Analysis

  • user interaction
    yes
  • max time kernel
    179s
  • max time network
    185s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    01/08/2026, 16:24

General

  • Target
    Ghostly_1.0.5_x64-setup.exe
  • Size 57.1MB
  • Sample260801-twdpdade25
  • SHA256 7246f76cedaf13023b6010c3d9a3aa6f5f4903880c1797f9c952ae813173b5ff
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 53 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Drops file in System32 directory 18 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Detects Pyinstaller 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 4 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ghostly_1.0.5_x64-setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Ghostly_1.0.5_x64-setup.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1188
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /T /IM ghosty-iosd.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3536
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /T /IM adb.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1032
    • C:\Program Files\Ghostly\ghosty.exe
      "C:\Program Files\Ghostly\ghosty.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies trusted root certificate store through registry
      • Modifies system certificate store
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1636
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ghosty.exe --webview-exe-version=1.0.5 --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1636.1308.8788762673028723799
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of WriteProcessMemory
        PID:3016
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffe6d02b078,0x7ffe6d02b084,0x7ffe6d02b090
          4⤵
            PID:3416
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --webview-exe-name=ghosty.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1732,i,8000374241634203273,7715485594341587274,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:2
            4⤵
              PID:4472
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --webview-exe-name=ghosty.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2060,i,8000374241634203273,7715485594341587274,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:3
              4⤵
                PID:3484
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --webview-exe-name=ghosty.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2372,i,8000374241634203273,7715485594341587274,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8
                4⤵
                  PID:2188
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --webview-exe-name=ghosty.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3624,i,8000374241634203273,7715485594341587274,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
                  4⤵
                    PID:3552
                • C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe
                  "\\?\C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe" list
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:1432
                • C:\Program Files\Ghostly\binaries\adb.exe
                  "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3212
                  • C:\Program Files\Ghostly\binaries\adb.exe
                    adb -L tcp:5037 fork-server server --reply-fd 672
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    PID:4672
                • C:\Program Files\Ghostly\binaries\adb.exe
                  "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:4484
                • C:\Program Files\Ghostly\binaries\adb.exe
                  "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2340
                • C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe
                  "\\?\C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe" list
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2396
                • C:\Program Files\Ghostly\binaries\adb.exe
                  "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:3808
                • C:\Program Files\Ghostly\binaries\adb.exe
                  "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                  3⤵
                  • Executes dropped EXE
                  PID:3876
                • C:\Program Files\Ghostly\binaries\adb.exe
                  "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                  3⤵
                  • Executes dropped EXE
                  PID:204
                • C:\Program Files\Ghostly\binaries\adb.exe
                  "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                  3⤵
                  • Executes dropped EXE
                  PID:4444
                • C:\Users\Admin\AppData\Local\Temp\Ghostly-1.0.7-updater-ZRHdde\Ghostly-1.0.7-installer.exe
                  "C:\Users\Admin\AppData\Local\Temp\Ghostly-1.0.7-updater-ZRHdde\Ghostly-1.0.7-installer.exe" /P /R /UPDATE /ARGS
                  3⤵
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1716
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /T /IM ghosty-iosd.exe
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3768
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /T /IM adb.exe
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3168
                  • C:\Program Files\Ghostly\ghosty.exe
                    "C:\Program Files\Ghostly\ghosty.exe"
                    4⤵
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of WriteProcessMemory
                    PID:4244
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ghosty.exe --webview-exe-version=1.0.7 --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4244.3404.15931892275513490541
                      5⤵
                      • Enumerates system info in registry
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                      • Suspicious use of WriteProcessMemory
                      PID:3732
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffe6d02b078,0x7ffe6d02b084,0x7ffe6d02b090
                        6⤵
                          PID:3060
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --webview-exe-name=ghosty.exe --webview-exe-version=1.0.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1820,i,15707648260501030390,11160574000949365011,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1816 /prefetch:2
                          6⤵
                            PID:2300
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --webview-exe-name=ghosty.exe --webview-exe-version=1.0.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1880,i,15707648260501030390,11160574000949365011,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:3
                            6⤵
                              PID:3828
                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --webview-exe-name=ghosty.exe --webview-exe-version=1.0.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2352,i,15707648260501030390,11160574000949365011,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:8
                              6⤵
                                PID:4168
                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView" --webview-exe-name=ghosty.exe --webview-exe-version=1.0.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3480,i,15707648260501030390,11160574000949365011,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
                                6⤵
                                  PID:3972
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:3888
                                • C:\Program Files\Ghostly\binaries\adb.exe
                                  adb -L tcp:5037 fork-server server --reply-fd 652
                                  6⤵
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • System Location Discovery: System Language Discovery
                                  PID:3548
                              • C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe
                                "\\?\C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe" list
                                5⤵
                                • Executes dropped EXE
                                PID:1268
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                PID:4740
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                PID:1344
                              • C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe
                                "\\?\C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe" list
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:5016
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "ver"
                                  6⤵
                                  • Executes a command shell one-liner
                                  PID:3808
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                PID:1624
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                PID:5036
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                PID:1092
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                PID:3564
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                PID:3056
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                PID:4940
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                PID:4460
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                PID:2920
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                PID:3024
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                PID:1268
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                PID:2976
                              • C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe
                                "\\?\C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe" list
                                5⤵
                                • Executes dropped EXE
                                PID:1760
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                PID:2540
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                PID:5036
                              • C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe
                                "\\?\C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe" list
                                5⤵
                                • Executes dropped EXE
                                PID:3856
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                PID:1652
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                PID:2784
                              • C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe
                                "\\?\C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe" list
                                5⤵
                                • Executes dropped EXE
                                PID:4232
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                PID:2328
                              • C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe
                                "\\?\C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe" list
                                5⤵
                                • Executes dropped EXE
                                PID:1624
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                PID:1416
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                PID:2668
                              • C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe
                                "\\?\C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe" list
                                5⤵
                                • Executes dropped EXE
                                PID:4652
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                PID:4672
                              • C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe
                                "\\?\C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe" list
                                5⤵
                                • Executes dropped EXE
                                PID:572
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                PID:1652
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                PID:3856
                              • C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe
                                "\\?\C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe" list
                                5⤵
                                • Executes dropped EXE
                                PID:2056
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                PID:4476
                              • C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe
                                "\\?\C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe" list
                                5⤵
                                • Executes dropped EXE
                                PID:3276
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                PID:2148
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                PID:4732
                              • C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe
                                "\\?\C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe" list
                                5⤵
                                • Executes dropped EXE
                                PID:4804
                              • C:\Program Files\Ghostly\binaries\adb.exe
                                "\\?\C:\Program Files\Ghostly\binaries\adb.exe" devices -l
                                5⤵
                                • Executes dropped EXE
                                PID:2332

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            AdbWinApi.dll

                            • Path C:\Program Files\Ghostly\binaries\AdbWinApi.dll
                            • Size 105KB
                            • SHA256 c1d653030b4bde65d3e07e4d0b0979e17be56df1436cdd15528630f27808050d
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            AdbWinUsbApi.dll

                            • Path C:\Program Files\Ghostly\binaries\AdbWinUsbApi.dll
                            • Size 71KB
                            • SHA256 0710e894d9b40f71a670c13c694079d564c92c1279da382cfe4850983aaebe1b
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            adb.exe

                            • Path C:\Program Files\Ghostly\binaries\adb.exe
                            • Size 7.9MB
                            • SHA256 b4a6b455702684652cccf7b46258b29e653538904359a58fd4931cf3ef286b3f
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            _SHA224.pyd

