1JzNcKSI/WthWDCsmzxIPaR9zvfF8:xOcKSLNzxOW9z6
- TLSH T1D1A21AD285AC8283F88E6D302295DA532C3ED7961D25807206E4F29D3DEB3C1E62853E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-processthreads-l1-1-1.dll
- Size 21KB
- SHA256 4ad565a8ba3ef0ea8ab87221ad11f83ee0bc844ce236607958406663b407333e
- MD5 385f562bdc391ccd4f81aca3719f3236
- SHA1 f6633e1dac227ba3cd14d004748ef0c1c4135e67
- SHA512 b72ed1a02d4a02791ca5490b35f7e2cb6cb988e4899eda78134a34fb28964ea573d3289b69d5db1aac2289d1f24fd0a432b8187f7ae8147656d38691ae923f27
- SSDEEP 192:xVfDfIe+WthWeWJWadJCsVWQ4KWbJzLrp0KBQfX01k9z3A3WXywMCl:xVfDfIe+WthWbCsIzRxB+R9zcWXsCl
- TLSH T1A6A22B829A7C4183F9EB5DB052E5EA532C3E77C72A50806605E4F15C2DD73C1AB20A2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-profile-l1-1-0.dll
- Size 21KB
- SHA256 7809160932f44e59b021699f5bc68799eb7293ee1fa926d6fcca3c3445302e61
- MD5 7a629293eeb0bca5f9bdee8ade477c54
- SHA1 a25bf8bac4fbfd9216ea827e71344ba07b1d463b
- SHA512 1c58c547d1fe9b54ddf07e5407edaf3375c6425ca357aa81d09c76a001376c43487476a6f18c891065ab99680501b0f43a16a10ed8e0d5e87b9a9542098f45fe
- SSDEEP 192:xTYY/beLWthWyxWEXCVWQ4iWZTc9qLrRGhFKeX01k9z3Atosrksq:xTYY/beLWthWyuw+u0R9zwprJq
- TLSH T143A23C92CBBC4043FDDB6D7042E8D9837C3D67CB5950956B06E9F49818933C4EB21A6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\base_library.zip
- Size 1.3MB
- SHA256 45e0d14fb2d34acd7ab4dc41f8c31ad64ef32d3f806ec74f168005573c1df4b1
- MD5 28ccb892108b919f439a06feffcf3352
- SHA1 f789f7f48038d566025f5a795835780947414973
- SHA512 980aa71cc3fa618512f194bb1da4398ed52e071a53c70f93757c922fce8334b86342f5be5c69b2f04a2bcfb7dd86c26666d4927a2cf15b5f0bfb0d8341958341
- SSDEEP 12288:S8lJGUmZx/sX9WVNtR3rmn92w2/HqnVTVihlyixmpvQXMHYIHbP1dmooe1:S8lJGUuS9qJ69v2/HqhZbP1dmu1
- TLSH T11F55D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\charset_normalizer\cd.cp312-win_amd64.pyd
- Size 10KB
- SHA256 be1d8801c9785a52e5bc1b0c77ceca2c88041a5d9b9bac7162d767f712ea10e3
- MD5 baf53803e705ad4208c93426be81071a
- SHA1 c40eadb8fd83a07f7786b3d16b1f70c0876a9bb5
- SHA512 f4e4a6ed825d83fdf2dd7a4258fc2e57dee4ca5fe5e873bde2075107dd8675e257106b895eaf9f86d31a512ba30ba965aa03476b0f45c368fa9fb9798edd555e
- SSDEEP 192:nJD0eIaQYVYZuLnN6KxvecRo930aeG1TbWVcS9H7EuO5:7kYVVLN6Kxxo93MmEcSZ4l
- TLSH T18E22F74CFA558CF6EA250239C9A74F1E72B5BA25178237CF4370C12E1EE3BE65279580
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\ifaddr-0.2.0.dist-info\INSTALLER
- Size 4B
- SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
- MD5 365c9bfeb7d89244f2ce01c1de44cb85
- SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
- SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
- MD5 SHA1 SHA512
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\django-stubs\django-stubs\contrib\flatpages\urls.pyi
- Size 59B
- SHA256 a0869d2c9451a944b87f059edc5d93c1d415888b98b9247b8aeb5489d9dcba7d
- MD5 72baef07657af40bbb9421362b0c67cd
- SHA1 e0e802c0e54240712b8bd8418627b2ffa123bc94
- SHA512 32e4cddc4df9759ad46f617cd69b2adc130a918cac4f588cf563d8e3c298ece3a5bb0a9dc9a082cbdc015f2789336a6e67d545603ea69477fc5de28256fd6d06
- TLSH T156A002864456BD866BEB4C0C50294030492D50C26F55493582A9936053914E48439119
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\django-stubs\django-stubs\core\mail\backends\filebased.pyi
- Size 103B
- SHA256 ae9de027f591acfedc0ba387099c4398c0841a9c126535d313ffbdb18184eea0
- MD5 7f6526c1bbcb2aa7ba6a8cde268765bc
- SHA1 cfc87c1fd110239d47886e0c5ebcad54bd453bbe
- SHA512 3c6f26b5f0ab2bc22e72e116ffe28624e5d971a86b9d85e5f733844827e784b8349c46fa46ca5390bc972607b7fb5b37a6fb47b410e105f02b147dfe77a737c7
- TLSH T193B0924460A342810FF69AE230F431905998340B8D38980A4F0031140B30C463E0A11E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\django-stubs\django-stubs\core\management\commands\testserver.pyi
- Size 85B
- SHA256 1a4fa10dd76be871ebe4f02bc9ccf70eaa1e178efa5291aa6aff471a9fcdb272
- MD5 6b8cad3305cef8186496283d80f5ea37
- SHA1 418009700ba673f4aebf49db46d1f44384d4f8f8
- SHA512 e06ba45ea1bd65681f3be4a85118d4bc75c961e82dc6d319c6a2b1a7a39533732fe7c5d152ea978e0dd62c1ea520eb62c9322eaed82ca5588495fa1465f71555
- TLSH T1C3A01208F0BD01E301CA80C6080422B134F1320245580C0315347D380C208C71C43101
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\django-stubs\django-stubs\db\backends\postgresql\creation.pyi
- Size 117B
- SHA256 7e724b81758b570f4c0db90f33f3eb96008d784a2fc911566a1982a661ad2fd0
- MD5 d777430060f3f4152b7cf359860a923e
- SHA1 5b613b527a03f141359595986e485c3354de1e55
- SHA512 be258dbe8e9637e92f5c895fe7dbb9160c053a047ea111e22e4ea497db8895aa15d95031b0aaea8c7092efe64fb43d5e007f05553f243b4a685377c46da42ed9
- TLSH T1EDB012C113020D9301EFC4473918C19701773C0145CA05000CDBC3E026304C73703607
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\django-stubs\django-stubs\db\backends\postgresql\operations.pyi
- Size 125B
- SHA256 f25e08acd46b419264f8b2db1f7cc65aa8294e6057036fab52c3fbe8682963f6
- MD5 ff32cc8f8bd938a5b4d6ba4618ac8787
- SHA1 bf49c15cc384b64055d6f6c26c512ce6b83d929a
- SHA512 ab7ef72c7fe9043d017fd3d4f39ba4a1411226e1bc3d10015a9754b562fdd8ce662452ddfc9efab66ac255928fae9d5e9fbb40065836391732da0d5ee3eb51c6
- TLSH T1A4B09285330207B242DFE357006880A4007EE8014ECA28404E1FC2D2F133C45360BD06
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stdlib\encodings\cp1026.pyi
- Size 730B
- SHA256 08663c54b1b600c85ea305e6103d01bb350ae41c9f0cd52b264a3650974551be
- MD5 ee8b2dc81acd1ed83a5aadc71d839ce7
- SHA1 96317badd9a196e246d8f585d1be38f32c007a8f
- SHA512 cf08c5275aae96033c1746de24e32af2f2c784d043bd6f22d50e3c64e9da59e27e059ae0e1814a4c0f6f9a7eb84652fa01a8e79030750554ee0af2a1abd3b685
- TLSH T1CF01C0891D2689D067BD91BA9000CD3B964E76E1893E2C65BCF2C3901EC062D95B5B0C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stdlib\encodings\cp737.pyi
- Size 733B
- SHA256 22e29100d1453aa2195b8ae046ded4aa77761f1c9e82d60ab983b055b451f606
- MD5 c56b5725a62194037e8c04af982f8ed4
- SHA1 8d4d4abab0f489006f2d70d14d2ad4fed6936b51
- SHA512 0552ab7ae35e7ed6e8050d50fecc1bbb8320d91f69daf3ec68340e4b70a821d751b6f9e0127488256833e53e2e69b3ef9862f66b7bfae64f5491a153edfe2553
- TLSH T11C01C0891D6686D197FD96BAD140CD3B954E76F18D3E2C217CF182A01EC082C427670C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stdlib\encodings\cp932.pyi
- Size 920B
- SHA256 9564886ba7353ce6726f0857c0d39e4e6c3996d26215389ec32185aab054dfe5
- MD5 b5d3ebfb8bdcb8319a2a3f3d2f376ebb
- SHA1 8cb636f53dcc85457c4f81103e710ed31ef32eba
- SHA512 ef538eeb071bac17353e65d389841ed7bf702ae7cba4ee5025f67ef19af94fd3c872d0f592afbc0cfddfaab205632946cff243bcdaeea9a2ba88871bc39ea654
- TLSH T1921125832DF646A1D6BF0196BE16DE21911C3A639B990E0E3FB183A80FA9D10D12436C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\aws-xray-sdk\aws_xray_sdk\ext\httpx\__init__.pyi
- Size 55B
- SHA256 d3b7520fe93d3fc021e4c0c938c23dd6c42c56f9d6caa17826c054bd2c0bb018
- MD5 6c3c6e8309bd9a65a0e520484605613f
- SHA1 4c4e070a122c5789571045af366b094daa65b7ba
- SHA512 fca6cb5328d31e5b4ee74dfe53e66e5a19f190d346a5021fd7bd408c3bda9d3de78f5d8e820cc1dad434cd837f470a90da96e79dcb1509fea96d732b583c2013
- TLSH T1219002F71DE5171084208103035F631145279E915F6010556514092553459420900810
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\aws-xray-sdk\aws_xray_sdk\ext\pg8000\patch.pyi
- Size 52B
- SHA256 caa04f4116d57cba6b439bf3c128ab019de1c49aef89632d81c70e464babc33a
- MD5 ee26f85d4a37f708f28c167bc1cb4093
- SHA1 5ebc592d3be5dea14fbb2a359d1e3d2d2734056e
- SHA512 836dfcbafaa7b2221c9605b7e977d70d1fde776f891fcd983e74dabcb462d091ebfeb8053ed0480c75c883db88edbd1bbcfd8ef3a00ec6633e68c55fd18906c2
- MD5 SHA1 SHA512
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\aws-xray-sdk\aws_xray_sdk\ext\psycopg\patch.pyi
- Size 25B
- SHA256 9dd03142ef8ea162b2dc2cee6d01577c7e9b25eb176dea913d1808dfb52beabb
- MD5 e9a0de49fc11967b387f0d27e9bef737
- SHA1 7a5439ff1539eb600aebd08ae71f0e9f4112560a
- SHA512 93163e8ab9cec33998fe73b5878ddf438219391c0dd48a64037d0c165e831b92a73a6562829f5edb3f5ad22f028a7305f34adac48278e82b5d93381d2df8272f
- MD5 SHA1 SHA512
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\aws-xray-sdk\aws_xray_sdk\ext\sqlalchemy_core\__init__.pyi
- Size 86B
- SHA256 e4a70cfc5c6ccdeaf213ed803b109ba89f07a61635ec8483b6f697e6c2b54ed4
- MD5 fee3b8e503100f2b9de5c476e73fd292
- SHA1 1657b5dd55aeede530158aec1809337eb715ea63
- SHA512 e384cc9fd5e80d206c63e2f253698d7f5e2d9e17b4a669bf69d6c5e4d7bece1b0e7337cc33028ae0a67ffb1a651473f5bd646e866d471ed7c841b3a981efe7a5
- TLSH T189A002F71EF9172198308113036F6322496BBFD95F6135A5E5254F35934BD820F05D20
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\dateparser\dateparser\custom_language_detection\fasttext.pyi
- Size 79B
- SHA256 a693bbab260ed91dea09f7b2b2e808fd842f1a3ad05797d4015cbd0a9b05f69f
- MD5 9c5ad9004c2ef235a053c77ff1f7e6d1
- SHA1 f2279fe1feffc16c2ec0809004383dbbbaa9989d
- SHA512 fc3f8f2ceb3fc2cc1984948008568301455f31b9a7f5aac6e28694c6526991b31d374941c986fbb7a9aecbf98aadaf9fd9bf3b860f6b1f6d0bfc6583da4acbd9
- TLSH T177A01242041B2A171AF60800C1411537042641D4424D69012204120004C300E40F30D5
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\docker\docker\version.pyi
- Size 17B
- SHA256 636e67e38a72137be9f763220012ab70adc8591c90d491b5ad9e147eacb69c2d
- MD5 3cfcd308f6cee078df2a3b8453aa210b
- SHA1 24063dd2fd1ad006b8e74517b956ff3fd0bb0b71
- SHA512 91e11dc2417a60fb9b157ad529406ec7d420488846fb34ef343a50e06de35f052a58b0bfd2e4b604ccc2e2f60d21778c5ec6b1d6bf7952521e05723e575db53b
- MD5 SHA1 SHA512
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\docutils\docutils\languages\ar.pyi
- Size 182B
- SHA256 091a29a1e46d4d88e274821a968102ab37091f5e19de942c07764a40260a3744
- MD5 5cdca6a8de3232b8386ba22c1b21022c
- SHA1 4451adb529f2517288e322d63b6c11cd5d4a6601
- SHA512 61cae9989c1f97c8014eb227d1918a06d5e226890d297b239adb3b09bd277a6e312140cd318066207b52fb5a25098563472bc33226ff5349ad78f30b8598feea
- TLSH T1C5C0128305A3084EA7ED5435A520592257AE00D0DB2A4B8D61581638D94751F1535668
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\docutils\docutils\languages\cs.pyi
- Size 180B
- SHA256 e8750bad8cd7bb1eefc49bf468ce786c1eb3c62ff4fa9a6a15b74a453f9d4d47
- MD5 e825c0c02c43a3a70ae156b5b768fde6
- SHA1 b7924c4e7ccd057e22104d414b31e086fb4dd398
- SHA512 343d9e39ad524653735da4a7b9c8c75a5c8d91e5e8928202925ba284ab28d26f309d6b05d9010ecb3b2e21ab2e259ddec041afe72b0111f6b464eb931b67db85
- TLSH T1EAC0129304A35C4AA7ED5435A520551257AA00E0D72A4A8D615C1638D95711E1935668
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\docutils\docutils\languages\zh_cn.pyi
- Size 157B
- SHA256 cb00d32f278275452988bf2aafc3cc7ece5075b9940cedf26fc6a0d383fb1996
- MD5 5d4a0c4e40306c7007ec34ecb3c034b0