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\Crypto\Hash\_SHA224.pyd
                            • Size 21KB
                            • SHA256 773fac9a1a65b31d22f79a5e4f035ddc00301b741873d334ee9902db1d1bebfd
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            VCRUNTIME140.dll

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\VCRUNTIME140.dll
                            • Size 117KB
                            • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            _bz2.pyd

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\_bz2.pyd
                            • Size 84KB
                            • SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            _ctypes.pyd

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\_ctypes.pyd
                            • Size 124KB
                            • SHA256 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            _lzma.pyd

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\_lzma.pyd
                            • Size 157KB
                            • SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            ada92cb5d92a588d1b93__mypyc.cp312-win_amd64.pyd

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\ada92cb5d92a588d1b93__mypyc.cp312-win_amd64.pyd
                            • Size 222KB
                            • SHA256 df5ea1b515f4e6677196f3d8c2f40a00b008d8e09152d08425f794e1b55f890d
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            api-ms-win-core-console-l1-1-0.dll

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-console-l1-1-0.dll
                            • Size 21KB
                            • SHA256 88ace577a9c51061cb7d1a36babbbefa48212fadc838ffde98fdfff60de18386
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            api-ms-win-core-datetime-l1-1-0.dll

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-datetime-l1-1-0.dll
                            • Size 21KB
                            • SHA256 1bd81dfd19204b44662510d9054852fb77c9f25c1088d647881c9b976cc16818
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            api-ms-win-core-debug-l1-1-0.dll

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-debug-l1-1-0.dll
                            • Size 21KB
                            • SHA256 591358eb4d1531e9563ee0813e4301c552ce364c912ce684d16576eabf195dc3
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            api-ms-win-core-errorhandling-l1-1-0.dll

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-errorhandling-l1-1-0.dll
                            • Size 21KB
                            • SHA256 d56ce7b1cd76108ad6c137326ec694a14c99d48c3d7b0ace8c3ff4d9bcee3ce8
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            api-ms-win-core-fibers-l1-1-0.dll

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-fibers-l1-1-0.dll
                            • Size 21KB
                            • SHA256 91d249d7bc0e38ef6bcb17158b1fdc6dd8888dc086615c9b8b750b87e52a5fb3
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            api-ms-win-core-fibers-l1-1-1.dll

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-fibers-l1-1-1.dll
                            • Size 21KB
                            • SHA256 fc9d86cec621383eab636ebc87ddd3f5c19a3cb2a33d97be112c051d0b275429
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            api-ms-win-core-file-l1-1-0.dll

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-file-l1-1-0.dll
                            • Size 25KB
                            • SHA256 1ca895aba4e7435563a6b43e85eba67a0f8c74aa6a6a94d0fc48fa35535e2585
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            api-ms-win-core-file-l1-2-0.dll

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-file-l1-2-0.dll
                            • Size 21KB
                            • SHA256 4cadbc0c39da7c6722206fdcebd670abe5b8d261e7b041dd94f9397a89d1990d
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            api-ms-win-core-file-l2-1-0.dll

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-file-l2-1-0.dll
                            • Size 21KB
                            • SHA256 93c624b366ba16c643fc8933070a26f03b073ad0cf7f80173266d67536c61989
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            api-ms-win-core-handle-l1-1-0.dll

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-handle-l1-1-0.dll
                            • Size 21KB
                            • SHA256 39095f59c41d76ec81bb2723d646fde4c148e7cc3402f4980d2ade95cb9c84f9
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            api-ms-win-core-heap-l1-1-0.dll

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-heap-l1-1-0.dll
                            • Size 21KB
                            • SHA256 8f105771b236dbcb859de271f0a6822ce1cb79c36988dd42c9e3f6f55c5f7eb9
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            api-ms-win-core-interlocked-l1-1-0.dll

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-interlocked-l1-1-0.dll
                            • Size 21KB
                            • SHA256 53b25e753ca785bf8b695d89dde5818a318890211dc992a89146f16658f0b606
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            api-ms-win-core-kernel32-legacy-l1-1-1.dll

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-kernel32-legacy-l1-1-1.dll
                            • Size 21KB
                            • SHA256 a9b13a1cd1b8c19b0c6b4afcd5bb0dd29c0e2288231ac9e6db8510094ce68ba6
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            api-ms-win-core-libraryloader-l1-1-0.dll

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-libraryloader-l1-1-0.dll
                            • Size 21KB
                            • SHA256 7f39ba298b41e4963047341288cab36b6a241835ee11ba4ad70f44dacd40906c
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            api-ms-win-core-localization-l1-2-0.dll

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-localization-l1-2-0.dll
                            • Size 21KB
                            • SHA256 6ee44dd0d8510dc024c9f7c79b1b9fa88c987b26b6beb6653ddd11751c34e5dc
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            api-ms-win-core-memory-l1-1-0.dll

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-memory-l1-1-0.dll
                            • Size 21KB
                            • SHA256 0512a35316ec9180437f86696a84c5c06a7e4e82e050055a656e5bf9fca206f9
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            api-ms-win-core-namedpipe-l1-1-0.dll

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-namedpipe-l1-1-0.dll
                            • Size 21KB
                            • SHA256 c05f1fffe3b5a2738ea54ce9485cca026fb9635f982626fba1e1dcc531897273
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            api-ms-win-core-processenvironment-l1-1-0.dll

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-processenvironment-l1-1-0.dll
                            • Size 21KB
                            • SHA256 c4eca98c3c67b6395d5b005b00ac1eb0318b86b23aa71035a44c2b1602befba9
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            api-ms-win-core-processthreads-l1-1-0.dll

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-processthreads-l1-1-0.dll
                            • Size 21KB
                            • SHA256 5ccb89e93d67bc3288d4e84649c5346e66e15e3d7cd65d989daf3f4cb584be9a
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            api-ms-win-core-processthreads-l1-1-1.dll

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-processthreads-l1-1-1.dll
                            • Size 21KB
                            • SHA256 4ad565a8ba3ef0ea8ab87221ad11f83ee0bc844ce236607958406663b407333e
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            api-ms-win-core-profile-l1-1-0.dll

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\api-ms-win-core-profile-l1-1-0.dll
                            • Size 21KB
                            • SHA256 7809160932f44e59b021699f5bc68799eb7293ee1fa926d6fcca3c3445302e61
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            base_library.zip

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\base_library.zip
                            • Size 1.3MB
                            • SHA256 45e0d14fb2d34acd7ab4dc41f8c31ad64ef32d3f806ec74f168005573c1df4b1
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            cd.cp312-win_amd64.pyd

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\charset_normalizer\cd.cp312-win_amd64.pyd
                            • Size 10KB
                            • SHA256 be1d8801c9785a52e5bc1b0c77ceca2c88041a5d9b9bac7162d767f712ea10e3
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            INSTALLER

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\ifaddr-0.2.0.dist-info\INSTALLER
                            • Size 4B
                            • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
                            • MD5 SHA1 SHA512

                            urls.pyi

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\django-stubs\django-stubs\contrib\flatpages\urls.pyi
                            • Size 59B
                            • SHA256 a0869d2c9451a944b87f059edc5d93c1d415888b98b9247b8aeb5489d9dcba7d
                            • MD5 SHA1 SHA512 TLSH

                            filebased.pyi

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\django-stubs\django-stubs\core\mail\backends\filebased.pyi
                            • Size 103B
                            • SHA256 ae9de027f591acfedc0ba387099c4398c0841a9c126535d313ffbdb18184eea0
                            • MD5 SHA1 SHA512 TLSH

                            testserver.pyi

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\django-stubs\django-stubs\core\management\commands\testserver.pyi
                            • Size 85B
                            • SHA256 1a4fa10dd76be871ebe4f02bc9ccf70eaa1e178efa5291aa6aff471a9fcdb272
                            • MD5 SHA1 SHA512 TLSH

                            creation.pyi

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\django-stubs\django-stubs\db\backends\postgresql\creation.pyi
                            • Size 117B
                            • SHA256 7e724b81758b570f4c0db90f33f3eb96008d784a2fc911566a1982a661ad2fd0
                            • MD5 SHA1 SHA512 TLSH

                            operations.pyi

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\django-stubs\django-stubs\db\backends\postgresql\operations.pyi
                            • Size 125B
                            • SHA256 f25e08acd46b419264f8b2db1f7cc65aa8294e6057036fab52c3fbe8682963f6
                            • MD5 SHA1 SHA512 TLSH

                            cp1026.pyi

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stdlib\encodings\cp1026.pyi
                            • Size 730B
                            • SHA256 08663c54b1b600c85ea305e6103d01bb350ae41c9f0cd52b264a3650974551be
                            • MD5 SHA1 SHA512 TLSH

                            cp737.pyi

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stdlib\encodings\cp737.pyi
                            • Size 733B
                            • SHA256 22e29100d1453aa2195b8ae046ded4aa77761f1c9e82d60ab983b055b451f606
                            • MD5 SHA1 SHA512 TLSH

                            cp932.pyi

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stdlib\encodings\cp932.pyi
                            • Size 920B
                            • SHA256 9564886ba7353ce6726f0857c0d39e4e6c3996d26215389ec32185aab054dfe5
                            • MD5 SHA1 SHA512 TLSH

                            __init__.pyi

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\aws-xray-sdk\aws_xray_sdk\ext\httpx\__init__.pyi
                            • Size 55B
                            • SHA256 d3b7520fe93d3fc021e4c0c938c23dd6c42c56f9d6caa17826c054bd2c0bb018
                            • MD5 SHA1 SHA512 TLSH

                            patch.pyi

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\aws-xray-sdk\aws_xray_sdk\ext\pg8000\patch.pyi
                            • Size 52B
                            • SHA256 caa04f4116d57cba6b439bf3c128ab019de1c49aef89632d81c70e464babc33a
                            • MD5 SHA1 SHA512

                            patch.pyi

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\aws-xray-sdk\aws_xray_sdk\ext\psycopg\patch.pyi
                            • Size 25B
                            • SHA256 9dd03142ef8ea162b2dc2cee6d01577c7e9b25eb176dea913d1808dfb52beabb
                            • MD5 SHA1 SHA512

                            __init__.pyi

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\aws-xray-sdk\aws_xray_sdk\ext\sqlalchemy_core\__init__.pyi
                            • Size 86B
                            • SHA256 e4a70cfc5c6ccdeaf213ed803b109ba89f07a61635ec8483b6f697e6c2b54ed4
                            • MD5 SHA1 SHA512 TLSH

                            fasttext.pyi

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\dateparser\dateparser\custom_language_detection\fasttext.pyi
                            • Size 79B
                            • SHA256 a693bbab260ed91dea09f7b2b2e808fd842f1a3ad05797d4015cbd0a9b05f69f
                            • MD5 SHA1 SHA512 TLSH

                            version.pyi

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\docker\docker\version.pyi
                            • Size 17B
                            • SHA256 636e67e38a72137be9f763220012ab70adc8591c90d491b5ad9e147eacb69c2d
                            • MD5 SHA1 SHA512

                            ar.pyi

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\docutils\docutils\languages\ar.pyi
                            • Size 182B
                            • SHA256 091a29a1e46d4d88e274821a968102ab37091f5e19de942c07764a40260a3744
                            • MD5 SHA1 SHA512 TLSH

                            cs.pyi

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\docutils\docutils\languages\cs.pyi
                            • Size 180B
                            • SHA256 e8750bad8cd7bb1eefc49bf468ce786c1eb3c62ff4fa9a6a15b74a453f9d4d47
                            • MD5 SHA1 SHA512 TLSH

                            zh_cn.pyi

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\docutils\docutils\languages\zh_cn.pyi
                            • Size 157B
                            • SHA256 cb00d32f278275452988bf2aafc3cc7ece5075b9940cedf26fc6a0d383fb1996
                            • MD5 SHA1 SHA512 TLSH

                            ca.pyi

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\docutils\docutils\parsers\rst\languages\ca.pyi
                            • Size 117B
                            • SHA256 7dd28eca78db7632bd9dc70a8c31e555699fad5332a04e51f5cabe4f5b51c97d
                            • MD5 SHA1 SHA512 TLSH

                            __init__.pyi

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\gevent\gevent\libev\__init__.pyi
                            • Size 24B
                            • SHA256 8eea9df4f6d7b38ca0e39ccc27b04700e3d08dbeec8046d613d22706d19985fa
                            • MD5 SHA1 SHA512

                            lua53.pyi

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\lupa\lupa\lua53.pyi
                            • Size 3KB
                            • SHA256 71b5af692107be0868cd47af49779406b579e82c384648ad82d113c9469be167
                            • MD5 SHA1 SHA512 TLSH

                            luajit20.pyi

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\lupa\lupa\luajit20.pyi
                            • Size 3KB
                            • SHA256 2621a362ed4303e45a76a1492a3a0d7ed98fefc6b5d369df67a300d3e170b1a3
                            • MD5 SHA1 SHA512 TLSH

                            version.pyi

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\lupa\lupa\version.pyi
                            • Size 50B
                            • SHA256 1bc0f1ada46ee63106faf7b4ea6b29f57a07a90c2d9c512356d0922deeef693c
                            • MD5 SHA1 SHA512 TLSH

                            SimpleHTTPServer.pyi

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\six\six\moves\SimpleHTTPServer.pyi
                            • Size 26B
                            • SHA256 bed05425469b4eb2152bdec29f43212d48474a56e61c1f10810956c1a747fbac
                            • MD5 SHA1 SHA512

                            _dummy_thread.pyi

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\six\six\moves\_dummy_thread.pyi
                            • Size 22B
                            • SHA256 027dc4b3528f32d138ec62be1ca57f5a7b86ee47e84f96e1f9b9ff49f390e4f7
                            • MD5 SHA1 SHA512

                            tkinter_filedialog.pyi

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\six\six\moves\tkinter_filedialog.pyi
                            • Size 33B
                            • SHA256 ce71ee5aab9b3305e238d58fd5b84d4660175157077579fd07c02aa09bb81206
                            • MD5 SHA1 SHA512

                            __init__.pyi

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\tensorflow\tensorflow\python\keras\__init__.pyi
                            • Size 53B
                            • SHA256 85c7c729385046289b3971a73de1141ee9ebb6f88c768ae3d0cb5d9c8c0bb65f
                            • MD5 SHA1 SHA512 TLSH

                            libffi-8.dll

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\libffi-8.dll
                            • Size 38KB
                            • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            grammar313.txt

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\parso\python\grammar313.txt
                            • Size 7KB
                            • SHA256 a33fbb9f58d463c8213e8784dc033d8a9355fddae2dc135f10f87c1e6b968cc5
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            grammar39.txt