- SHA1 e8b706bbf34138a3addccd0dd7defd559e5a9beb
- SHA512 6037582bdee770ecd50ef9b207d9c8d1051cc4cb36ca713bff55ed34b6e6a006335ca360721e5bba18fafa17551ac212fb0a53cdea70132e757a035b95b8e2ff
- TLSH T128C08C8305B3048EBBE86035C5201A2313BE00D0972A8B8C719826349D8320D093665C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\docutils\docutils\parsers\rst\languages\ca.pyi
- Size 117B
- SHA256 7dd28eca78db7632bd9dc70a8c31e555699fad5332a04e51f5cabe4f5b51c97d
- MD5 08ccc9e8b111b3d302bab36507f97044
- SHA1 7af52592c734749229462c144c04451052bf125d
- SHA512 6b02a0fcdbf20815180c3c13dd6b5fa9b486442dcaddd99b8e0289b77e08585f8f4c75f44866643283d79805f8a2f217dd6f2b74a6d097adb4365c077484ec69
- TLSH T1CDB0925349A7244A23F0553442240A322BBE01D1932E5ADC25A426388D4561D197126D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\gevent\gevent\libev\__init__.pyi
- Size 24B
- SHA256 8eea9df4f6d7b38ca0e39ccc27b04700e3d08dbeec8046d613d22706d19985fa
- MD5 8cad7b52788a1f41859dbfd33f997a6b
- SHA1 7013d5e39227a5fe833fdc7901145266ee61c6f5
- SHA512 386ba6e65b5cf40e034ecfdd4cc396331a79634ae94f5ecac7b612164ba77ad47794993d9726578765f03887e009db7bfb009e4549f6ab86e32aeb91faa63f69
- MD5 SHA1 SHA512
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\lupa\lupa\lua53.pyi
- Size 3KB
- SHA256 71b5af692107be0868cd47af49779406b579e82c384648ad82d113c9469be167
- MD5 3260bf4d47f9f5f99857c70147b8b361
- SHA1 71928660e4ea929a0d4ea3029ffb80dba902ef00
- SHA512 62e0fd4b96630a9b7c2c64e082771febf7d4f8fef3e8cebb652459d5be8d8a7b66974cc3f3dce8d62d21d15da248c1bfdb088b5e8aef6f82b7ac5daa5d6ee36f
- TLSH T13181200D821AF2F302AADDB544162BB7DE29C1935E7CB43464F4F4ED1BD7038C8A6699
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\lupa\lupa\luajit20.pyi
- Size 3KB
- SHA256 2621a362ed4303e45a76a1492a3a0d7ed98fefc6b5d369df67a300d3e170b1a3
- MD5 6d9b267cf06d8ca3306d6c828c2e5c40
- SHA1 1b768c1e78fa0b12186ccbdd31d4175e468f76f4
- SHA512 d0f719bcb876b13c9edfc16e33b5ebcce0861ec6f0222f0a16a7ba090866b0aeda74d4adb03978eb05f207a88bb06e99da3e8b9019b2f7c9d73bb09bfa948f4f
- TLSH T14961EF1D821AF2E341BADD3848122BB79E3990935F7D743475F0F4E96BE7038C8A6199
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\lupa\lupa\version.pyi
- Size 50B
- SHA256 1bc0f1ada46ee63106faf7b4ea6b29f57a07a90c2d9c512356d0922deeef693c
- MD5 2e0a8f4a89631f160794c3be3eceea9b
- SHA1 8c65677e5de8ab21145fdd21a8e80812bb9fc390
- SHA512 50822084e85dd25c6cbd88f09744199005d0b4fec3f1496572d7bcb89fb99a9bcff3b11fb2f069dd00fee6098313a901476f3af6a6f5ca2e9464e3682b9c1673
- TLSH T1AE9002410A31455655F98629122D5018132301A02741460813846238A39159F55751AC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\six\six\moves\SimpleHTTPServer.pyi
- Size 26B
- SHA256 bed05425469b4eb2152bdec29f43212d48474a56e61c1f10810956c1a747fbac
- MD5 59c113ba8da07ed8b8cf1d9fa0cb0a08
- SHA1 b29c918fa7f8eb1f29f0a940f7bc3473d1f5d5e1
- SHA512 98a1b860fb715c34568ec9247df52f480fd5fa72eac8c3b34954bfc2b35fb4b0bf73ea421950a9c027a20fc364207bf930edff3033490acf4011098afbe098e1
- MD5 SHA1 SHA512
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\six\six\moves\_dummy_thread.pyi
- Size 22B
- SHA256 027dc4b3528f32d138ec62be1ca57f5a7b86ee47e84f96e1f9b9ff49f390e4f7
- MD5 264bddb3174e841f3290f783e4529e03
- SHA1 9cf6d1082c8801906899fce8ea82b81fd038fc28
- SHA512 be2fdc06cbfed4802a23b543306bf0ed57374395dff87cc0db800c651748748077feab423a50efce0a6c17f96b98701403a8ba94a725b79351a3b50c6e688ffc
- MD5 SHA1 SHA512
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\six\six\moves\tkinter_filedialog.pyi
- Size 33B
- SHA256 ce71ee5aab9b3305e238d58fd5b84d4660175157077579fd07c02aa09bb81206
- MD5 f8d574ac9b02c149019de779c681cfa4
- SHA1 b6c4e450ca85bad7f1bb25f5c2d0b32fb6c0619c
- SHA512 82d1c6ded5274624c9b925784880d36625c652c2876ba90395eb7f3fdcaf8ce477d1d7180e74f4fdb58182dab63e57e8127755e2d8bb0b8b82dac913178d95cd
- MD5 SHA1 SHA512
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\tensorflow\tensorflow\python\keras\__init__.pyi
- Size 53B
- SHA256 85c7c729385046289b3971a73de1141ee9ebb6f88c768ae3d0cb5d9c8c0bb65f
- MD5 da2d0a9a18322c50cf5fa08e2a669637
- SHA1 edea4946228aec0136eaf76e4877e35829569da6
- SHA512 771ba360ef0b6a82b059526ff686e2bbcf6b72c8c8c15fcf91b8962c6bf8b751fd1538c822de5f18c5da0923db0a7b2c88e825072c69c6f331c0026e5c4e3de5
- TLSH T13290021B41797996472A095AED320595595429448258405054455059128E10985552DD
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\parso\python\grammar313.txt
- Size 7KB
- SHA256 a33fbb9f58d463c8213e8784dc033d8a9355fddae2dc135f10f87c1e6b968cc5
- MD5 7752cfb4e5260647e6fbc7ebdd92ee93
- SHA1 ff5e18b7398a6382a0ffb19315797bbe5498c2a4
- SHA512 bad4c33423d5657e12efdf3784a6d9e822c00dc54abb2340a1a81ee4d5201c34275f9ffc879fe68aae32c95e98a24e75e5648b8523da0816b2b8fc07dba6c93c
- SSDEEP 192:d8cHcdJJZYu2koUX3X1pR3SylUrgM4B9hU6T+:dviX3X1pYyert4Dhi
- TLSH T187F1921DA6DB07050BD264B7554CF3BA49C9D18E20378176FBCD92FD8FCB0A42622B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\parso\python\grammar39.txt
- Size 7KB
- SHA256 715ad56c5f4f8395092c58b6b6f2deb4f906f81380929a836bd86ab253634875
- MD5 fbbad176c79cc8670f9c2b4a0078b4fe
- SHA1 b63c75589d719f28bb59b6ecab806d9b57701da9
- SHA512 15833d8c2df3fd51fc387a19c0880361cf9ff664da8ba33b6ee764bf6220634a151aae729db3f1e5b05aa3bc7c56782754d060fc7cc1af7a938dfe042a98a340
- SSDEEP 96:d8cvbzNX3X1pR3SylUHu5riFl69BFmlETSX6MckQlb99c83OiEhNhfO5ZCCv2OGf:d8cFX3X1pR3SylUrgM4B9hUi+
- TLSH T1EAF1911CA6D70B450BD150B7554CF3BA49C9D18E203B8176FBCD92FD8FCB0982622B6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\pmd_pytcp-0.3.0.dist-info\WHEEL
- Size 91B
- SHA256 2b6eb4118ce7cd7b09601406aa623c553c4476265836f0d9c16f5c061f7efcc0
- MD5 d8484b2712d6275b37660ce7c74212ff
- SHA1 e28579fb4ecc8d36e494d12789590d234e656931
- SHA512 750688b867d714e8f1894966b2f117b453aef8e8a69eaaf904e40ce183d5a0d8a092cce7cc713b1ba5a66779edf87ecca86eb869122ba08b5018550069cefbc7
- TLSH T108B01215094014FC54A0EE134074A1201B6085455895707DF04A03446549D4406CDC5E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\pmd_pytcp-0.3.0.dist-info\licenses\LICENSE
- Size 31KB
- SHA256 af85d629f041f624f69ad1d22b6cc16a4c521b97e63df64d293eeba8fa2c0421
- MD5 90abddbf5efdd9ab79e95051f75b8e89
- SHA1 7ceac9fc9230dc92d7cfdfb4b3de31483156ab2c
- SHA512 3d5300b0ad85cd6a9c0ae9ee68953854d32b5c8c29251d07dced3d26332a171e06549b623f18058c2a59d228aac6329e67bc7d18aae95c6f8994f638a4676bae
- SSDEEP 384:FAvdfQM8xcy2qVTfofITuM2Vs6aHGUa1lufWkGVBmnLRfCiR1XAnLuaa9f/dQOaO:Fo1acy3LTB2VsrHG/OfvMmnBCtLmJ9T
- TLSH T1A4E2635FB74413B2028206A26A9B68DEE31DD039776640A5785DC15C27B3E3483BFBED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\pymobiledevice3\resources\webinspector\element_clear.js
- Size 1KB
- SHA256 1fb4afc2ba857ea623329f375206c0d68be02455723922f4b0334e1fc6fe17da
- MD5 8ce09fc7c86264d8995177edcf38a6c2
- SHA1 bd708c1fef805e092362b55591923e3fbfa030b7
- SHA512 176c89162fa17237748d20ac22c189260eb15c15ab86700c920c46f62f8a7b74ba49fabbae07f200df3e54299c46cd860c337ebf0449ff2a85114861bf81bf7c
- TLSH T1B821DFD6315A747E0BED829F5053828DFFFC46C44818E4B4E458E408A67DD8574B7CE5
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\python3.dll
- Size 68KB
- SHA256 fb975a606e7fbf74f64260e3f60c3490b4f74a183c0926fd6ed1ac4c52ac7b1c
- MD5 962428e9e68d43ecc16f3e33f2ea8667
- SHA1 6d0f349ab2e795b138a64346b784fc7fcdb6d87f
- SHA512 a925586bbc4cc9d2f58f5b6eeed82e429c23dd57d7b33609c0067fc14ed66ed165ac8121eeec1db3f993412f28ba527e961e3d6bcc201d4cda2037f85931ffc5
- SSDEEP 768:BV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/s:BDmF61JFn+/OulIWL0vytH/9ifITgj
- TLSH T125637042BB54F893DBFA66FC7AD199CE642B12CC572984ECA47593D30D1A310A2E334D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\python312.dll
- Size 6.6MB
- SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
- MD5 de50496cece613ec7ebedbf9f2aefecd
- SHA1 6cd49527f647f7ea96872b89bb4fde20afbada1b
- SHA512 a8d22a6f6140280ff36476cdc7cda4a3ebc46f0ac63b2a3c44fbd5f45aa3d343121e63b092b320d1dd8dbb7bc586a679bbcf738f485f36502a34592521aaf7a8
- SSDEEP 98304:2nZOqBIZAopgdKJUskfih6ZizvmHDMiEXAbBu:IoJedKJnkf8ivs
- TLSH T12C666B15729CC0A9C96795B8CC13C28EE7B27C117F51434B30ABB71E2F733A1966A789
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Africa\Asmera
- Size 191B
- SHA256 0783854f52c33ada6b6d2a5d867662f0ae8e15238d2fce7b9ada4f4d319eb466
- MD5 fe54394a3dcf951bad3c293980109dd2
- SHA1 4650b524081009959e8487ed97c07a331c13fd2d
- SHA512 fe4cf1dd66ae0739f1051be91d729efebde5459967bbe41adbdd3330d84d167a7f8db6d4974225cb75e3b2d207480dfb3862f2b1dda717f33b9c11d33dcac418
- TLSH T105C02B886B10D0B0F08148348EF30606DE51C3B8032200F37C0C281003740602A460E0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Africa\Bamako
- Size 130B
- SHA256 f3e7fcaa0e9840ff4169d3567d8fb5926644848f4963d7acf92320843c5d486e
- MD5 796a57137d718e4fa3db8ef611f18e61
- SHA1 23f0868c618aee82234605f5a0002356042e9349
- SHA512 64a8de7d9e2e612a6e9438f2de598b11fecc5252052d92278c96dd6019abe7465e11c995e009dfbc76362080217e9df9091114bdbd1431828842348390cb997b
- TLSH T15FC00289B7080942C45063B90D8723A8DF15C009D53153B338187208CCAA9D42E145C5
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Africa\Cairo
- Size 1KB
- SHA256 89cb9a36212fb82e933dcd9faa10efdfa969a29ec80c32063bbb4518c033d1be
- MD5 8dcab26c06fc82939d77511b0c7c24b2
- SHA1 aaf905b698b21ecdbddddc507a02d443875028b3
- SHA512 a30a9ed096dc2f9314c560d0b620cc04dff9fc7335336eb9854833c5da6a9fb450534f3ea9d1ec14ac264617fb0f233cdbb6c10af13b5d3fc1e7380ae4e00f12
- TLSH T1EC21022216BCB89FD11641B04557453DCE5B76523F9252C7C35B4B090A75F49F829C91
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Africa\Douala
- Size 180B
- SHA256 e5ef1288571cc56c5276ca966e1c8a675c6747726d758ecafe7effce6eca7be4
- MD5 89de77d185e9a76612bd5f9fb043a9c2
- SHA1 0c58600cb28c94c8642dedb01ac1c3ce84ee9acf
- SHA512 e2fb974fa770639d56edc5f267306be7ee9b00b9b214a06739c0dad0403903d8432e1c7b9d4322a8c9c31bd1faa8083e262f9d851c29562883ca3933e01d018c
- TLSH T14FC012C073B00497CA50773C0FA32AD3DE018914CAAA37EB2954158C09790D07AAB9E8
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Africa\Gaborone
- Size 131B
- SHA256 910c97c091cd34ae7427c83226234ce7b4f2f425c5822d6669c24be62010a792
- MD5 9c92339423e915befec45cc4752a75ce
- SHA1 d336e337b0cafc1205ba041fac447b8ae3074dbe
- SHA512 e5a3a1ab74a2620743964583ab960be126448ed013b57393eca6b397ac020de0be5763b6d40443b1976e0d3e6a533e8c46123fcb0428e5e233b076cf9ba69667
- TLSH T1D5C02200F30C882AC00003FA0BAF0300AC0BC200CB0022B328203008CCCA0802E003C0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Africa\Mbabane
- Size 190B
- SHA256 d19aebe2435c4e84bf7ae65533d23a9d440f98162e5b4d69c73f783e02299ec8
- MD5 a46a56e63a69fd5c5373a33203250d39
- SHA1 da4256239fbc544037f0d198cd407e6a202d1925
- SHA512 fc9c48be574219047f00bf2ba91e085076aec96db89f5e44741596b10b8766d4f80da3676d421a6a929b48a7eb85e4eafa4cc4673fc40d8f45aa96569c48e12b
- TLSH T1F7C0924C7E27AA27E9D576FE2A170B19AD4AC19580222DAB7CA63804147B984AE25181
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Africa\Tripoli
- Size 431B
- SHA256 cf33012d9661e15438fc045ee64e0bfebb2ea8a3fb79d2af56df05ea4be3e453
- MD5 a6b8c0b7319f5fdca0ed634760ff6e3b
- SHA1 eeece4b26584fc353eed209cfa5859ec5b738d6c
- SHA512 742eaffafcae962727594a0da2c4a4f1536c41859dcec20ecbfdfb973edaa6e79bba9298d653fd05fc57b7bc7e78c320968a2397c0a98866c43af48cbe37f00e
- TLSH T1EFE0261A82AC3C2FD440727C7A0F8535C444668553210097F73E072843F6313FD20880
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Anchorage
- Size 977B
- SHA256 77ca0c22962f06998bce5e48d81cb865a14466c83ff5dc607eaa483344058bf6
- MD5 77ea6e8a582f87d7a397a9e7b2111be0
- SHA1 28ce77f9ecb7ffc2706d9e5f4ec8ff29065c0a9e
- SHA512 36a1ec2f0337af24d66a8b9ddbe32cd8e332bbe4a736657d82d04623458ab1a93f8024e4f51af549dbe3664d73a5ab8b087c9e8e2a8e6214b6e5e213ab58c2f3
- TLSH T1B311F157191306D2C2E5277442F79C41BD324DA4DE4F6EE1ED5A36302178704EE1F784
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Argentina\Buenos_Aires
- Size 708B
- SHA256 20454ea527c8ea888926614d21bf556f46ce38c220c4ee5b821170eef9071469
- MD5 a4fc7ef39a80ff8875d1cb2708ebc49e
- SHA1 fae01425a95499abae520771d54109d75f221753
- SHA512 a59d5f5d3a7652b2db2dc3c54cb3a2e1f37103f03dcc39523d609361c4aaa0219c9fb0db93130588814f81ac1683c66987bf3500a7022a2faceeb694b7f2cd7c
- TLSH T1CD01464DFD63380BD9C95EFE4983E1B2A0FCA3297A529F258CE274A61438501A80C400
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Argentina\Jujuy
- Size 690B
- SHA256 ed8a6339c99568a2a98aadf5ad07bc4d30cd131747f638d922175c66ff928548
- MD5 239a70724a0ff39d5dd3e6b7f4a34212
- SHA1 3bf3bf976c08b901647b63d763529d1061ad6f1d
- SHA512 b42195b41c7a450207bdd48476618a732b01d2761dd9a97ae8401d9b166ac8e138ab62c6a72cbea09aec1528e096d9e6cda7f67405edecd79e8f796629451e44
- TLSH T1B6018B4EFDB7390BDAC85EBA0987D2A5A0ECA3267551DF669DF174E31034900E80D800
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Argentina\Mendoza
- Size 708B
- SHA256 74be2ad33818d8528f6c6f1c0be5a49e7a69f2d17663b496816482fc6fd6ce72
- MD5 839eacc63921f196e4ecfded7245a67b
- SHA1 80dc6f505e5841d9dd6f713dd422b2a6a3c9a0d2
- SHA512 77fd0f07cce5093c453f33d89e3c74822205b09a185cdc03dce30429eec348d1d18b89eda7c625f35db22983a911bee091fee38bc044147263ad0d55289e8a43
- TLSH T12101A68EFE23380BE9C86EBA5956D0A6A0EEA72534519F228CE231A21034800EC0D400
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Aruba
- Size 177B
- SHA256 abbe8628dd5487c889db816ce3a5077bbb47f6bafafeb9411d92d6ef2f70ce8d
- MD5 92d3b867243120ea811c24c038e5b053
- SHA1 ade39dfb24b20a67d3ac8cc7f59d364904934174
- SHA512 1eee8298dffa70049439884f269f90c0babcc8e94c5ccb595f12c8cfe3ad12d52b2d82a5853d0ff4a0e4d6069458cc1517b7535278b2fdef145e024e3531daad
- TLSH T15AC01205BB415584E2E177B503F703D7CE1C80048C00DEABF907369508B88503FB0C80
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Catamarca
- Size 708B
- SHA256 502d1fc71ed93e68cfc370f404afb9bdaa7e735701cdb811dbddcc76611f3b1d
- MD5 e3467a68822f3d1365e3494970219b03
- SHA1 3b37cd19a0ecda386ce185f888f4830d4767ac35
- SHA512 4ae79f4a57134ebae1776c259af4236fb75827e4feadf952eafcd33a15f1cae49a68855eb67b1a129dfb2cfe44ade4bba274051c972434517e179fd36e4b6534
- TLSH T12901E14DFDB33407D9CC4EFA4987D07290ECA33975519F659DE130931434500EC0C400
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Coral_Harbour
- Size 149B
- SHA256 a78d73067ba3cbd94f8a23dfdd6aa8b68cb33b18484bc17b4e20ea1aec2f0a81
- MD5 595e67b4c97fda031a90e5ef80813e7d
- SHA1 7194eb1a70c1acc1749c19617601595d910b9744
- SHA512 27925a87379552403a0960c2ec191994610bc05b2d67fb1fbbeeb6086a16091bdc69449bce3426b31a2775f3845ed8cc07d1882f8b3b4e63f437775a2eea5d76
- TLSH T1C3C01214B7480A16C55132BA2A410100CC044300A12202B36C4C231804585C26630182
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Detroit
- Size 899B
- SHA256 23817c32df67c77f0017a0feb2d798b2405afc71ceea3294d7e5b4c9116be740
- MD5 48c96bff46ef373ce5d759dc4a4d2de2
- SHA1 70d4a9e213bb53a0cd2ed2dd107fdeb0fdc199f2
- SHA512 1de4c446bd95e7cbbe535b54049aaa4f6d4ab8971ee23c1797ce1759ddd7e0e50af1feb88d1a6899a912cbd56153f6672f5da7617746ec0ecb1c6ed7146815be
- TLSH T1781144EF2A1D7D7FF601217A22114175C6B045814C3723C6C72EAB10303C398C965CDA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Godthab
- Size 965B
- SHA256 2e5199e58fee77d270591be77079d41d102b41b6e735c9a6af3dddb8c851dc77
- MD5 2d1f992b4b2db0d5b93386a2df8579fe
- SHA1 2e7b9ed4551cd8fa9e2874b46b4474b3c866afb1
- SHA512 3c431540e307b4388aec2870ffbf12298c49c19e0df00a9011afd50eae8af014f750accb3385e02e862c0c3a5f648e263514ff99c28346453c683dccc0297249
- TLSH T1E011945C68308BB1C40C78774AD9BC4F29518B0E0B4D8E5B118A7F095BA4BC11716090
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Halifax
- Size 1KB
- SHA256 90ee5a841336a132df592e0a5f5e456ca5dfa39c20f9ff6fc35fe130e2121a28
- MD5 ef31a488808a56cc6d3c9a3c5a53abeb
- SHA1 4df15b8ac91449f8d760be312f3b88fe07169542
- SHA512 d09629d1274e6f7153940151a837febde0f08eb17fe170c8a0e8422a86fb3905ad74d4379eecc6cbbc2fe4f17aff7cd7a2d807261cb21e3867d854cb5a92e3b4
- TLSH T1233153B5E90CE544EB0215748B93C51CE4EC57023B894EC1CFA7738701B5F9CDA298E0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Havana
- Size 1KB
- SHA256 9ace6b0aeab6c81338f55993ca632d15037773968137596477c8e3cca767366f
- MD5 14af0ba77d76b97e0e666c070c2172cf
- SHA1 cee0e5a7a733d3a1d792c7b62eb477beff914fb8
- SHA512 b59e2dadd7ab207e7f0a508ac4219b3c2b5801a1f3bfcced78f2b5d16e848cdcb7dd79f39984f053a367c55edcc4c23c5c660278d4a8a551f6fee4a3a1dc5e3c
- TLSH T1BE21EFB7EB6FB513C23020F49427DC43F6D7CEB837555A91CAAB83011431A61CE24856
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Indianapolis
- Size 531B
- SHA256 e678f42a13efbd7be0f26a9ce53e04b1c28a582eab05611cb01c16836432f07b
- MD5 9208172103191bf0d660e0023b358ea1
- SHA1 6f19863d563ade21b63df66afd12e0c67903a341
- SHA512 013be7c175dba66510fbd2972e0d4b76b7073a079aaed9e0a454753dc5e18fb1133b2947c48bd7e1cfa70820b397af6ff49b41434a4909906f87a8c91b853178
- TLSH T18BF02B84E73984C4EBF176F6050805E84F50F1C5DF2780C72C6E2A081A79FD507A66B2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Iqaluit
- Size 855B
- SHA256 9ce352ef392c1874eb6c4263ef72d84595bdeb83a7710ba3fd5e9f363a43a10d
- MD5 b8248a79b8e4c6de4f23c59e360d333e
- SHA1 96117e3c8e6541cea87f3a9731c2af53bc4b2021
- SHA512 456dbe8cc744c74cb61b009789baab73624b66745255e2353757bb15b6cbc14a4403fb8c659d4f869cea26bdcee27743986e9e8d394fd14997bd0c7c659bbf56
- TLSH T19C1123EEEE5F396FDA0031BB12129571C96481407C3562C6C73E6B00346D384CE69ECA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Jamaica
- Size 339B
- SHA256 a437b1700333aeff53a8b5868d5387c080dc14c2d3e95aa5ce36f901b3669284
- MD5 6ddb543268cbeb4a7fffad436081b019
- SHA1 124c3cc99c63be1fd377125d13eb49de2a00ab50
- SHA512 c128f47deb433221c04ab5caf2daf71e3e791a2f4bc324fe9156a6ceae3347d88b5b00697dbfb3fd923550c739e90cc9e33481707d42b413b5fa6d8563eca55b
- TLSH T172E02E08F2AB323FCE223ABA038A0278C81680007D2885E3BB1A134118D8400DC28849
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Kentucky\Louisville
- Size 1KB
- SHA256 cd2d924b9ef70fd4e6419156b52c9121537765754dff61695416eda9014ccca5
- MD5 9d9fdcb5bec6ef7173f20c0b968ae540
- SHA1 7ad6d7a6ee8a68b6830490748811a3eb4890fadb
- SHA512 4be8df0766c8cc72818ad185af7ede88779b86a7846b0c38f2949b9ab7cad364f5a26cdc11c56bce2507b7f46a8e68249d95b2c9ee748f68d4ea93c33425bef2
- TLSH T15921322E121834DFE61061F9113544B8CA70E1C44F3F5EC7DE2D6B04153CB88CA21E96
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Manaus
- Size 412B
- SHA256 f6482b869af207de18395a2c8499628a20d27fd9b08dbdce6705f41eeb0d46b9
- MD5 bbb3263234960c35b55fffa1327cc48c
- SHA1 0a67dcc2d4632f74552a2ee7fa8bd8bd574251a2
- SHA512 9f1bdc984534540df6508072a530d34e6443180608f549ee96149830e657f86fc78fcc15ab4c194f598c614e4ae466a101ed45e811c9a697354686d65a26e6ed
- TLSH T1D1E07DC979452141C40C08366734E159BDEB82B0B300FF537E4122D880313006A2597C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Mazatlan
- Size 690B
- SHA256 20dede710f520eaf6c0cdbeefe773fc6e30dd8b1d28aaf17e9842099551ee9a6
- MD5 9e5a72ab87891aaa1f6fa40acb8becee
- SHA1 c82a0b803e3cd9df94876248495b4640a6227ce5
- SHA512 2964f5193b84b886da341f008732ae22541ad543403e2a605369b32304545e9ded54ed22f76a8021ee3963e738fd2b29e5a8c1d433327be92701abe46329e5fb
- TLSH T167010E98E1A32950EA7C2E365563A3C03C12471AEA0F94F368C0A1347CFBFB27910284
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Mexico_City
- Size 773B
- SHA256 37dd2bf08f13fce0f707c3b1f4cec4018efbd9c47c8367b0fb4debbd461bd72f
- MD5 cf1d8646034dc47b761583fe0f6bee1d
- SHA1 8c68d052a55ca10e75011a8ade7183dd365a4ccb
- SHA512 18ad81484c38cde8ccf6fc983ae0407b782546fcf21b697070f5b9eb5dafd8a8df72f365507e53feefa733c6ef34b07dd3b7cf5697bb9101ca121229a745bbe4
- TLSH T1DA014750285C745FEB903AF7065356F82C24D0053F1341E3DE8A231418B9F157310C57
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Nipigon
- Size 1KB
- SHA256 815ab4db7a1b1292867d2f924b718e1bba32455ce9f92205db2feb65029c6761
- MD5 3fa8a9428d799763fa7ea205c02deb93
- SHA1 222b74b3605024b3d9ed133a3a7419986adcc977
- SHA512 107a4dbb64107f781e3ed17b505baea28d4ca6683c2b49d146dda41c28ca3f9c307809ed938e4152011e199a7be6913de6f7b78cafe8ef300dc3034397945238
- TLSH T1143183969418B8DFDF0145B90560C03CCB6431C30B2B91C6C74D67402578F5D89A5DF6
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Noronha
- Size 484B
- SHA256 434af71ad039cb644690e8f9e8e4d91b9b6e072d41ea47db872ac9a8281fdbb8
- MD5 6c4f6742a67bbd289f89eb4fe7de8e57
- SHA1 445fc9a74acf7002bff1f23d3ea9769eb78df0ca
- SHA512 d1854c7030c1ad91fca7c7c8dabf3e4f37c2de4a2710c3bc1972da776722d0e8fd916703eb0089e1d687da2d7291f2ad5f9659ea163b454d0ab68d2a63f216fe
- TLSH T19AF0C044828A5681C4DD023A7F638B04D7A841A4CB1DF0F6F92C87C444F4F072D0D0C8
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Regina
- Size 638B
- SHA256 fc91ee9ecdb6e6213e4c773d345a7e441ab83d650b02e1b0d8e2dba4e07f50cc
- MD5 c87b8b428cfdf54309e9503177e0ca5f
- SHA1 44ee98818578c443bd7c02e8e0cf8adfa4508704
- SHA512 a3149ab7fda9cbee2df6c4ad39d77e722bf1c10b267e1e016db05cf979a016c7d788b4d2e5347a670f0626ee98dc56926b83b380b16205ae4cf6db3e56b0beef
- TLSH T146F09E419B5056FADF22713C45714ACD8B01F1C14F2664FFAD7B19ADF0F0B9C1550511
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Rosario
- Size 708B
- SHA256 f488f75a34fd99630a438dcb792508a90b836fdcd2dc54a51d83d535025315fd
- MD5 5c57dc3d11f5a64fac22a08ea0c64d25