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\parso\python\grammar39.txt
                            • Size 7KB
                            • SHA256 715ad56c5f4f8395092c58b6b6f2deb4f906f81380929a836bd86ab253634875
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            WHEEL

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\pmd_pytcp-0.3.0.dist-info\WHEEL
                            • Size 91B
                            • SHA256 2b6eb4118ce7cd7b09601406aa623c553c4476265836f0d9c16f5c061f7efcc0
                            • MD5 SHA1 SHA512 TLSH

                            LICENSE

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\pmd_pytcp-0.3.0.dist-info\licenses\LICENSE
                            • Size 31KB
                            • SHA256 af85d629f041f624f69ad1d22b6cc16a4c521b97e63df64d293eeba8fa2c0421
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            element_clear.js

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\pymobiledevice3\resources\webinspector\element_clear.js
                            • Size 1KB
                            • SHA256 1fb4afc2ba857ea623329f375206c0d68be02455723922f4b0334e1fc6fe17da
                            • MD5 SHA1 SHA512 TLSH

                            python3.dll

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\python3.dll
                            • Size 68KB
                            • SHA256 fb975a606e7fbf74f64260e3f60c3490b4f74a183c0926fd6ed1ac4c52ac7b1c
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            python312.dll

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\python312.dll
                            • Size 6.6MB
                            • SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Asmera

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Africa\Asmera
                            • Size 191B
                            • SHA256 0783854f52c33ada6b6d2a5d867662f0ae8e15238d2fce7b9ada4f4d319eb466
                            • MD5 SHA1 SHA512 TLSH

                            Bamako

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Africa\Bamako
                            • Size 130B
                            • SHA256 f3e7fcaa0e9840ff4169d3567d8fb5926644848f4963d7acf92320843c5d486e
                            • MD5 SHA1 SHA512 TLSH

                            Cairo

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Africa\Cairo
                            • Size 1KB
                            • SHA256 89cb9a36212fb82e933dcd9faa10efdfa969a29ec80c32063bbb4518c033d1be
                            • MD5 SHA1 SHA512 TLSH

                            Douala

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Africa\Douala
                            • Size 180B
                            • SHA256 e5ef1288571cc56c5276ca966e1c8a675c6747726d758ecafe7effce6eca7be4
                            • MD5 SHA1 SHA512 TLSH

                            Gaborone

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Africa\Gaborone
                            • Size 131B
                            • SHA256 910c97c091cd34ae7427c83226234ce7b4f2f425c5822d6669c24be62010a792
                            • MD5 SHA1 SHA512 TLSH

                            Mbabane

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Africa\Mbabane
                            • Size 190B
                            • SHA256 d19aebe2435c4e84bf7ae65533d23a9d440f98162e5b4d69c73f783e02299ec8
                            • MD5 SHA1 SHA512 TLSH

                            Tripoli

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Africa\Tripoli
                            • Size 431B
                            • SHA256 cf33012d9661e15438fc045ee64e0bfebb2ea8a3fb79d2af56df05ea4be3e453
                            • MD5 SHA1 SHA512 TLSH

                            Anchorage

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Anchorage
                            • Size 977B
                            • SHA256 77ca0c22962f06998bce5e48d81cb865a14466c83ff5dc607eaa483344058bf6
                            • MD5 SHA1 SHA512 TLSH

                            Buenos_Aires

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Argentina\Buenos_Aires
                            • Size 708B
                            • SHA256 20454ea527c8ea888926614d21bf556f46ce38c220c4ee5b821170eef9071469
                            • MD5 SHA1 SHA512 TLSH

                            Jujuy

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Argentina\Jujuy
                            • Size 690B
                            • SHA256 ed8a6339c99568a2a98aadf5ad07bc4d30cd131747f638d922175c66ff928548
                            • MD5 SHA1 SHA512 TLSH

                            Mendoza

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Argentina\Mendoza
                            • Size 708B
                            • SHA256 74be2ad33818d8528f6c6f1c0be5a49e7a69f2d17663b496816482fc6fd6ce72
                            • MD5 SHA1 SHA512 TLSH

                            Aruba

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Aruba
                            • Size 177B
                            • SHA256 abbe8628dd5487c889db816ce3a5077bbb47f6bafafeb9411d92d6ef2f70ce8d
                            • MD5 SHA1 SHA512 TLSH

                            Catamarca

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Catamarca
                            • Size 708B
                            • SHA256 502d1fc71ed93e68cfc370f404afb9bdaa7e735701cdb811dbddcc76611f3b1d
                            • MD5 SHA1 SHA512 TLSH

                            Coral_Harbour

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Coral_Harbour
                            • Size 149B
                            • SHA256 a78d73067ba3cbd94f8a23dfdd6aa8b68cb33b18484bc17b4e20ea1aec2f0a81
                            • MD5 SHA1 SHA512 TLSH

                            Detroit

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Detroit
                            • Size 899B
                            • SHA256 23817c32df67c77f0017a0feb2d798b2405afc71ceea3294d7e5b4c9116be740
                            • MD5 SHA1 SHA512 TLSH

                            Godthab

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Godthab
                            • Size 965B
                            • SHA256 2e5199e58fee77d270591be77079d41d102b41b6e735c9a6af3dddb8c851dc77
                            • MD5 SHA1 SHA512 TLSH

                            Halifax

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Halifax
                            • Size 1KB
                            • SHA256 90ee5a841336a132df592e0a5f5e456ca5dfa39c20f9ff6fc35fe130e2121a28
                            • MD5 SHA1 SHA512 TLSH

                            Havana

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Havana
                            • Size 1KB
                            • SHA256 9ace6b0aeab6c81338f55993ca632d15037773968137596477c8e3cca767366f
                            • MD5 SHA1 SHA512 TLSH

                            Indianapolis

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Indianapolis
                            • Size 531B
                            • SHA256 e678f42a13efbd7be0f26a9ce53e04b1c28a582eab05611cb01c16836432f07b
                            • MD5 SHA1 SHA512 TLSH

                            Iqaluit

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Iqaluit
                            • Size 855B
                            • SHA256 9ce352ef392c1874eb6c4263ef72d84595bdeb83a7710ba3fd5e9f363a43a10d
                            • MD5 SHA1 SHA512 TLSH

                            Jamaica

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Jamaica
                            • Size 339B
                            • SHA256 a437b1700333aeff53a8b5868d5387c080dc14c2d3e95aa5ce36f901b3669284
                            • MD5 SHA1 SHA512 TLSH

                            Louisville

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Kentucky\Louisville
                            • Size 1KB
                            • SHA256 cd2d924b9ef70fd4e6419156b52c9121537765754dff61695416eda9014ccca5
                            • MD5 SHA1 SHA512 TLSH

                            Manaus

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Manaus
                            • Size 412B
                            • SHA256 f6482b869af207de18395a2c8499628a20d27fd9b08dbdce6705f41eeb0d46b9
                            • MD5 SHA1 SHA512 TLSH

                            Mazatlan

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Mazatlan
                            • Size 690B
                            • SHA256 20dede710f520eaf6c0cdbeefe773fc6e30dd8b1d28aaf17e9842099551ee9a6
                            • MD5 SHA1 SHA512 TLSH

                            Mexico_City

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Mexico_City
                            • Size 773B
                            • SHA256 37dd2bf08f13fce0f707c3b1f4cec4018efbd9c47c8367b0fb4debbd461bd72f
                            • MD5 SHA1 SHA512 TLSH

                            Nipigon

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Nipigon
                            • Size 1KB
                            • SHA256 815ab4db7a1b1292867d2f924b718e1bba32455ce9f92205db2feb65029c6761
                            • MD5 SHA1 SHA512 TLSH

                            Noronha

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Noronha
                            • Size 484B
                            • SHA256 434af71ad039cb644690e8f9e8e4d91b9b6e072d41ea47db872ac9a8281fdbb8
                            • MD5 SHA1 SHA512 TLSH

                            Regina

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Regina
                            • Size 638B
                            • SHA256 fc91ee9ecdb6e6213e4c773d345a7e441ab83d650b02e1b0d8e2dba4e07f50cc
                            • MD5 SHA1 SHA512 TLSH

                            Rosario

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Rosario
                            • Size 708B
                            • SHA256 f488f75a34fd99630a438dcb792508a90b836fdcd2dc54a51d83d535025315fd
                            • MD5 SHA1 SHA512 TLSH

                            Santiago

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Santiago
                            • Size 1KB
                            • SHA256 fd006953c2b442a2e1e66db2a967dd932a4824390f01cddd9c801ce63450c715
                            • MD5 SHA1 SHA512 TLSH

                            Sao_Paulo

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Sao_Paulo
                            • Size 952B
                            • SHA256 fa2ceb222f065c0289f3997ff0c54ba05a74a599b4522870fa86a96e24e18891
                            • MD5 SHA1 SHA512 TLSH

                            St_Johns

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\St_Johns
                            • Size 1KB
                            • SHA256 bfdf6afc014c3e597930cc4ca7df1aa98e347268acdb07224df4eab36fe46f49
                            • MD5 SHA1 SHA512 TLSH

                            Tijuana

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Tijuana
                            • Size 1KB
                            • SHA256 af9aea4aee505143fa5e847643c0ffe164190c38411010ac7f0b170f4098a6c8
                            • MD5 SHA1 SHA512 TLSH

                            Vancouver

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Vancouver
                            • Size 1KB
                            • SHA256 7d23681b36849ac7f50537b9c02bd8d3aa000b98bd3d1825ce85e7ea3e5534c9
                            • MD5 SHA1 SHA512 TLSH

                            Whitehorse

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Whitehorse
                            • Size 1KB
                            • SHA256 0b26388cd7747f335275fd4795819f6a4b40a661fbd6d44d465a4e10edf60c6b
                            • MD5 SHA1 SHA512 TLSH

                            Ashgabat

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Ashgabat
                            • Size 375B
                            • SHA256 3932c7750f2314f0efc6efc8c0a5ff7375b78dd37a7bb146a0248411bd172aec
                            • MD5 SHA1 SHA512 TLSH

                            Bahrain

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Bahrain
                            • Size 152B
                            • SHA256 6160d6575a371c75b19e6c25cf03160b9dc2f386583e42bf8189fdf8fd17c785
                            • MD5 SHA1 SHA512 TLSH

                            Brunei

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Brunei
                            • Size 320B
                            • SHA256 dda8e0208df167e59cf9da9745348cc3ca904434a35e5481231c84fec0d11939
                            • MD5 SHA1 SHA512 TLSH

                            Calcutta

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Calcutta
                            • Size 220B
                            • SHA256 3a00bdbe1bc4959e727567c730ba51b03455ecd455f7c190c5ad14386eb79b0d
                            • MD5 SHA1 SHA512 TLSH

                            Dacca

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Dacca
                            • Size 231B
                            • SHA256 ac21a61306d6e2a91453641f4e3e732ebc9d542abc1d35a5d5db2a10340ebefa
                            • MD5 SHA1 SHA512 TLSH

                            Harbin

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Harbin
                            • Size 393B
                            • SHA256 bf8b7ed82fe6e63e6d98f8cea934eeac901cd16aba85eb5755ce3f8b4289ea8a
                            • MD5 SHA1 SHA512 TLSH

                            Ho_Chi_Minh

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Ho_Chi_Minh
                            • Size 232B
                            • SHA256 0d6e76fb941d0540214ee81f161f449c6a7dc3d515e5654618a7ae42d0acd1e1
                            • MD5 SHA1 SHA512 TLSH

                            Hong_Kong

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Hong_Kong
                            • Size 775B
                            • SHA256 f4068f73246db97417f73467453564c57d6646ce4909b9fa2536923efcd7eb4f
                            • MD5 SHA1 SHA512 TLSH

                            Kashgar

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Kashgar
                            • Size 133B
                            • SHA256 849cafd377611cc2fc2b41891ab63c6fb3343949045db961fd16267593315ad4
                            • MD5 SHA1 SHA512 TLSH

                            Kathmandu

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Kathmandu
                            • Size 161B
                            • SHA256 76b8f1bfe072231a1d9e7f8501310e27c0d08048c48f7422860b6477c142c438
                            • MD5 SHA1 SHA512 TLSH

                            Kuwait

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Kuwait
                            • Size 133B
                            • SHA256 46853e94276af2eea8e86c2f152a871c092df195dc51273b8fc7091faa4b461c
                            • MD5 SHA1 SHA512 TLSH

                            Macao

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Macao
                            • Size 791B
                            • SHA256 9abf3d8bfc293285a102da99ac5d9219ca082dc530eab62b0e42143400deb3b1
                            • MD5 SHA1 SHA512 TLSH

                            Makassar

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Makassar
                            • Size 190B
                            • SHA256 355f63fd14ee894e3b9af26f7ca13c75a5c7e4015827c2a2e20bc70494b1c8b7
                            • MD5 SHA1 SHA512 TLSH

                            Nicosia

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Nicosia
                            • Size 597B
                            • SHA256 4d862a5a9f2c2b40300541c0a74c2eba2859b90d7d45776ddbc6ed877df33812
                            • MD5 SHA1 SHA512 TLSH

                            Seoul

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Seoul
                            • Size 415B
                            • SHA256 64a70b6fbcc9b65e762dbd25eb89b6f40c137146edc8dbd4d081eafacdab78de
                            • MD5 SHA1 SHA512 TLSH

                            Taipei

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Taipei
                            • Size 511B
                            • SHA256 a04c2c72f4f76a83178d036dd97d157ee1f32e478e44dda7a5c10923687ee6cf
                            • MD5 SHA1 SHA512 TLSH

                            Tehran

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Tehran
                            • Size 812B
                            • SHA256 65ac5ec01f3721d608195a49bdca7c7accb3de27df020c44cec8fb70cada4377
                            • MD5 SHA1 SHA512 TLSH

                            Thimbu

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Thimbu
                            • Size 154B
                            • SHA256 37a77fbdf16f60e45f327af57c7263612b780c139149b2e2ff64feaf67490672
                            • MD5 SHA1 SHA512 TLSH

                            Tokyo

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Tokyo
                            • Size 213B
                            • SHA256 59a3871430f0d3b93e619fa30a43a41d1e88bdd49ff26f09d0f405a500706f96
                            • MD5 SHA1 SHA512 TLSH

                            Ulan_Bator

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Ulan_Bator
                            • Size 594B
                            • SHA256 fbe23c3fafdee01b5121edf009290fb701cebbf93dacfb30f8aa90287242f6f3
                            • MD5 SHA1 SHA512 TLSH

                            Vientiane

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Vientiane
                            • Size 152B
                            • SHA256 cdc8e2c282d8bc9a5e9c3caf2fc45ff4e9e5cd18f5dec8cb873340ad7c584d64
                            • MD5 SHA1 SHA512 TLSH