- SHA1 53f6da348a256b7f84be5e9088a851331b82db9d
- SHA512 18f23ddb3dca6fa3efe9cbea294bdfc6ad9db3bea98fc1766e0f317754d8a452e12edd692b1505810ec7842d0f8dbdcf1f50a4027dbc2621cde865311ff5b259
- TLSH T1F3018B4EFEB3380BD9C95EFE4983D176A0ECA33976519F65EDE174A31838501E80C801
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Santiago
- Size 1KB
- SHA256 fd006953c2b442a2e1e66db2a967dd932a4824390f01cddd9c801ce63450c715
- MD5 c3b66836f89ba29559e1b438d7454e0b
- SHA1 df202e385ed60db5440a1342518f0ac821f8f9c1
- SHA512 f0fb70197e3c380c7171ee7e952ace677621edf9109bab74153fe664c4b3937bf647a5221a776810ce1c323cc2c6d1744edd107b325a02037a554c75dd0e35f6
- TLSH T116217253B453A431CC0D3DBB49E6586175FB5D7C3643CA989CAA5F3B2831860EC22023
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Sao_Paulo
- Size 952B
- SHA256 fa2ceb222f065c0289f3997ff0c54ba05a74a599b4522870fa86a96e24e18891
- MD5 94e0437e48ebbef69b3fb7fe2af5e0f2
- SHA1 530a7e928f645917c3f6e69c74edfbc6c8e371db
- SHA512 2a146e8f2ee485e1895f57a51e9e8b67aa371d03fbd4fd53757fa662e7a19a8e8563f7f6ca97de17fa3a34c7abe894f36cc656c55795f14a4f032b5ac56a410a
- TLSH T17C11444C626189D1DCC54BBD3DFBE1043BBBC42EC341C9D0E85C96F46870741042C0D5
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\St_Johns
- Size 1KB
- SHA256 bfdf6afc014c3e597930cc4ca7df1aa98e347268acdb07224df4eab36fe46f49
- MD5 b5fb2c880a7c41fe2fa96a4792d83269
- SHA1 78d17d5b6c6930197ea638f689e353cdb329f26f
- SHA512 872bdb1137ce98fefb81001102d9fb22d6cc7fd9f89ac95ecc100de26cccbe19fbb2ccf5e55339069ae4007e06ffdfd44e7ebbb88b438107151dda517b4edef9
- TLSH T1574153B792A70811E443A5344688E1FBD4D288916B7A818E38AA634566F0E633FA24CC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Tijuana
- Size 1KB
- SHA256 af9aea4aee505143fa5e847643c0ffe164190c38411010ac7f0b170f4098a6c8
- MD5 6c06020a12ab12660084ac48ae52bf03
- SHA1 ca115af4844f677fdc7ef4fc96f7d3c616826030
- SHA512 fce8525090704d839dabdfc5f1e3cba622dbf9668756acf327d0f9042ee59976ef5aef5f1635ef0f8bbbec44882a72d7a68294c286d69b11c89dca912a024d56
- TLSH T10521D50AD0033493C4CE637B7E3B00A21E648180FE1E937E603E87842BF77200E1C2AA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Vancouver
- Size 1KB
- SHA256 7d23681b36849ac7f50537b9c02bd8d3aa000b98bd3d1825ce85e7ea3e5534c9
- MD5 f93f2305d26b5a687facefb2b17f905b
- SHA1 399eb16d8b3cd1dca46346efd6b9a02b1dfcd463
- SHA512 0b06674ae1173d39666f1ce3817b3d3ccaac7b8b86c19a147437e98562e0a1d5615b9fda068fc847e2dd26a87167a2e1b500381077c4705f4f1ed1b5d3c09ec4
- TLSH T14331B41A92515A0AC4DEA3727A73202A48980284DF2E927CE47E5FD427FE3204D9C3D6
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Whitehorse
- Size 1KB
- SHA256 0b26388cd7747f335275fd4795819f6a4b40a661fbd6d44d465a4e10edf60c6b
- MD5 5fa937049e86ffbf52d4348c6c43b0ad
- SHA1 b9bad43996197e8a2559bb9e4f01cb69caa03af5
- SHA512 603fbc2afea3c985228769c11f58a4a211145aa07c7557fc26757426893252b342118cffb9019dcce1b6838fefaf36afdd8b8ca9af4989682355af1687aac256
- TLSH T1CC1146D6B2555D53C8DEB33F517F2813858895C4EF0ED564E87C4909D5763D09A1C2C8
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Ashgabat
- Size 375B
- SHA256 3932c7750f2314f0efc6efc8c0a5ff7375b78dd37a7bb146a0248411bd172aec
- MD5 c68faf20645ecd953e8eb2fb70469f59
- SHA1 fa8b3fcbd2691455cf8a180ee1696ffa3a34c37e
- SHA512 c1876c6a5af20e970b2144e17eed57cde0805d187d3479b95138a3c3f86a62a2a517996103b33c7edc5c1bb24aee0e034e8bc3f9c1162f75fb1492d80df5cc7d
- TLSH T178E02B51F4A73243E224777D4F5BA90B6DF69018330252B77617B379D03C41558AD090
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Bahrain
- Size 152B
- SHA256 6160d6575a371c75b19e6c25cf03160b9dc2f386583e42bf8189fdf8fd17c785
- MD5 ec12549279e64ebeb926579888cf89d9
- SHA1 528a10a16627bf876cce29e1a0fd3022ca47751a
- SHA512 d337bff4ac36e395e1ebeb10ded20e52f021508df4896e6494316e59147b284e6d8c819c6dc036b6c0a0c677e72d222f4226810963752dd2f5b65cf79db6595d
- TLSH T1FBC0120731080901C8800336475665857D1F406A82030997B804154614C56C12A200C0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Brunei
- Size 320B
- SHA256 dda8e0208df167e59cf9da9745348cc3ca904434a35e5481231c84fec0d11939
- MD5 bf388a0a1da2be989c25dbfb587076d8
- SHA1 0b72cbe2ad6610d3fa67f4b5f1668f1116931210
- SHA512 4fe6fd2841d6ae5affc8e5658a3339c32391bc57782ee7d405350dc051c9b61a4f4fd8ea10023c53877a359161834c682e28c9481115ab7ee44c1ed8ed8a7cdc
- TLSH T180E0A745F74F7423D4CBB674C51761D16D40DACA7C83516F9D90E28C68BA108A5D39C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Calcutta
- Size 220B
- SHA256 3a00bdbe1bc4959e727567c730ba51b03455ecd455f7c190c5ad14386eb79b0d
- MD5 16a0b637c31e7e480cfccfc46dd75d67
- SHA1 d921f7a3301e8312e5fe21bfdba2bb84a63dd7e2
- SHA512 93e3e32b61555b8f1986af380975058b4c90ff47ef7907f9f12815d46a515492919f899c907298859100dd94884ee162bda94de8cbc590c36080ded2354a1269
- TLSH T104D02B01BE390584FC9071358C622421CE34F19EBB3111EF149D74100CBACE45FC82D8
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Dacca
- Size 231B
- SHA256 ac21a61306d6e2a91453641f4e3e732ebc9d542abc1d35a5d5db2a10340ebefa
- MD5 940f5a339a1f12a7153474fc3c92c624
- SHA1 2f06a713f4c229de75d4eefc3e46bd5450ef6ba4
- SHA512 34f0a94199b54cf418d170c1484a824afe956cbda4dc0c1c7e4eca10045d5f74ee1002ca5ed351c28539b7ec0e45ed637424b674f6506ddbc93a38b5a009942f
- TLSH T192D08C1437B90948D44922791A276287CD35A28C982103D73A08A2A808F8080EFCA2CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Harbin
- Size 393B
- SHA256 bf8b7ed82fe6e63e6d98f8cea934eeac901cd16aba85eb5755ce3f8b4289ea8a
- MD5 dff9cd919f10d25842d1381cdff9f7f7
- SHA1 2aa2d896e8dde7bc74cb502cd8bff5a2a19b511f
- SHA512 c6f4ef7e4961d9f5ae353a5a54d5263fea784255884f7c18728e05806d7c80247a2af5d9999d805f40b0cc86a580a3e2e81135fdd49d62876a15e1ab50e148b7
- TLSH T1EBE0C20C52681DCAD3ADF3FA265589A68B01E1838F52159B1446AA0DA57FB9618180F0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Ho_Chi_Minh
- Size 232B
- SHA256 0d6e76fb941d0540214ee81f161f449c6a7dc3d515e5654618a7ae42d0acd1e1
- MD5 4ced82af58a7a471a25153d55d66e402
- SHA1 354c0fb17caa7324d2ef1cc5916a3ea8043c0c94
- SHA512 93dcba1c4a2db1a51d5583052bf1d916cc69f5cc00bbc0307cd71a484245e857af74f3dc83020953abf3d9d2547382fdabc8427efb7bdbcb395c5603f220adfd
- TLSH T115D08C02E90A2C63E04803BC8A2B65C08F28F4D6502B26B734A822CC09F6194A869AA0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Hong_Kong
- Size 775B
- SHA256 f4068f73246db97417f73467453564c57d6646ce4909b9fa2536923efcd7eb4f
- MD5 f729c88451bacd2895fc1c8d29064c46
- SHA1 c52bb303bd8eedd239bd1f3de4ca7ff388f43280
- SHA512 74878b0625e7e882ad9a4590791d66c680b96e802799a7665759c60cd784f0949c7f63babb0b646b6215a6b5bb10196c0f71c2ac56d746da6947db17b01b78c9
- TLSH T13101ACE2ABDA4F80CDAC4373FEF25262E968C4E19706E64B254559B1627730077C0094
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Kashgar
- Size 133B
- SHA256 849cafd377611cc2fc2b41891ab63c6fb3343949045db961fd16267593315ad4
- MD5 67c981ccf51584922a1f72dd2d529730
- SHA1 60ef0baeb39358fee28d01525962e05a7f71e217
- SHA512 0e563b55141e0f63d762dff0b8fe428897e9a98233dc2af04df09c79c702623b6567178de0b65a2ba35381971bbc14e4721dd0aada6ab52190efa8a436e7b480
- TLSH T19EC002C07B0C0B46D49003794A476B8DAD15D155A92246F7784C314C9D9C541BA595CC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Kathmandu
- Size 161B
- SHA256 76b8f1bfe072231a1d9e7f8501310e27c0d08048c48f7422860b6477c142c438
- MD5 90518d05c449fad639594f7f575407d6
- SHA1 2d772fa28e185a08babfe9fea67f00346b6b0b03
- SHA512 4c1ea234fa0466d1584d5e5a4377ca6e4085598d68d7f3c4c8d36c84df095bc5cd38d3a18fa2f537feee628c8e23c6dc6174ce5b0cec2c63d214f615ea5e6af0
- TLSH T147C0121032810954E400433D0A7B3A849E31D60AC64102673F0430050B74046DF25CE5
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Kuwait
- Size 133B
- SHA256 46853e94276af2eea8e86c2f152a871c092df195dc51273b8fc7091faa4b461c
- MD5 165baa2c51758e236a98a6a1c4cf09a0
- SHA1 dbf6914834465a72dc63d15272d309a4331cd1c3
- SHA512 82f71fe26f83940b802676221f6efc6cfd66aa0cf0c3befdab9b60d7a8e951e504c547f90876890e7ecb18c7f89a41152d276f32f7e5ac6abead24b6fd47f3e5
- TLSH T16EC0028A770E4946ED9207790B572B82FD15C13AC5028AF77A59348C9CDC6E07A950E0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Macao
- Size 791B
- SHA256 9abf3d8bfc293285a102da99ac5d9219ca082dc530eab62b0e42143400deb3b1
- MD5 d3dfd69107a4d78facbc67c4d8cea004
- SHA1 5f6b72f90af4e6475bdc57467498795c8084f340
- SHA512 adc4da2dc4f44e3e6892bfc0f9bdc8a4e9d6de9a182d9bad28aa67bb978bcfe70bcbd3adaf0f6fa6ee116554e1a7f7f3db3447086179e1276b78e4a348b216f7
- TLSH T14801DD838AE61FC9DD3886B3ABA2C155DB54B0A08403D19B018157D0267AB0037F0073
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Makassar
- Size 190B
- SHA256 355f63fd14ee894e3b9af26f7ca13c75a5c7e4015827c2a2e20bc70494b1c8b7
- MD5 c8c41a468e356c6bb65e89c69e4406dc
- SHA1 302262c6ab0abd593d4b654b2038de7b4868fd73
- SHA512 f48e242f97f3c430d09452b960e4616da39654c436dee90562b0f669516dc194227d661d0d5e85df7150b5fb9b8806273158cfe6349c48fec0ad7261c0c21154
- TLSH T1DCC09288FA4A0856C1A5163DDCF39227AC59C1EF9402C9BB2C8024C648FC40A26012C0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Nicosia
- Size 597B
- SHA256 4d862a5a9f2c2b40300541c0a74c2eba2859b90d7d45776ddbc6ed877df33812
- MD5 0ec72f7b73a20e311e127abd87a9ec26
- SHA1 a1ae5718ffc912b1d4e5e48a5cc99633bb15bb2e
- SHA512 ae4a74320707629614b9c8c71bf3a134820745cf4a875af8a9737ab9bed2a8bdda286045b45a2a5cc47d4ef32dc1504d447c40b376d28a6c707e50d1c26b759f
- TLSH T14AF05CB735995AE8E452693D750C210DD4644511370073D7EB4B171E817675ED948095
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Seoul
- Size 415B
- SHA256 64a70b6fbcc9b65e762dbd25eb89b6f40c137146edc8dbd4d081eafacdab78de
- MD5 da5aae5f9a71de05b4625f74b007c461
- SHA1 95f3e46c1a2123cf8ac8cfee9769b4614f631051
- SHA512 db649a8855895d9aa0553d6bcf9bcfe53907f50f22a121c5a91101a9537b5e571d433ea112dd566639adbf4ab7a3c9b9b7e0a6bb31f2c9cbf5c7d0801e30dfea
- TLSH T170E02609AB3209C4D5E52179830309C84982A0C35426EBAEBA435799AEF7F591A301E2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Taipei
- Size 511B
- SHA256 a04c2c72f4f76a83178d036dd97d157ee1f32e478e44dda7a5c10923687ee6cf
- MD5 eda5a4ce01efed633c50e04d09fe73b2
- SHA1 efbb31eb355ae5f83185fa884258f217813ea6b8
- SHA512 7fabd3e6eeeebcd981bf51d47cfd7641dda6bfdc0f4897b93d9bcd657b7ba93d6a547f98f8a43fcdcba6e9d71b27fca5436cce5bb0a1f08562eb7e4e38f037c5
- TLSH T1BDF02B19540BD9CDD2646EB3019551D18F24F1E15D631173A9426A0C59BBF63AA248B0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Tehran
- Size 812B
- SHA256 65ac5ec01f3721d608195a49bdca7c7accb3de27df020c44cec8fb70cada4377
- MD5 de3b36fc112021df58c148343dcc0991
- SHA1 62852dededa619d2c907bc14972d255e4d068565
- SHA512 e90064f7e60f8b67f6e49cfbdbd940e77549d67aeb4c0f6a3de4b5753deb6bce984e6b2ed3247f53da23282d3fb05a099ec1d8e23ba4035c151b32f53e69fcfe