                            Faeroe

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Atlantic\Faeroe
                            • Size 441B
                            • SHA256 230d2a074981baf887e70dd0cbc8dac4239eb34ed91e1db0916f0c3d4589aa3d
                            • MD5 SHA1 SHA512 TLSH

                            Adelaide

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Australia\Adelaide
                            • Size 921B
                            • SHA256 1a4d52746455981db7dc8f961135c0302673ecbec7573a0de1a52821c80daf78
                            • MD5 SHA1 SHA512 TLSH

                            Brisbane

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Australia\Brisbane
                            • Size 289B
                            • SHA256 da4556cfd088feab5f75be7983488be7d814042ee59cedc651a948431b470036
                            • MD5 SHA1 SHA512 TLSH

                            Broken_Hill

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Australia\Broken_Hill
                            • Size 941B
                            • SHA256 77393d2ef180ff1452b670088c016e4c9f14c33feceea1961909a25cf803b0b6
                            • MD5 SHA1 SHA512 TLSH

                            Darwin

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Australia\Darwin
                            • Size 234B
                            • SHA256 6687b16e181d52557895e57e76106ee80c43564272e37c6b3dbf5443711009d2
                            • MD5 SHA1 SHA512 TLSH

                            LHI

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Australia\LHI
                            • Size 692B
                            • SHA256 f368bd25659c0293d02bb79ec7dac7d5b73a92dffafce14b4dd2ffb8ba11aada
                            • MD5 SHA1 SHA512 TLSH

                            Melbourne

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Australia\Melbourne
                            • Size 904B
                            • SHA256 5fb24f3048ff4985b27e0585324a7a14e993e867f28d1fa517d8451a04dabe71
                            • MD5 SHA1 SHA512 TLSH

                            NSW

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Australia\NSW
                            • Size 904B
                            • SHA256 820d45a868a88f81c731d5b2c758b4ed000039b6260a80433f8e0f094a604b59
                            • MD5 SHA1 SHA512 TLSH

                            Perth

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Australia\Perth
                            • Size 306B
                            • SHA256 66cb9e95c042d587d6ba01f60ab94e5d07120c3e20194242a1b0755be6aea47a
                            • MD5 SHA1 SHA512 TLSH

                            Tasmania

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Australia\Tasmania
                            • Size 1003B
                            • SHA256 d4801581fd00037b013d71616b119fbbd510fdca5de06369b10f718a8da5e32d
                            • MD5 SHA1 SHA512 TLSH

                            Acre

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Brazil\Acre
                            • Size 418B
                            • SHA256 563b9052bebaf2986ae5b707e34afde013e7641287cc97ff31005f33a0dbf7a5
                            • MD5 SHA1 SHA512 TLSH

                            Central

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Canada\Central
                            • Size 1KB
                            • SHA256 00dcf0606054d4f927416e0b47e1fdda2e5ce036fde4b53e51084f8566428c3a
                            • MD5 SHA1 SHA512 TLSH

                            Mountain

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Canada\Mountain
                            • Size 1KB
                            • SHA256 d52173b56a28205d8d6f792bcfa8bc07614ee0d269f7bf6e43ec91f68d410600
                            • MD5 SHA1 SHA512 TLSH

                            EasterIsland

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Chile\EasterIsland
                            • Size 1KB
                            • SHA256 13054cef85e3b1ba0f5712bd6d699d7789d3aedbdab0fd7394b771acc07f61a1
                            • MD5 SHA1 SHA512 TLSH

                            EET

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\EET
                            • Size 682B
                            • SHA256 f1fd678b0548e329b38934f6281255e698dfa761ad1ff841f6ccb79606c61345
                            • MD5 SHA1 SHA512 TLSH

                            Eire

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Eire
                            • Size 1KB
                            • SHA256 11c00336e02f1318fe764ab29467c5f2afefbfffa644fa8dd24f5b083b495b71
                            • MD5 SHA1 SHA512 TLSH

                            GMT-0

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Etc\GMT-0
                            • Size 111B
                            • SHA256 dc4a07571b10884e4f4f3450c9d1a1cbf4c03ef53d06ed2e4ea152d9eba5d5d7
                            • MD5 SHA1 SHA512

                            Universal

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Etc\Universal
                            • Size 111B
                            • SHA256 fddce1e648a1732ac29afd9a16151b2973cdf082e7ec0c690f7e42be6b598b93
                            • MD5 SHA1 SHA512

                            Berlin

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Berlin
                            • Size 705B
                            • SHA256 a7fd9932d785d4d690900b834c3563c1810c1cf2e01711bcc0926af6c0767cb7
                            • MD5 SHA1 SHA512 TLSH

                            Bratislava

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Bratislava
                            • Size 723B
                            • SHA256 a6e930e3375cdcb51f7d8a74885aff89fd14b861ebb75cb339d0f91c16c1469a
                            • MD5 SHA1 SHA512 TLSH

                            Brussels

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Brussels
                            • Size 1KB
                            • SHA256 b10f9542a8509f0a63ebca78e3d80432dd86b8ea296400280febd9cfa76e8288
                            • MD5 SHA1 SHA512 TLSH

                            Chisinau

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Chisinau
                            • Size 1KB
                            • SHA256 439e1ca44e245387148c1141d7d7c5e84bcca73188ff85351a126c8deea0e12e
                            • MD5 SHA1 SHA512 TLSH

                            Helsinki

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Helsinki
                            • Size 481B
                            • SHA256 71ca4af5998f09990c5e875d350fc3c8e34f280bae6fe14f36d4692face7a563
                            • MD5 SHA1 SHA512 TLSH

                            Isle_of_Man

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Isle_of_Man
                            • Size 1KB
                            • SHA256 676541f0b8ad457c744c093f807589adcad909e3fd03f901787d08786eedbd33
                            • MD5 SHA1 SHA512 TLSH

                            Monaco

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Monaco
                            • Size 1KB
                            • SHA256 cd588e779c5737d70e4e47158dafab7945b026b2bb34454cc47741815459b068
                            • MD5 SHA1 SHA512 TLSH

                            Moscow

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Moscow
                            • Size 908B
                            • SHA256 ed2e0a099fb446b2416683438d3f56f9fc5a62a16c7549a7f59cbc935b364c8a
                            • MD5 SHA1 SHA512 TLSH

                            Podgorica

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Podgorica
                            • Size 478B
                            • SHA256 a8c964f3eaa7a209d9a650fb16c68c003e9a5fc62ffbbb10fa849d54fb3662d6
                            • MD5 SHA1 SHA512 TLSH

                            Uzhgorod

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Uzhgorod
                            • Size 558B
                            • SHA256 0589e80ddecebf9d3077898c12975d2be7393df2856ee9926c534763e1e26bf2
                            • MD5 SHA1 SHA512 TLSH

                            Vatican

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Vatican
                            • Size 947B
                            • SHA256 86bd26a06fe3057b36cf29dd7a338f2524aff8116ef08d005aa2114ea6122869
                            • MD5 SHA1 SHA512 TLSH

                            Warsaw

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Warsaw
                            • Size 923B
                            • SHA256 e88f5a51f168157a41ac2dd8a4ee0e9a879419c84c6122b4771b1a2a33d93a4c
                            • MD5 SHA1 SHA512 TLSH

                            Zurich

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Zurich
                            • Size 497B
                            • SHA256 199062b1c30cfeb2375ec84c56df52be51891986a6293b7a124d3a62509f45e9
                            • MD5 SHA1 SHA512 TLSH

                            Cocos

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Indian\Cocos
                            • Size 187B
                            • SHA256 e89d835c811d4da44aa8b386782ce8828df085aa0ee8f25661a9881d2f00e90c
                            • MD5 SHA1 SHA512 TLSH

                            Kerguelen

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Indian\Kerguelen
                            • Size 152B
                            • SHA256 94485f0f58f842767ec2db93539d5fc3afb2bdce16673d9e63c0988cccd6438e
                            • MD5 SHA1 SHA512 TLSH

                            Mahe

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Indian\Mahe
                            • Size 133B
                            • SHA256 0d9ea5053e83188032a6fb4d301d5db688f43011e5b6b1f917a11b71a0da7b16
                            • MD5 SHA1 SHA512 TLSH

                            Israel

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Israel
                            • Size 1KB
                            • SHA256 9fcde8d584dea0585f5c8727aaf35f48a149e0dbd3a83bf6cef8bca9c14021e3
                            • MD5 SHA1 SHA512 TLSH

                            Kwajalein

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Kwajalein
                            • Size 219B
                            • SHA256 4be6458ba89d2b30da7a52f2ec346318f783d2cee856e777c4b33164a365064f
                            • MD5 SHA1 SHA512 TLSH

                            MST

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\MST
                            • Size 240B
                            • SHA256 ae11453c21d08984de75f2efec04dc93178a7b4e23c5e52f2098b8bd45ccb547
                            • MD5 SHA1 SHA512 TLSH

                            MST7MDT

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\MST7MDT
                            • Size 1KB
                            • SHA256 9bb703920eca4b6119e81a105583a4f6ca220651f13b418479ab7cd56c413f3e
                            • MD5 SHA1 SHA512 TLSH

                            NZ

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\NZ
                            • Size 1KB
                            • SHA256 0e06e7e55aedbc92ef5b3d106e7c392ab1628cfd8a428b20e92e99028a0bfbb9
                            • MD5 SHA1 SHA512 TLSH

                            NZ-CHAT

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\NZ-CHAT
                            • Size 808B
                            • SHA256 a67858fcb6fc5787a8e9c2b7c8be8964bd3ce9223f7ad1baac2c9ca6925f4c78
                            • MD5 SHA1 SHA512 TLSH

                            Enderbury

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Pacific\Enderbury
                            • Size 172B
                            • SHA256 a23386fa8aa2db91ce9d8e811616afff76e65a0d4b0c82d3e2ffa4c4e155baa2
                            • MD5 SHA1 SHA512 TLSH

                            Guam

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Pacific\Guam
                            • Size 350B
                            • SHA256 8b9ede33ab32ae2505bc06eb5402e7ce20b0fc8e2510dcb305c25d39a1fbd725
                            • MD5 SHA1 SHA512 TLSH

                            Johnston

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Pacific\Johnston
                            • Size 221B
                            • SHA256 1daa5729aa1e0f32cd44be112d01ad4cc567a9fe76d87dcbb9182be8d2c88ff0
                            • MD5 SHA1 SHA512 TLSH

                            Ponape

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Pacific\Ponape
                            • Size 134B
                            • SHA256 522f0f374b61e2c6f5fa7d19f1c7acccd09e4a213462ee3b42c90d32bf2bf18c
                            • MD5 SHA1 SHA512 TLSH

                            Port_Moresby

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Pacific\Port_Moresby
                            • Size 154B
                            • SHA256 683001055b6ef9dc9d88734e0eddd1782f1c3643b7c13a75e9cf8e9052006e19
                            • MD5 SHA1 SHA512 TLSH

                            Samoa

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Pacific\Samoa
                            • Size 146B
                            • SHA256 650d918751366590553063cd681592fdca8a09957e0ce2c18d6697ec385ef796
                            • MD5 SHA1 SHA512 TLSH

                            Tarawa

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Pacific\Tarawa
                            • Size 134B
                            • SHA256 09035620bd831697a3e9072f82de34cfca5e912d50c8da547739aa2f28fb6d8e
                            • MD5 SHA1 SHA512 TLSH

                            Singapore

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Singapore
                            • Size 256B
                            • SHA256 0954b2d9a301d94f4348024606a71bbcb2fa24d3cd3709f5bc8bca605039785d
                            • MD5 SHA1 SHA512 TLSH

                            Turkey

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Turkey
                            • Size 1KB
                            • SHA256 2a7163b16b94806f69991348e7d0a60c46eb61b1f0305f5f4b83f613db10806f
                            • MD5 SHA1 SHA512 TLSH

                            Aleutian

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\US\Aleutian
                            • Size 969B
                            • SHA256 abfb1980e20d5f84ec5fd881c7580d77a5c6c019f30a383aaa97404212b489e0
                            • MD5 SHA1 SHA512 TLSH

                            Central

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\US\Central
                            • Size 1KB
                            • SHA256 c27b739ff46a7df0594e120d725b439217e11e44ea9a50cdc49130383b5482e7
                            • MD5 SHA1 SHA512 TLSH

                            Eastern

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\US\Eastern
                            • Size 1KB
                            • SHA256 d7f2206b3a45989fc9ad63d558922532fa7352280d5f87176bf1db79cb1d1fa9
                            • MD5 SHA1 SHA512 TLSH

                            Indiana-Starke

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\US\Indiana-Starke
                            • Size 1016B
                            • SHA256 2890b35dcb7c093308b552d82d8781a8ce9a4fa6f9de058283a6836ec1f9f282
                            • MD5 SHA1 SHA512 TLSH

                            Pacific

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\US\Pacific
                            • Size 1KB
                            • SHA256 200d05754f6d83a371cf408d7085125797657b3b0bebeba1e508cffe86a3e5c8
                            • MD5 SHA1 SHA512 TLSH

                            WET

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\WET
                            • Size 1KB
                            • SHA256 44d2f6cf84737e6a1e0daf914109e94256beca40b40c9a11b7a04e8bddaee4ec
                            • MD5 SHA1 SHA512 TLSH

                            ucrtbase.dll

                            • Path C:\Program Files\Ghostly\ghosty-iosd\_internal\ucrtbase.dll
                            • Size 1.3MB
                            • SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            ghosty-iosd.exe

                            • Path C:\Program Files\Ghostly\ghosty-iosd\ghosty-iosd.exe
                            • Size 16.8MB
                            • SHA256 3d954a278729d3205b50a8721345ffa4f49ada301705d22a1338dfdc8b966605
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            ghosty.exe

                            • Path C:\Program Files\Ghostly\ghosty.exe
                            • Size 7.2MB
                            • SHA256 02dcca2962251b32b1e2a5a227cb9a1efc52a4ef3f288a1e6c439b9670e6a3e7
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            modern-header.bmp

                            • Path C:\Users\Admin\AppData\Local\Temp\nsl6A0D.tmp\modern-header.bmp
                            • Size 25KB
                            • SHA256 8f9a1d9f07f59520abde541066983cfaef91c745070be879659abcf1f04c94f1
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            System.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\nsn2661.tmp\System.dll
                            • Size 12KB
                            • SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            modern-wizard.bmp