- TLSH T13701DD87F02B385FD51AA37690E20B40F2B3AC70FE5154E6355A223824B9A108F105AA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Thimbu
- Size 154B
- SHA256 37a77fbdf16f60e45f327af57c7263612b780c139149b2e2ff64feaf67490672
- MD5 b4aa5f2b966a76ebc38d1aab44d86bce
- SHA1 9d4416c3b3ac45cf91b079ae1663c03b4355720c
- SHA512 ab896e52092c7d014f09d5e5bd8bd1ad8259918a3df190d39f1bc63ffd55db92fba1ee33cf457bfbcc96c6d9ae3a387c5a198f069ff77c1a3d1d3ef45cc4490e
- TLSH T1C9C0125072684941C8D0033548D6368F5D20431AD102029F7D04108838DC112EBA84CE
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Tokyo
- Size 213B
- SHA256 59a3871430f0d3b93e619fa30a43a41d1e88bdd49ff26f09d0f405a500706f96
- MD5 618a4a8f78720e26749b9c29ed4fd1b3
- SHA1 c33c6cbfded556420003eb37cc8898e3556487b5
- SHA512 bbcd5cda61f848abc7e8be82f766f3cfc4140835ed59abb86802b195e70d25f312e717b9188cd6b1c0c075211aac2dde840fc7ea8900ff77175cc2eeeb88b9e7
- TLSH T18BD02B4865741CE0CD17293D13014D044F107800C70333573A0A1B4DE4BF7401F200BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Ulan_Bator
- Size 594B
- SHA256 fbe23c3fafdee01b5121edf009290fb701cebbf93dacfb30f8aa90287242f6f3
- MD5 66a0ec5d00519d1826d055514861779d
- SHA1 a64af00e5941a77ddba4deaf4e68943beaabea61
- SHA512 2e02a6e7e1cb5ff51c8edf86ab6e901e10ddb95817469678a296f484eb8b7edc52235c1f2d6775778c2bb29a53874c90376517c1e3d5af3875b5a05a5da74e12
- TLSH T160F0DC40D20BB86FD2802E7405272AB24D354901F12E63BAE2101AC5B878700BF9DCC2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Vientiane
- Size 152B
- SHA256 cdc8e2c282d8bc9a5e9c3caf2fc45ff4e9e5cd18f5dec8cb873340ad7c584d64
- MD5 ff94f36118acae9ef3e19438688e266b
- SHA1 b68e4823cff72b73c1c6d9111be41e688487ec8a
- SHA512 e2ded089e3f51c57e2c32333dbca528551440ca76cdbcbaab9d627f8ee0824f1b3cae20f26352dc7edd6887e74fc78357ab52044fbfadf2192129052f82cbee6
- TLSH T1DFC01204B6240D45C45602B80C2A1500CCAC811D470F16F32408204C14B84419F521C1
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Atlantic\Faeroe
- Size 441B
- SHA256 230d2a074981baf887e70dd0cbc8dac4239eb34ed91e1db0916f0c3d4589aa3d
- MD5 253d5505eaf3a497f4fa107633bea235
- SHA1 3b1d6dd93a3db18650406df6b67c357062546634
- SHA512 063f431e16fc6319ad261a98b770871f3d3d40082763dd8e478b2ecc769f01f965cc0e329aadad8931c9cfcaabd065d9793ce22a93b1a74d5bac3e230a42906b
- TLSH T14EF07269B022CFC1C00C25BD0B26AA420C81868ECF4C0383374CE90FA63C7803F090D0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Australia\Adelaide
- Size 921B
- SHA256 1a4d52746455981db7dc8f961135c0302673ecbec7573a0de1a52821c80daf78
- MD5 02d7a06f7ede604bdd6bf40932b670c6
- SHA1 485f98599707fb459c0afc4ac0980e2624c0f6d1
- SHA512 af2fecfd56e34b3c73dfb63f4abb16759e307ae57fdd4b1d2a4949ff1556ac0b49e1ae3c1758c8fc5adfe94a6b52105981046d6d4fc05e805e25e574f296406a
- TLSH T1B111838EE40376D3E9E10EB7922F88609E58934C31821927B102EA4CC336480B901AA0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Australia\Brisbane
- Size 289B
- SHA256 da4556cfd088feab5f75be7983488be7d814042ee59cedc651a948431b470036
- MD5 d5464310b37a30d92f5b85d128dd4937
- SHA1 76ff8daa890e779845c9f6c42143b441f84f93a8
- SHA512 418861fab4dcf776a4c8f358a5a52bba056c19c09d05148bec82bbbf9f479d1b1ece7481061726cca3c62e0151e500ea1b13892c3b63fed9b9d6c9b73d2a1408
- TLSH T105D0221060455DB0C99196FA6D270A633CC8C4CA1F9403ABB02EB30CB4B931A3E318B8
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Australia\Broken_Hill
- Size 941B
- SHA256 77393d2ef180ff1452b670088c016e4c9f14c33feceea1961909a25cf803b0b6
- MD5 35eebba76b28756b47e8fff3157eafdb
- SHA1 3ecafe049f5e038c42c7153f00715d61613e830b
- SHA512 ebb1b0c134ef158ef3f170a8fe96eea4ca34e2e31715e1f69484d3906ae2500dc60d446ccece408da7adc6607a5140bd3ac034eff398ef00495a056adb546fbf
- TLSH T127111B9AD8030AE0E8E24DB6962F85D48D98534D31B2102EB205F70CD732C80BA18AE1
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Australia\Darwin
- Size 234B
- SHA256 6687b16e181d52557895e57e76106ee80c43564272e37c6b3dbf5443711009d2
- MD5 09e36f9135b9ddb666cbb9496fecdf89
- SHA1 276a4428eb072774c96e882af29a949ef28c8847
- SHA512 5be4040d5a78f4d0a6dc97d58cc78e02e6779562d8329ce6fe61addcaed7dc0f32e6dcb1744aefbe2d715637eee91b22f6a8a869ac3f4d80366b2d24bb77522e
- TLSH T114D08C88F9372ECAD272AEB156BB03508FC8A44C70410AAFAD212199C6BC0102E088F0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Australia\LHI
- Size 692B
- SHA256 f368bd25659c0293d02bb79ec7dac7d5b73a92dffafce14b4dd2ffb8ba11aada
- MD5 e68c0f2ebe9dc247712393ab1bd168d2
- SHA1 c318c332b71519e0e27a105b739a6a453a1fc875
- SHA512 1e7231d70e1ae6caddf80cb48c9bd90c2fe75b3a6c8b4a6f764bbc969c238c8c9832b3b8366333e137819c51315a8db71434fcf0d1baac81d4ddac8a0d872353
- TLSH T1DB01EB43C113349FE1520ABDC72A07F0CE8841193AB246DEC618B302AD4AF801D65CE0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Australia\Melbourne
- Size 904B
- SHA256 5fb24f3048ff4985b27e0585324a7a14e993e867f28d1fa517d8451a04dabe71
- MD5 e308055a9c06f33a854a9d579ed61249
- SHA1 21ca2e394d40acc93724025a0f5e81ab3e3ae23a
- SHA512 b9fec4b59e24ae621497750871ac5a8fd9077a3a1a265fdc2b63399a7b8016927062d1f7781f8bed711f9a1e73f4e50c17f021699d189ecaa7a5b7fe96dcfa1f
- TLSH T170118304C142A5A0E2822DFDFE2B8C0CACDEC5C01B652E4722C6B32489703467E83869
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Australia\NSW
- Size 904B
- SHA256 820d45a868a88f81c731d5b2c758b4ed000039b6260a80433f8e0f094a604b59
- MD5 a1085ba102822f56191705c405f2a8ad
- SHA1 ccb304b084e1121dd8370c3c49e4d9bea8382eb6
- SHA512 3d2fa63913f22aedbffad9f94697a19aefe0920c1b9e4be47144022706fb309e46b38d85322f9ff4d8fc2472ca43fe3c5aec6486f94a89fb728a05753c075239
- TLSH T1701188508152A560E2413DFDB5274D0CACCD84C51B591E533286B31485703463D93464
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Australia\Perth
- Size 306B
- SHA256 66cb9e95c042d587d6ba01f60ab94e5d07120c3e20194242a1b0755be6aea47a
- MD5 543113396c7e34a7532457a1ce759c4e
- SHA1 7758b71f6ff9d11c43b593fd87b4575303008a10
- SHA512 12f924baa6302dbe14b742535a1ef507368c08077d66350b649260310def3566020c57eec3d59056a1372083666a2c7067f8fec74a1512aba2b9b32b26afd7cc
- TLSH T1F3E0A70862C245A2C6D24377591FC27004419108D7060FABA15CBB080BB5BC12D1D1B1
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Australia\Tasmania
- Size 1003B
- SHA256 d4801581fd00037b013d71616b119fbbd510fdca5de06369b10f718a8da5e32d
- MD5 8371d9f10ef8a679be6eadedc6641d73
- SHA1 541dd89e23dc4e37e77fe3991b452915e465c00f
- SHA512 0c08054c08a4aa20efd8ef18af57fbd914fa99b5ce1aa837e8c491274b09ef934a831e4a36c4b64332d2d47f5e3083f30d4e505560c5a3188c02a4cebbf820e9
- TLSH T132119984965394D6DA412D72A84B1D1C3D5DC5C42F610B1F3365336C50F4346FE434BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Brazil\Acre
- Size 418B
- SHA256 563b9052bebaf2986ae5b707e34afde013e7641287cc97ff31005f33a0dbf7a5
- MD5 0b427173cd7de48179954c1706df9f0f
- SHA1 6f3bb01406ad71ca9718e7bc536fca9251754938
- SHA512 2be3257bef4949ce42d143d3f0e095ea26347ac22fd436d98445af8590186f74a165777e9f423b8bdac416758e42a636fc6bdb86a097256100d61c2828b522d9
- TLSH T1DEE07DDC3D0DA600E44C2C351B66D16055E5AB14F3D5DF827C8E42C81479701545230F
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Canada\Central
- Size 1KB
- SHA256 00dcf0606054d4f927416e0b47e1fdda2e5ce036fde4b53e51084f8566428c3a
- MD5 1ee6e72e10673d4a16b6e24671f793ec
- SHA1 439bd8f20d919a71ac25cec391caa8084f3b7cc3
- SHA512 dbcc75cd333e3565c5bda2329f69ff83816b1383456a5f4f11b960fe90436798182565119a48dfe590a7eed5a82e436fe39a1d5d2d71a4c12bdced265d89d7b0
- TLSH T1072194A8966880D4E310D9F207A38AD80F68F0C55F2E4483107B552C1DB8B933790875
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Canada\Mountain
- Size 1KB
- SHA256 d52173b56a28205d8d6f792bcfa8bc07614ee0d269f7bf6e43ec91f68d410600
- MD5 832f4f2fa5d0b434873da01b78b20085
- SHA1 d8cb91bfcbff2e26deb035c06a5335f4f71437a2
- SHA512 b966758ea6bb5e0404966813f51f7744c61ec3bbf887bb5ae7ad89197218b93451a1bc82ba71114a84b16a4c92aee8ac7de191a480a6063ea9946d68b8d96645
- TLSH T1EA2154DD56D1A639D65C703442B3F9A01C6844585F4F4CBF547B3834ADFCB06726059A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Chile\EasterIsland
- Size 1KB
- SHA256 13054cef85e3b1ba0f5712bd6d699d7789d3aedbdab0fd7394b771acc07f61a1
- MD5 57aca34c4b3ca88d9c94b88990c62c79
- SHA1 675741018ad5d7be0ac0e2a4776dcc2addaf49d3
- SHA512 fea3f80903459876a77bd4f20f92bb4da43cdc51c94516c802153b0a797c58eee44022764ae37e23ffc5761a924ebe05079b2126e835dca29c40c9c60a14f835
- TLSH T127216FA7F2B3B873C85A68F406D10DA035B74D787612C81C8C2AA739093A816DC12067
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\EET
- Size 682B
- SHA256 f1fd678b0548e329b38934f6281255e698dfa761ad1ff841f6ccb79606c61345
- MD5 9006b968810f68ce90473c809b252776
- SHA1 ee454b7014fb0133b1ba142e3e01f5ef71d32cc6
- SHA512 4f9f4c9a8616961baea5612a5a9db593df84dd788449498d4c93e1be51ee80438dedb6423b40abd2d47d0a1fd92fbadad74f352b98e285a451ca3b5e8ed2f4ed
- TLSH T1BB010565F407FF4BD02D35752B0A54674814168EF46C12A26555DD1F523C6785E050D0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Eire
- Size 1KB
- SHA256 11c00336e02f1318fe764ab29467c5f2afefbfffa644fa8dd24f5b083b495b71
- MD5 1917c051a13995cc4c32d2ce05bc3e7b
- SHA1 10df4e1a6453cca5d4f63503b3f5fec745829a12
- SHA512 176e5a670f370b56157d333e9c98bf70c6d8abb1b49db80ce67efd12822e6487ded65169057e439a4a3477d09cf30e0336fdf6a5966ef1e8649ad714846a2b36
- TLSH T1BB3133D746828706D4FC26F63A936341694489D8E17D8150FDDCC7E4DA757C82E1ECD0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Etc\GMT-0
- Size 111B
- SHA256 dc4a07571b10884e4f4f3450c9d1a1cbf4c03ef53d06ed2e4ea152d9eba5d5d7
- MD5 e7577ad74319a942781e7153a97d7690
- SHA1 91d9c2bf1cbb44214a808e923469d2153b3f9a3f
- SHA512 b4bc0ddba238fcab00c99987ea7bd5d5fa15967eceba6a2455ecd1d81679b4c76182b5a9e10c004b55dc98abc68ce0912d4f42547b24a22b0f5f0f90117e2b55
- MD5 SHA1 SHA512
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Etc\Universal
- Size 111B
- SHA256 fddce1e648a1732ac29afd9a16151b2973cdf082e7ec0c690f7e42be6b598b93
- MD5 51d8a0e68892ebf0854a1b4250ffb26b
- SHA1 b3ea2db080cd92273d70a8795d1f6378ac1d2b74
- SHA512 4d0def0cd33012754835b27078d64141503c8762e7fb0f74ac669b8e2768deeba14900feef6174f65b1c3dd2ea0ce9a73bba499275c1c75bcae91cd266262b78
- MD5 SHA1 SHA512
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Berlin
- Size 705B
- SHA256 a7fd9932d785d4d690900b834c3563c1810c1cf2e01711bcc0926af6c0767cb7
- MD5 2577d6d2ba90616ca47c8ee8d9fbca20
- SHA1 e8f7079796d21c70589f90d7682f730ed236afd4
- SHA512 f228ca1ef2756f955566513d7480d779b10b74a8780f2c3f1768730a1a9ae54c5ac44890d0690b59df70c4194a414f276f59bb29389f6fa29719cb06cb946ceb
- TLSH T15E0120325142CA46D19C20F5077468D30F45168D4B9C02FF5739D12B77F03901D420D0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Bratislava
- Size 723B
- SHA256 a6e930e3375cdcb51f7d8a74885aff89fd14b861ebb75cb339d0f91c16c1469a
- MD5 9ac4de9fb3bcae616f7de40984ccb6b2
- SHA1 1039edb2078f89138ccafffef1490b571994285a
- SHA512 d2c08501f8801382053362f1be4c1e1a34181319dba80d97adf4c140043d358c8415a5eaf75728462c7c274220c1df95830e654719cfe934aab359f494b8c210
- TLSH T12F012622D693FB87C85C30B90F7CACE7CB50158D7C7C02791B34A02657F46548E45081
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Brussels
- Size 1KB
- SHA256 b10f9542a8509f0a63ebca78e3d80432dd86b8ea296400280febd9cfa76e8288
- MD5 7a350885dea1ebe1bf630eb4254e9abc
- SHA1 5036277ce20a4d75d228cf82a07ed8e56c22e197
- SHA512 524ed4fb0c158a1d526dd9071df7111fb78940d468e964bf63ba5418f9b551ec28c38fa1dc2711415aa31f926d8729eac63d6b1e2946b7942ce822f09d00c5ae
- TLSH T18B11001AA1138BFAF86C74B53A605DC24745368C98BF516DD52C53E951B4F5499024F0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Chisinau
- Size 1KB
- SHA256 439e1ca44e245387148c1141d7d7c5e84bcca73188ff85351a126c8deea0e12e
- MD5 28b60125d475647a97304d7c8302e0f1
- SHA1 99cc439385390ec9cce305ef4bc3c58c1298c628
- SHA512 5bfaa4ca0c0de1fd05c019a9cbe4362c2dd89834218b8907adf752152af057651dbaa6c35e70971b1f7e1605bee1aa885b22dee1000c611140a521c756a98207
- TLSH T16F21211572670ADECA4324BA367B79FE8D9C470742B566AEAA5B43148670F39BA040C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Helsinki
- Size 481B
- SHA256 71ca4af5998f09990c5e875d350fc3c8e34f280bae6fe14f36d4692face7a563
- MD5 aecc05607e312ffdbdf3a8f07ac64a6b
- SHA1 467706af09080dbd38a83372e3a98cac405494c3
- SHA512 a48895d819a41382e0a1d642b89e77b2a08b74c0be500f6eb65a584d3823fe8888c522a51f821a4cc7fdf2480c948c4d88f98a9da5d76ec5e083dfe1de6ea310
- TLSH T12EF0C0D8F417FF8BC12D75BA3F1BC1624D40B94DF80C2261678D950F927C2943D0A091
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Isle_of_Man
- Size 1KB
- SHA256 676541f0b8ad457c744c093f807589adcad909e3fd03f901787d08786eedbd33
- MD5 d111147703d04769072d1b824d0ddc0c
- SHA1 0c99c01cad245400194d78f9023bd92ee511fbb1
- SHA512 21502d194dfd89ac66f3df6610cb7725936f69faafb6597d4c22cec9d5e40965d05dd7111de9089bc119ec2b701fea664d3cb291b20ae04d59bcbd79e681d07a
- TLSH T17631710B85868B0AD0FC277A3AF3A3056D584588D3AE8161F4ECC3E896FA3095D6D8C0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Monaco
- Size 1KB
- SHA256 cd588e779c5737d70e4e47158dafab7945b026b2bb34454cc47741815459b068
- MD5 506e99f9c797d9798e7a411495691504
- SHA1 b8f338a8ff9fb7e5956f4cf93078b7314ebc2b0e
- SHA512 b414b180d3d59e58ff9c299322453a7739bd3f6ad45da60396463ecf126699436048411652ab59017a5fb10c51ef67865df8a8a2f2e1803cf9a4739f485607df
- TLSH T17711525AD563BECBCC4C65F53D10A8958F9232CD3C9F02164F38056E6634F61EA066B0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Moscow
- Size 908B
- SHA256 ed2e0a099fb446b2416683438d3f56f9fc5a62a16c7549a7f59cbc935b364c8a
- MD5 39b47bf37a27f7bcd5d3f7c51343c7fc
- SHA1 215283523f3c66d520fe278c54a65ce07928191e
- SHA512 d6067dc4cf22b38ba2cfb7ac39de38accfd89068316fe7049b34afe3a6dfbf1e4ae4c50d001501393f616d7d0985aeb7856fc981b29722f9030e7d607e48ca37
- TLSH T1141199503048FBFFC1046D31573B0975CEDB8435020F7FD1DD0A63084475988962CC88
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Podgorica
- Size 478B
- SHA256 a8c964f3eaa7a209d9a650fb16c68c003e9a5fc62ffbbb10fa849d54fb3662d6
- MD5 a4ac1780d547f4e4c41cab4c6cf1d76d
- SHA1 9033138c20102912b7078149abc940ea83268587
- SHA512 7fd5c4598f9d61a3888b4831b0c256ac8c07a5ae28123f969549ae3085a77fece562a09805c44eab7973765d850f6c58f9fcf42582bdd7fd0cdba6cd3d432469
- TLSH T175F0267651228F48D11C94BA1718A91B4FA4530ECB8C03B226A9A91E527CBE4EE060E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Uzhgorod
- Size 558B
- SHA256 0589e80ddecebf9d3077898c12975d2be7393df2856ee9926c534763e1e26bf2
- MD5 f2dfc019c4f320ae616a51ab406e8c70
- SHA1 03ba6cc273c409aaa5c207e0cefbe23b2b0b150e
- SHA512 d5fd4ac155e5cfb26b587d71b3f5997498ae14737c5f5b629fa40e01f32afffb2f6462d74847318c6badcbede9fa775949c8222d418091911425ff5900b8b059
- TLSH T177F09741631BAAEFC30570BABB6B40348E456014436032CA221AC35883F4700FE1C091
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Vatican
- Size 947B
- SHA256 86bd26a06fe3057b36cf29dd7a338f2524aff8116ef08d005aa2114ea6122869
- MD5 c57843caa48aa4715344a26830df1f13
- SHA1 c2f1530fce47b5a7d976f0bd4af28e273a02d706
- SHA512 5e93be3d2a9f4fe6ce98c938cc08ea6c08c36c05ef797c639f97cda82c1bd272e7826df413991929a94a33b8b0c96656f3f96f61d338737ccc26be72388c6408
- TLSH T13C112C20C853FECFC76C55B40A20983A8B81338A3C4E4276D26C631E03F8B1047049B0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Warsaw
- Size 923B
- SHA256 e88f5a51f168157a41ac2dd8a4ee0e9a879419c84c6122b4771b1a2a33d93a4c
- MD5 d44a4791346a5defc84c6bec9e52645d
- SHA1 663aacf47137418e48c0c631320bb57a2381f7c5
- SHA512 007f09bbdc2731b48754bd2c91e772bf969217f482834497bc44a3ea562e422ec5c7a090d91bd36eb69d2afdcda96707dc864f2ba8cdd50debd3cbf637670cd2
- TLSH T16C1165D5D013F28BC2582031345B85C69E816B087C9D137B093C523F12F47507E484F7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Zurich
- Size 497B
- SHA256 199062b1c30cfeb2375ec84c56df52be51891986a6293b7a124d3a62509f45e9
- MD5 07b0081174b26fd15187b9d6a019e322
- SHA1 f5b9e42b94198a4d6e8a7ae1d4bdd6b7255ce1f6
- SHA512 18916dc499f8b0a600cbe03dca3509465c7693b64c9c27cda3c97d0de7269279b4c9c918c3a9aafc4a3c9f3eab79a521f791dba257aaf436d906aaf4526bd369
- TLSH T142F0C026E053FF43C12C38F81B28FD5A4E50524DBD0C02672798A82F5B7D1606F0A0E0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Indian\Cocos
- Size 187B
- SHA256 e89d835c811d4da44aa8b386782ce8828df085aa0ee8f25661a9881d2f00e90c
- MD5 37f26cf8b8fe9179833e366ca13b8916
- SHA1 da0b9ee83039fcd70fb0d439fac9f453768abc28
- SHA512 60817dde97cea65dd16de8b91d0fd6475a8a2151881a1e3a9a496d143c71509ca6d6f802505cdfd6b8b91f6478717d5509abee8e301a926207a8fac7630bf1db
- TLSH T18BC09200B74128A6F88A137C1A3A024ECD48E854840B12EA2D6814840CBB8D963C10D0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Indian\Kerguelen
- Size 152B
- SHA256 94485f0f58f842767ec2db93539d5fc3afb2bdce16673d9e63c0988cccd6438e
- MD5 5d62b2758da6d68cb971d8f2cf64d432
- SHA1 42c74574e1afaedf50e2e0854bcfc246be0a4817
- SHA512 cb37dac60ae229be6aa60e8c6011ab772a9f6cbd7d5afc809fe70c73a7481ec5e4dfa71275361937218c37996b1917a18abc9c7c7496ac38368928c020413655
- TLSH T1EFC0120127191C44C590033C09570140DD38458544132597390920580C74B81E7201C4
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Indian\Mahe
- Size 133B
- SHA256 0d9ea5053e83188032a6fb4d301d5db688f43011e5b6b1f917a11b71a0da7b16
- MD5 667e494c45d181f0706bd07b211c850b
- SHA1 bb2072fbc0357111a7570af852bc873b0f0070e1
- SHA512 57a367ee2efb608cb11fa83d2ce4be99c55f223b717ee9da3d78a5f273a6dc0e8face0d255304d3ab99f1dc7c6155376afb53eda8bc0b8ac481fcd54b3a3313e
- TLSH T16DC00286B74C1847C590137B5E472B999F22D154994252F73D1D30589C9DA81FA220C4
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Israel
- Size 1KB
- SHA256 9fcde8d584dea0585f5c8727aaf35f48a149e0dbd3a83bf6cef8bca9c14021e3
- MD5 9360bb34802002d91d9bba174c25a8dc
- SHA1 fb7e5e8341272ebd89210ece724b9a6c685b8a69
- SHA512 6e0d68f6c58a2f7aba3e1b0d85ccaea46b63695edf7a4476f0b65f7853d3c28b086d5c8a2f0f6e1dc2f7ef6a71b2165e3f07a885e3307c8488ef739ffe429f50
- TLSH T142118629F90B308FE119B17C290742F1CA04C2E77F4914DFD70B430C98F1158DB66981
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Kwajalein
- Size 219B
- SHA256 4be6458ba89d2b30da7a52f2ec346318f783d2cee856e777c4b33164a365064f
- MD5 475a8ae9a30287527356f20d4456abd4
- SHA1 f7e8430a1e2c0cb7c6fee1d41940b4baa0e8491c
- SHA512 0450f701ef4271dfbc911a4745a4e0605affda6dda49a8f6de7dc009d47c176754b458ed4bb5178ac6536516bbbf0f0f9b3a0a6f78fc2ce101eaeee88a31fac3
- TLSH T13FD08C22F2398AA1C98993BA100752404AAAD243841243922F8333DC39F82849A08CE0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\MST
- Size 240B
- SHA256 ae11453c21d08984de75f2efec04dc93178a7b4e23c5e52f2098b8bd45ccb547
- MD5 db536e94d95836d7c5725c3b3c086586
- SHA1 f0c3fb96c02359a66ed4f7000a6ecda3d4a699ec
- SHA512 87aa4f9f8b3b01c4bdc96fe971be12b38e16219f58b741c93a52c369146f6a3ae669e2bff2021403f5c1aee1f216c02d1faeb30012454e1de463c467c7f6b374
- TLSH T110D0800DF3C73715D975663845791141C876C485A54CC6DF261F25125DF551405719C5
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\MST7MDT
- Size 1KB
- SHA256 9bb703920eca4b6119e81a105583a4f6ca220651f13b418479ab7cd56c413f3e
- MD5 c1b9655d5b1ce7fbc9ac213e921acc88
- SHA1 064be7292142a188c73bf9438d382002c373c342
- SHA512 2a188d7bcc48acc17b229e50e136b55dbc59058ae9be6ef217238cd1b6c0a59817954ab98817d2e2ff836a6f7d7461be5850ad73a9096d7a14ce9fd8c2a3c29a
- TLSH T1961120C9AAE1B575E15D543047B3D0800CAC48855F0FC98F20BEB52A8EF6B5936741A9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\NZ
- Size 1KB
- SHA256 0e06e7e55aedbc92ef5b3d106e7c392ab1628cfd8a428b20e92e99028a0bfbb9
- MD5 655680c9ae07d4896919210710185038
- SHA1 fa67d7b3440bbcef845611a51380d34524d5df4a
- SHA512 28ca8023b1091b2630bf46314fa1737ac66a3b464cdd48c2d8300edcb2eb5847710e98e4f63be358e443bfa8ca6dc73a8b3f38fc6df4f7c0ff324520c91bc498
- TLSH T10B114109C4B372F3C725ABFA5A04F629C079684AF61102EAEF9A6195A63040DDD81930
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\NZ-CHAT
- Size 808B
- SHA256 a67858fcb6fc5787a8e9c2b7c8be8964bd3ce9223f7ad1baac2c9ca6925f4c78
- MD5 41dd4c2678c8776c4abdcc809932bbe7
- SHA1 948aae44bb328a82195a5b72ca5e9bdda00d9b52
- SHA512 40178e1189356ac0dd934522f2feadf812092545afbd78b100d9dc6592a74b7f8ba7c4721480c97d1c7a4bcd957b563030eeec5b5b36cf9ae16acbaec7ba74ce
- TLSH T124014701C483B5F3C164E47B6B04F624C9AB5A14FA0107CED35F649853BC005FA85E65
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Pacific\Enderbury
- Size 172B
- SHA256 a23386fa8aa2db91ce9d8e811616afff76e65a0d4b0c82d3e2ffa4c4e155baa2
- MD5 99cc3c716bf45f1ae5bb572baa4ad256
- SHA1 b49e2d0d552414186bf87801176fd82dc19debc2
- SHA512 8f67ee7a35db687edc27f2812d5eed4d4e566a45900d3dbd7be4ff56225c7b0fedce5f14cb719eb8a2303e36e62c4c5622d0194d9a04f036a9dd0bf9fde719e1
- TLSH T1E3C01289B1E048C2C5021338001B1FE46E178841980347DF3EC131481E543F3EE504C1
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Pacific\Guam
- Size 350B
- SHA256 8b9ede33ab32ae2505bc06eb5402e7ce20b0fc8e2510dcb305c25d39a1fbd725
- MD5 ec185892bb2764a8280ee41ff8f2b032
- SHA1 82b8f7b67cf7d0b4d6bf12270bf734d1e83531f7
- SHA512 05bdd1b237db5753e485ba59a07b7a6f19e26cf846337ad0fc1352c6883642d4d358dbb72a0c18ad73ef35bf96d0e0789b1d4f7900514cfc1d451ac9618e7fdc
- TLSH T14CE02B05B26404D4CB80357145A541E54E18A0866C8351F7FC48770CEBBC2605E15C46
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Pacific\Johnston
- Size 221B
- SHA256 1daa5729aa1e0f32cd44be112d01ad4cc567a9fe76d87dcbb9182be8d2c88ff0
- MD5 5ed332a521639d91536739cfb9e4dde6
- SHA1 0c24de3971dc5c1a3e9ec3bc01556af018c4c9ea
- SHA512 0014e8f2499fe415644e21456f5ca73297c36603de24d60459355a55174e1db81e6929278ccd0df79c750c519d2d6e5ee49019feb63b42f9240c8b8402f3db98
- TLSH T167D08C0CF3A50E06ECD2F23AA287A5C2CC7040446D203683B8AC3F24D7FCA4005A198C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Pacific\Ponape
- Size 134B
- SHA256 522f0f374b61e2c6f5fa7d19f1c7acccd09e4a213462ee3b42c90d32bf2bf18c
- MD5 44355d47052f97ac7388446bce23e3ab
- SHA1 2035f1c7a9ff65687b1e765ce240f701cdc7bc82
- SHA512 3dde34960b8aa19fe30f43588b3ba8a25b256f918a19cd03594e15ca482252eed1e987611fdc6b09997205efe1ceb93cf77e487a2dfea54a21214c66a394a086
- TLSH T114C0029DF76C8856D061537E59AF57409D75D408897783E73819394CAC982D0AB194C1
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Pacific\Port_Moresby
- Size 154B
- SHA256 683001055b6ef9dc9d88734e0eddd1782f1c3643b7c13a75e9cf8e9052006e19
- MD5 bcf8aa818432d7ae244087c7306bcb23
- SHA1 5a91d56826d9fc9bc84c408c581a12127690ed11
- SHA512 d5721c5bf8e1df68fbe2c83bb5cd1edea331f8be7f2a7ef7a6c45f1c656857f2f981adb2c82d8b380c88b1ddea6abb20d692c45403f9562448908637d70fa221
- TLSH T10AC0120162E70C0AC660023505494793DD48D50180062BDB24041199F47D78136000C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Pacific\Samoa
- Size 146B
- SHA256 650d918751366590553063cd681592fdca8a09957e0ce2c18d6697ec385ef796
- MD5 f789c65f289caa627ea1f690836c48f6
- SHA1 dd4dadc39a757b9a02efd931a5e9a877e065441f
- SHA512 f7461e9b6c0af87b45dccc1a8884c47bca59462c9cb5ceac74aebc314cc924c2aebefa993a7466d4d3d4ab3fcdc76c6bc43c7522395f8f053273f55f3eb8305e
- TLSH T1CCC0124065442C82C0F813BD030602405E048C10904112E3A850210DCC560401B05088
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Pacific\Tarawa
- Size 134B
- SHA256 09035620bd831697a3e9072f82de34cfca5e912d50c8da547739aa2f28fb6d8e
- MD5 ba8d62a6ed66f462087e00ad76f7354d
- SHA1 584a5063b3f9c2c1159cebea8ea2813e105f3173
- SHA512 9c5dba4f7c71d5c753895cbfdb01e18b9195f7aad971948eb8e8817b7aca9b7531ca250cdce0e01a5b97ba42c1c9049fd93a2f1ed886ef9779a54babd969f761
- TLSH T146C00280F71818D3C455577E058F17949D57D6418D0287B7398A34CDFD983916B288D0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Singapore
- Size 256B
- SHA256 0954b2d9a301d94f4348024606a71bbcb2fa24d3cd3709f5bc8bca605039785d
- MD5 8a2bb95893137bb40748ef4ecd8d7435
- SHA1 6d65ec8958626477d7cb6ddfc036e70e7949c533
- SHA512 360d4e0ff1f06c63be5abf3d2fc336d5f11e5e0db055999fa856f03344c16d30b7b8b4145e7fb5f8a6bc0b912c4db46b8f66af586fddcb74225228dd1805e6bc
- TLSH T1B5D0129863A5A80EC535A73BDDEA2A02DC57D29A8512023B3C2411C95DB90549F491D6
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Turkey
- Size 1KB
- SHA256 2a7163b16b94806f69991348e7d0a60c46eb61b1f0305f5f4b83f613db10806f
- MD5 48252c9a797f0f4bea97557a5094cf98
- SHA1 6e6893d64fa2e3249efdb170face5085e5f5945d
- SHA512 f091784b4dd4a9683c5a70194dd957e6bbf3a43a0bc469fa12c9788f1f478256dae78dd7f5eb1b49753f3661893f8dfaf1f988b07a00a0209106d4d231a27bea
- TLSH T1F2218849D16BFABFC719343B216B45BA4DE5871634DD1780D686231150F524C7648D86
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\US\Aleutian
- Size 969B
- SHA256 abfb1980e20d5f84ec5fd881c7580d77a5c6c019f30a383aaa97404212b489e0
- MD5 1df7e605c33529940c76c1c145c52fc5
- SHA1 09c48d350827083bd4579e0cabf5be2ff7bf718b
- SHA512 27af4d1bb570244667132cf8981f62f245b2228518324ecc67867eb15c8440446ddd6f2a221cbb2aeb15adfd955dab01bd708ac2c2723a113aa30839ff6632c6
- TLSH T10F11EB3BA10101D2C6E0243042B3968974F35EB47F5F6FDAAC42B23408B2100ED21B88
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\US\Central
- Size 1KB
- SHA256 c27b739ff46a7df0594e120d725b439217e11e44ea9a50cdc49130383b5482e7
- MD5 85435a33486747b319872947c68317f3
- SHA1 32e3c6ad26d613ef495d7d5d433edfc8314c702b
- SHA512 1c6327903e9a396a278cc15ac97bbcef48b96bdd9e8c6f9948297e9d3eb2aae9692c2714071f6d58c84fbb24d636bf96fd82f1bd424031a53551f8b50f981b2e
- TLSH T18C316319962DB4CFE66185B2498318FD0F74F2D16F2B8413D13A174C26B6F923635C72
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\US\Eastern
- Size 1KB
- SHA256 d7f2206b3a45989fc9ad63d558922532fa7352280d5f87176bf1db79cb1d1fa9
- MD5 763d7a8374a42066d2b0bb81bd47218f
- SHA1 b75087bc45aea07d6c6f9c17ac87eab1ef826f3a
- SHA512 ed227c915d7a595d4247c53d2e5c90a9209d2b1252390464661393ed8d94555e9a968c550c145ba2712f5de4ffd441d81492820a3a361a7203dc53dd3622a430
- TLSH T1ED31639A852978DFDF1189BE1224803CC76834835B3795C6D24D2B006678F9DC969EF2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\US\Indiana-Starke
- Size 1016B
- SHA256 2890b35dcb7c093308b552d82d8781a8ce9a4fa6f9de058283a6836ec1f9f282
- MD5 964fb4bc6d047b2a8826a0734633ab0b
- SHA1 e22e9a86e34a20fbeb4087fd94145b287c28e74f
- SHA512 869203f9854bf2cd0ffcc75f4524965757ecb03879a08e1275404b7eaeb5942eb25dff0f6ca6bfa236e659e2fb315c1b9dfcfc544a59ff7b3cdd6ab6904aa298
- TLSH T15F11FD64566DA0DFDA3095F10A4705F85F70F2CA6F2B8883A86E2B1C1AB57D23B31D21
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\US\Pacific
- Size 1KB
- SHA256 200d05754f6d83a371cf408d7085125797657b3b0bebeba1e508cffe86a3e5c8
- MD5 641e03b9a1178df8c823447ea6563f25
- SHA1 6ef797d8023f26139b78a452f630893c70b4d0b9
- SHA512 c959cea5dddf0edb9c910a1c45a5d2a0e1d406cda39bbc2176d0af76feac26f4358bad4d94bf2abfca4f4f35d518721004be3ddca76432c38e45cff046f8a6cf
- TLSH T19621C806D1040546C8DE23767A7F01770C608284EB2EE7BD147D85901FFB3241E5C2CA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\WET
- Size 1KB
- SHA256 44d2f6cf84737e6a1e0daf914109e94256beca40b40c9a11b7a04e8bddaee4ec
- MD5 811ad23dd5d9f6100864211855fda211
- SHA1 6424d0f2f76f55f4662ea272ee236355b1dd46d3
- SHA512 a0af630b88b325be0c1ed27cc1bb118301acf71241683c72cc1bb1259aaff4d1a0dcf2a6fb26eba1488d2f9adf767abd79f93af6fab8b4383f3c5d1051b0950b
- TLSH T1A631301961348AD0C91C68BEB0278F459F403A2A8B9F0A12EF5C5FC9A171F649D1A1F5
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\ucrtbase.dll
- Size 1.3MB
- SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
- MD5 286b308df8012a5dfc4276fb16dd9ccc
- SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
- SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
- SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
- TLSH T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe
- Size 16.8MB
- SHA256 3d954a278729d3205b50a8721345ffa4f49ada301705d22a1338dfdc8b966605
- MD5 7a2b42168d75dc93601da31ac02fe188
- SHA1 8c09719419540960552317dce8f27bdc8457fa46
- SHA512 5a8b5bbf59c4640d48faa02d0e562a6eb2e9981d562e2d2a7ded3ab6ae5f077f2247465c141337ba9626e69f4e8859b82ae2e3d13e93cbed01686f198348e4ee
- SSDEEP 393216:nOTEK1R1vEtmj8I69Gf3mCLF7Mtb8adgi/rCipN5zO+u:nOTf3pVfWmtMtbx+i/ntzO
- TLSH T140073310D24590FBDAE303B7DA1FC264E2BEBC156765C4CF4284B2193D172A56939FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty.exe
- Size 7.2MB
- SHA256 02dcca2962251b32b1e2a5a227cb9a1efc52a4ef3f288a1e6c439b9670e6a3e7
- MD5 42b584397c6fdfea3804454184b9ed73
- SHA1 acdd15974704ec07ba594f3ab7344896b6d61799
- SHA512 68aaf7758515af4a3835284b595bdfdc8af295f1638687d07f863c508401d148ee872a007219b534d56dea22a510a1848591e91fcb9c62fb347220e6956cb592
- SSDEEP 98304:XpFAV+bI0ixHDT6T+VCpWBFHCtR/K5CiMNPxa4PFb6DmfJChgZgn+L:XQaiFilrPCmW3
- TLSH T11E768C07F79181E8C09EC178835BA637EB32BC894935B29F1BE44B112E2AF506F1D759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsl6A0D.tmp\modern-header.bmp
- Size 25KB
- SHA256 8f9a1d9f07f59520abde541066983cfaef91c745070be879659abcf1f04c94f1
- MD5 66127fd2e4cf5ef30d7e19d30b2a2ff4
- SHA1 68804b9ee408aa90bb4e7d5310cbc14fd268c1ab
- SHA512 90c6dc527659d5aa6080b7fe6fcd89629bbcd835f01a8b0daef5a0ab0f8a23831db6701a422f4d276b31d073a18abfab7517664666db5f6d6d66fb3a9022cdf7
- SSDEEP 192:yAV9X/S6pHkkFuyDFiJCLS/kv8Wbnp1FueuWjPjHbhErAdnTwy3eJ+a7/lJh6gA2:5ZW8S/s8ip1FzhTj7AsnTJ2+G/lzdAFM
- TLSH T137C2201713409C0AB61EC4D264ACF2A98210EBBDCBCEBFE13FA5D0BE711255F91D4A65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsn2661.tmp\System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsn2661.tmp\modern-wizard.bmp
- Size 150KB
- SHA256 084dec4fa7121522b5cfa4f0e173dfc32d7fc0f064ba3840fd8af51e52a883bd
- MD5 9d883082f562ced2e8d29e61da7d9259
- SHA1 d82195414d44ee387dd596e2c20aa78d0f89ea6b
- SHA512 0a4ade0f6213297cc59f2de5e0138c9cd25acee7874c6571c8697c757c00b0543e991c644752c12554f5f70cc3de0fcbe84f67029fb1ed32186dc60b12c9ee84
- SSDEEP 3072:yD+GIBm4rzzIzzzzczzzzzzizzzzzzzz9zzzzzzzzPzzzzzzzzEzzzzzzzz5zzzQ:ySm4rzzIzzzzczzzzzzizzzzzzzz9zz5
- TLSH T16CE3414177A6E5C9B31C94074F0B5D2C4408A6CDEEFAABED722ACDCEA559702232DC4D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsn2661.tmp\nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsn2661.tmp\nsExec.dll
- Size 7KB
- SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
- MD5 8fe362ffdfa66269b8a64e3a87f68e52
- SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
- SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
- SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
- TLSH T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsn2661.tmp\nsis_tauri_utils.dll
- Size 33KB
- SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
- MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
- SHA1 75197fee3c6a814fe035788d1c34ead39349b860
- SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
- SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
- TLSH T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 0dfa66f609fb0c3115a9b4be5c09f2536dff65a534246cf3a77c3f63b6641405
- MD5 584577cc8c95b42d226c61f8016ee674
- SHA1 68809550c2e22c269ff8129d540c80cb185456dc
- SHA512 c4f2af465478639779453b39c0066b890bb41426d4ca232d52eaba715349dd7674823036762e684b55417aed9987665807676b646d3a1dc8f8d993ca00b0c47c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 29d7c2e711403bbcbda53a31db80bb958aeee7d79d07ceb9140d58501ededf2c
- MD5 9f340b65c704fa84bd154276b80eddae
- SHA1 df5d887d563260adfb55161fcc3362139b7417e1
- SHA512 f371bd9a872a6b9bc2c6415fbd2be62b9a6d43ab9592fa1b789a21e85e49ffa2c579cc86f46b94031d433a049cb8b99f6407a7b41461ef219cc95211deb58ba2
- TLSH T190D01212761205B4D02029371002F50A1400C50B8649C0156428891D1B245540E07441
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 30a4df7a14bda1da086a63289f683c8161d4082c8704fe3b940bea83fe035bf3
- MD5 fec9d0218a1150b5beed9875fdb7ba21
- SHA1 fbbe4a4613238f66e0ae9bc8f249bf18b4e4110e
- SHA512 e73e8c7576c780dadf4bc2a1fb3995128870f5e3fbefb1e72901ed36be2e92bd7809a950fdecc8debc030bb2ab5472d021011673c261493e3e5d674029c6ed65
- TLSH T161D012127A1201B4D0202A361001F50A1500C40A8749C1156428892D1F245540E07441
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 72B
- SHA256 f2c397aca6d2e0bb0d791ece69b979575c42150d4cc37fb27b302578af2a3e2e
- MD5 45e5827b62794f04ee1bd20af4c8a319
- SHA1 021310779d3a15eb4dd8a6eeee0687a6bcd02061
- SHA512 aa9a04bb6657453449530eb82ab9eef1bab885e99febbf1cbc7bd3ea0fe603ca284f205da38ba3d7e0584c44e7e56024bace2c7dee82d94b370083534a994cd3
- TLSH T14CA0021059E40655C9651BB919A197D036304B601A029F4540D402B98DA0775D605365
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 48B
- SHA256 5071d99c804973ae9366361ba791495961936bf6928a952d9c8295f50d1086d7
- MD5 046584078630c2d00782b5b62fb999e6
- SHA1 453488ee68f9c6e0621f65c3e0ee4198d7f47444
- SHA512 61930af748d2e49bf9dbb21e48312518173fe95535c36ee8943c4819154e807ae695db40dc1ee4104ba7e52df5c180c4d5912d266e66a7b662228d1ec5149bfa
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 96B
- SHA256 0f482e4457b0da507f84e23735e823c91cc1d1a753d7440229afd0b7b2c72220
- MD5 30a683f2639a90a198714eb160511464
- SHA1 c1368133f3b17c6091559826be9120c93308f84b
- SHA512 0e6f3028109f55700735db306e0b10f9cdc941fa19684db5af71074939e30dafc0a1ecda513e1972b0c918ce0d5868b999034990821544fecc52bc2a42a96e3a
- TLSH T12BB024131C440101C3F05F3405D004C073347F000307444DC77441D44071307F100370
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\DawnGraphiteCache\index
- Size 256KB
- SHA256 3c8588647bb3780b370fc13a4a7e12a7d65582f4ad2d037f7d6c5189ad32d4a2
- MD5 b1063785a2adcf6d097d7a4858a3fe22
- SHA1 d13d64fd78b2653004543c14c5ecb4449071a396
- SHA512 1eb2c6713f12d1de8118a22a66b3058c64fd53f185d13a30e853922b7356c278474e0cbba44398b1d506e6e7c7d8ad142500cbcdec55e25736f4a6d040c2842f
- SSDEEP 3:LstlNllkll/lcGv:LsX3lEtcG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\DawnWebGPUCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\DawnWebGPUCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\DawnWebGPUCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\DawnWebGPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Extension Rules\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Network\9d904ba2-31c2-4971-ba26-a1384714623f.tmp
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Network\Network Persistent State
- Size 578B
- SHA256 066b565f3135fc239e48f96a93d11e15948d0b47a93f8cf64d98e37278a9c21d
- MD5 b6b0de0b408dea0427d00d9e67fa0053
- SHA1 d21ba2747ca029d2ceb4bd9eee5b5e7708454a31
- SHA512 a2536fa6f3ce12929b0d65de07ed8e71b81a08ec5e9707feb0a67b7a906ede5c3050b2232e81e67bf4112d84c2d10236cb087b05b9076463bbf1a165dc56d5bc
- TLSH T18CF0E1A1D2D0816E8A5123E417357513CA3E040A921C3D26DDE9FBFA57D1079D32040B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Network\Network Persistent State~RFe596ae5.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Network\TransportSecurity
- Size 355B
- SHA256 bb43bbd6396f14655937a7acd073b34811ab70f144075af5c8cffb12f79f4b70
- MD5 3f4204b3379839fa9e41f0fc873524a7
- SHA1 ae8aa8616aec03ba8f346ff16e9bbe3727e06faa
- SHA512 104305c6ad0b62d1207d7c371d863aed6fa98bccbec30710fa2bdfc76d223afe37e5795dde5604ca44d6282f6495453200d85cca48287184d58df5aade5f30d9
- TLSH T1CAE020B250BED876547845291EC47F455EB5F037418264F4C6E2C57C61405A7450B066
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Network\TransportSecurity
- Size 353B
- SHA256 af38d36be9192a8d3d679f19e3bf0b142aea2451a0f6bb7535075fb10b67f4dd
- MD5 0dc1e68cba9d52bf63b1e3f308def97f
- SHA1 a6541e86610f5ac2c50ca7e18e407d00a01057d2
- SHA512 86cf1d4a13a0b49030720ff45cc1eb87d69fa145f4c9f8612339eaa197eadb8bff6266502c506ca30e280316f46319a39e53b8efff2f86aa0be91ce8eb3d2cac
- TLSH T167E020A2407ED8765178492A1D947F45AEB5E43B418255F4CAD2C57DA0405A7461B012
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Preferences
- Size 6KB
- SHA256 d1ed5555c64b92678abc7fbd3d4ac62d3a5a7fbaf4782d5f56a689b12009c30c
- MD5 2d02482944cb06af793355b556c5e789
- SHA1 b87036006484302ebd0c899c37143f1f9b03eb5d
- SHA512 b626b2a7e0b85d8d4b551e041800efb3760d81993f11afa4f76ac724b3d4fe9d8c2628897c6a89d1355769a408e043e9d6e4d4b22f025573e7e2151729b42e61
- SSDEEP 96:stRu05rSwh69Vb9Hfffq1KdZ8i0vhEqvktRsm/7qx+WVHMSm+uecJRN9m1idQjkt:sto0REXff/Z8paVj/S+WiT38wd6MXK8
- TLSH T19DE1B8069E68B9774CC7E21DBE35BB52D2FA106265C40E5CEBFC852C04D66DD6207D0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Preferences
- Size 6KB
- SHA256 94b1f1d1e3049eec26de427fc83930cf6d22c6d6ab6c814166881e1fad4f80b0
- MD5 6fef94a32eff9fb203880577e6ea1660
- SHA1 a2736f816969e30a7bc50be147f7cafc4e3087b2
- SHA512 2dc71e2a99bef9269551829d64b9625258df61d931f5aa93795f8171c37ca606fc4da489bc7d5fb3bca5776325e2e6c073c3e457f27385b082f12c610dada967
- SSDEEP 96:stRu05rSwh6qbDHfffq1KdZ8i0vhEqkktjm/7qx+WVHMSm+uecJouMk8dQjke+go:sto0RTff/Z8pa2S/S+WiTouQd69OM8
- TLSH T18EE1B7069E28B97B8CC7E61DBA35BB52D2FA102261C50E5DEBFC852C04D66DD6307D0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Preferences
- Size 7KB
- SHA256 487c4fce519320372a828af8269003ecf67776a11306578e0f9a424c4b29a344
- MD5 777d5e194302bb57e199364d30241f3c
- SHA1 722803fa306caaad4866c6ef3a1b2edaff032646
- SHA512 058af339b2bda175c9fe26e3b639ffbc07f616459bc6f2c93a6b2183bf147d9f67a86a39db69d6ff9ffe79cfd4ceb1188448de0971855e0d332b89219c31b7dc
- SSDEEP 96:stRu05rSwh6qbDafffq1KdZ8i0vhEqkktjm/7qx+WVHMSm+uecJouMk8dQjke+go:sto0Rmff/Z8pa2S/S+WiTouQd6zOMC
- TLSH T192E1B8069E28B9778CC7E61D7A35BB52E2FA102261C50E5DEBFC852C04E66DD6307D0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Preferences~RFe5968f1.TMP
- Size 6KB
- SHA256 176cbbe38c029e5ca26c3e48c15c66ae4f33fe6404a8206ae14eb64cfaba95b7
- MD5 1db009a95cfe2bd987bbfb67f9e36e9b
- SHA1 e2d9cafd7337f91ce42920c16a88c7fe54254ea5
- SHA512 34fe90082e5ae9fffb44e4db3b8e3963420e9dccedfac7521db8fe7310bfb1ebb748f52f0337e5109ae850411355c7d4e5aeed5614f5db6f536d838135b70e80
- SSDEEP 96:stRu05rSwh69Vb9HfffDKdZ8i0vhEqvktRsm/7qx+WVHMSm+uecJRN9m1idQjken:sto0REXffYZ8paVj/S+WiT38wd6rVM8
- TLSH T1A6D1B6065E68B9778CC7E2197E35BB52D2FA206261C50E5CEBFC852C08E66DD2207D0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Site Characteristics Database\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Local State
- Size 4KB
- SHA256 a68378be8f79f40f2679fd566593ec8ce2043c409b61c2307559a5074a8ba55d
- MD5 7f457c528e221209a5c8651d02a4989f
- SHA1 7008aa1839de0c143d65000723922790cdecf33d
- SHA512 fdea6da7006b9ecf185a606162eab8fb8fb81369fe9a9465f8ca9fa30cfab90bae8cf05ae09dd0eb0065f200a0b36894b5c49b186b52978c9029cbbceddf38ef
- SSDEEP 96:zup7bNkCEifHezFIY8Frh/cInURoDoto+5RwtDR3xBv4Zpa6ZUZiFZjTwmloa:zobNb/RooDUhYJgZrfB
- TLSH T1E3919526A8A4BA378DF2D945B8453F03BA655167D5953FA8D9EC0F0C02DB2DD1302D17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Local State
- Size 4KB
- SHA256 146d49b4cb90bf901bcc540462b9330d8e74467f068ff8f9e6149ce8a638caa4
- MD5 66bef5b80c74df8db32d38933f17afe4
- SHA1 77ebd555e1b3531209e0108d82a9aca7df688b84
- SHA512 0ece37cc6f5c553f5d4b36f20c58efeaa63f97cee2427706f553c82aa59636a0ad19e48f03ea7fd3b3511e1acf6f8dee84c0c93bc499b01144562f9a2cff5b36
- SSDEEP 96:zup7/3NkCEifHezFIY8Frh/cInURoDotoN5RwtDRkBv4Fpa6ZUZi6ZjTEgloa:zo/3Nb/RooDUaYugFefEa
- TLSH T10A919322A8A4BA378CE2D945B8493F03BAA55127D5953FA9DAEC0F0C02DB2DD1303D17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Local State
- Size 1KB
- SHA256 0be9666a94e00b89f1970207eb70e702f82729ef5e22d0707bb657cc1b5ba04d
- MD5 46807b193919523e8db0e275d67a72fd
- SHA1 d8950044f42f27e1693bde5a012b7552e459c5d9
- SHA512 a1accd48663406bdc890249eb2baf6a087a58400f0f0414498b6fda0c1a56890dd1656cf51e73bd19b5c46f3720d991439e6ac4dd8eb903441670b13d9b12504
- TLSH T1463174B2E8D43B33DC82AA89B6517F87AE2111BAC1105E08A7DD5B1C03E72DD5627D33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Local State
- Size 4KB
- SHA256 bbe2a59c31f91c9c9fb3523ebf56c2894676d1da2addcbb3bd6f4a0b1d8b557d
- MD5 461bab159f4df1cd3de02883e43caa4b
- SHA1 f2f70cedb5d7161c872f1f98b9301cd43d42f924
- SHA512 c6a41f5ab50f45b71ccedb6116247486368efd87ef983e93f8990bc31a4e8094870f7f4b1161979d61381ea36eb539f27d851d4df2d727884252765732382ac5
- SSDEEP 96:zup7e3NkCEIfHezFIo8Frh/cInURLl8Doto+5RwZDRgBv4Fpa6ZUZi6ZjiAroa:zoe3NbZBoiDUhEmgFe+Y
- TLSH T13F919566A8A4B9378CF3D945B9453F03AAA55127D5943FA9DAEC0F0C02DB2DD1303D17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Local State
- Size 16KB
- SHA256 1c972fdc05c5bba249bd3df10e1732de405fe3bae6e24de44e6b8630a00ae578
- MD5 d3987db452cbbdffb25bc6793dfcb3f8
- SHA1 318f2f8c0d40d2adc3359f69d229cad2b6bba221
- SHA512 a48b96714edda9ef5cd7efc7018fc0834ad89fbbadf36a31d24922d281b044d8680bde614f071ac1148e92ae0818c286229859cc4b9e81f2a07a4fc9f3da558c
- SSDEEP 384:zl+aQikB+z/xvxjg/qhEu3NbKMeDf2F9zt:8/UxvxjgC+uRmf2FFt
- TLSH T166728D2B65697E3399F3E905791C1B8BDAB494B290C52EB84EED5F0D06DB3E80303D16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Local State
- Size 2KB
- SHA256 862ba0938562278b0841d0754538c153d179b443803944185e5657bd3d177657
- MD5 42a1dac45e21aad7dbb3ffdbbde21f6d
- SHA1 93c18d2cdc30abeef019915a4b31f5166ce7f92b
- SHA512 d0b8489f81b449bb85d5a459d3a53defc0e5870c1ecc31649bf4c9ef93372cc3a499247435e3b5ade392da53a0f410a24bdfebc44700ea6e1355ab55811fdef1
- TLSH T182519673A8547A37CDD35A84B9493F53DD3551A5C6512F649ADD1B1C02DB1AC2303C37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Local State
- Size 3KB
- SHA256 962831e3dc7add8b3bf0e08a67988437f12f81c6290308cc97fc1c124194ec8d
- MD5 353d03a218c4807ca5d7a683fb771a7f
- SHA1 e511117f2376c3b39becfabc2176d8266c16c12d
- SHA512 1c6e8ab6c0b17d11bee3860edff304d7c803802cefa1e2d785f3673d9365579ab8c14af58998a87cfab24bdd884156732fe29787080feb1068d3dd22e98cc9dd
- TLSH T1ED71A676A8A4BA378DE39A44B8853B02BA655177D5953FA8DAEC0F1C02DB3DC1303C17
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Local State
- Size 4KB
- SHA256 3af10b353b55e92b43e1a02775dacbfc957b6ab12c6702c37288ecbd1f7ecdd4
- MD5 e7859d7d5c8d93482296ca58fe25126c
- SHA1 1dc7ed00b0978006576e9f4f2ede6335b7bbffeb
- SHA512 26cd008e7ce02d2a5dff1f54786b0b9e071711269db35bc0b78b6533d81830ae1f56218d782a4f3693a7e357e843c45b32f2209faaa3461afbe12e6568b23fff
- SSDEEP 96:zup7/3NkCEifHezFIY8Frh/cInURLl8DotoN5Rw1DRkBv4Fpa6ZUZi6ZjiAloa:zo/3Nb/RoiDUa8ugFe+6
- TLSH T1AC918426A8A4B9378CE2D945B9493B03BAA55127D5953FA9DAEC0F0C02DB2DD1303D17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Local State~RFe591498.TMP
- Size 1KB
- SHA256 969ca7ae86e04da7eb701a19e98330f12bbcbd80fa536041f4c9781af5b9fa0f
- MD5 ad0ca85ba9ca5b3b66ccbfd0e9015b04
- SHA1 36a79acc4bb3909dfb98556c5f2493a0f403423d
- SHA512 b1f7fc606b2c7fd5889b69e9391e572ab54ed73830feab024d03eebacf8e30037d7db2618ee784ba54da27e1d7a51dc6941393959b89d23ae426bacc4b1aa399
- TLSH T1892162B3D8943A77DC825989B211BB876D2051BAC1145E0CE7DD571C03E71ED0623C33
- MD5 SHA1 SHA512 TLSH