                            • Path C:\Users\Admin\AppData\Local\Temp\nsn2661.tmp\modern-wizard.bmp
                            • Size 150KB
                            • SHA256 084dec4fa7121522b5cfa4f0e173dfc32d7fc0f064ba3840fd8af51e52a883bd
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            nsDialogs.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\nsn2661.tmp\nsDialogs.dll
                            • Size 9KB
                            • SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            nsExec.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\nsn2661.tmp\nsExec.dll
                            • Size 7KB
                            • SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            nsis_tauri_utils.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\nsn2661.tmp\nsis_tauri_utils.dll
                            • Size 33KB
                            • SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            settings.dat

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Crashpad\settings.dat
                            • Size 280B
                            • SHA256 0dfa66f609fb0c3115a9b4be5c09f2536dff65a534246cf3a77c3f63b6641405
                            • MD5 SHA1 SHA512

                            settings.dat

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Crashpad\settings.dat
                            • Size 280B
                            • SHA256 29d7c2e711403bbcbda53a31db80bb958aeee7d79d07ceb9140d58501ededf2c
                            • MD5 SHA1 SHA512 TLSH

                            settings.dat

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Crashpad\settings.dat
                            • Size 280B
                            • SHA256 30a4df7a14bda1da086a63289f683c8161d4082c8704fe3b940bea83fe035bf3
                            • MD5 SHA1 SHA512 TLSH

                            throttle_store.dat

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Crashpad\throttle_store.dat
                            • Size 20B
                            • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                            • MD5 SHA1 SHA512

                            the-real-index

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                            • Size 72B
                            • SHA256 f2c397aca6d2e0bb0d791ece69b979575c42150d4cc37fb27b302578af2a3e2e
                            • MD5 SHA1 SHA512 TLSH

                            the-real-index

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                            • Size 48B
                            • SHA256 5071d99c804973ae9366361ba791495961936bf6928a952d9c8295f50d1086d7
                            • MD5 SHA1 SHA512

                            the-real-index

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                            • Size 96B
                            • SHA256 0f482e4457b0da507f84e23735e823c91cc1d1a753d7440229afd0b7b2c72220
                            • MD5 SHA1 SHA512 TLSH

                            index

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\DawnGraphiteCache\index
                            • Size 256KB
                            • SHA256 3c8588647bb3780b370fc13a4a7e12a7d65582f4ad2d037f7d6c5189ad32d4a2
                            • MD5 SHA1 SHA512 SSDEEP

                            data_0

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\DawnWebGPUCache\data_0
                            • Size 8KB
                            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                            • MD5 SHA1 SHA512 SSDEEP

                            data_1

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\DawnWebGPUCache\data_1
                            • Size 264KB
                            • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                            • MD5 SHA1 SHA512 SSDEEP

                            data_2

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\DawnWebGPUCache\data_2
                            • Size 8KB
                            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                            • MD5 SHA1 SHA512 SSDEEP

                            data_3

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\DawnWebGPUCache\data_3
                            • Size 8KB
                            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                            • MD5 SHA1 SHA512 SSDEEP

                            MANIFEST-000001

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Extension Rules\MANIFEST-000001
                            • Size 41B
                            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                            • MD5 SHA1 SHA512

                            9d904ba2-31c2-4971-ba26-a1384714623f.tmp

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Network\9d904ba2-31c2-4971-ba26-a1384714623f.tmp
                            • Size 40B
                            • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                            • MD5 SHA1 SHA512

                            Network Persistent State

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Network\Network Persistent State
                            • Size 578B
                            • SHA256 066b565f3135fc239e48f96a93d11e15948d0b47a93f8cf64d98e37278a9c21d
                            • MD5 SHA1 SHA512 TLSH

                            Network Persistent State~RFe596ae5.TMP

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Network\Network Persistent State~RFe596ae5.TMP
                            • Size 59B
                            • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                            • MD5 SHA1 SHA512 TLSH

                            SCT Auditing Pending Reports

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Network\SCT Auditing Pending Reports
                            • Size 2B
                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                            • MD5 SHA1 SHA512

                            TransportSecurity

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Network\TransportSecurity
                            • Size 355B
                            • SHA256 bb43bbd6396f14655937a7acd073b34811ab70f144075af5c8cffb12f79f4b70
                            • MD5 SHA1 SHA512 TLSH

                            TransportSecurity

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Network\TransportSecurity
                            • Size 353B
                            • SHA256 af38d36be9192a8d3d679f19e3bf0b142aea2451a0f6bb7535075fb10b67f4dd
                            • MD5 SHA1 SHA512 TLSH

                            Preferences

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Preferences
                            • Size 6KB
                            • SHA256 d1ed5555c64b92678abc7fbd3d4ac62d3a5a7fbaf4782d5f56a689b12009c30c
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Preferences

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Preferences
                            • Size 6KB
                            • SHA256 94b1f1d1e3049eec26de427fc83930cf6d22c6d6ab6c814166881e1fad4f80b0
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Preferences

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Preferences
                            • Size 7KB
                            • SHA256 487c4fce519320372a828af8269003ecf67776a11306578e0f9a424c4b29a344
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Preferences~RFe5968f1.TMP

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Preferences~RFe5968f1.TMP
                            • Size 6KB
                            • SHA256 176cbbe38c029e5ca26c3e48c15c66ae4f33fe6404a8206ae14eb64cfaba95b7
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            CURRENT

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Default\Site Characteristics Database\CURRENT
                            • Size 16B
                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                            • MD5 SHA1 SHA512

                            Local State

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Local State
                            • Size 4KB
                            • SHA256 a68378be8f79f40f2679fd566593ec8ce2043c409b61c2307559a5074a8ba55d
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Local State

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Local State
                            • Size 4KB
                            • SHA256 146d49b4cb90bf901bcc540462b9330d8e74467f068ff8f9e6149ce8a638caa4
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Local State

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Local State
                            • Size 1KB
                            • SHA256 0be9666a94e00b89f1970207eb70e702f82729ef5e22d0707bb657cc1b5ba04d
                            • MD5 SHA1 SHA512 TLSH

                            Local State

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Local State
                            • Size 4KB
                            • SHA256 bbe2a59c31f91c9c9fb3523ebf56c2894676d1da2addcbb3bd6f4a0b1d8b557d
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Local State

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Local State
                            • Size 16KB
                            • SHA256 1c972fdc05c5bba249bd3df10e1732de405fe3bae6e24de44e6b8630a00ae578
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Local State

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Local State
                            • Size 2KB
                            • SHA256 862ba0938562278b0841d0754538c153d179b443803944185e5657bd3d177657
                            • MD5 SHA1 SHA512 TLSH

                            Local State

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Local State
                            • Size 3KB
                            • SHA256 962831e3dc7add8b3bf0e08a67988437f12f81c6290308cc97fc1c124194ec8d
                            • MD5 SHA1 SHA512 TLSH

                            Local State

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Local State
                            • Size 4KB
                            • SHA256 3af10b353b55e92b43e1a02775dacbfc957b6ab12c6702c37288ecbd1f7ecdd4
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Local State~RFe591498.TMP

                            • Path C:\Users\Admin\AppData\Local\com.ghosty.desktop\EBWebView\Local State~RFe591498.TMP
                            • Size 1KB
                            • SHA256 969ca7ae86e04da7eb701a19e98330f12bbcbd80fa536041f4c9781af5b9fa0f
                            • MD5 SHA1 SHA512 TLSH

                            memory/1432-14413-0x0000024AD27F0000-0x0000024AD3170000-memory.dmp

                            memory/2188-14146-0x00007FFE89F30000-0x00007FFE89F31000-memory.dmp

                            memory/2188-14141-0x00007FFE898E0000-0x00007FFE898E1000-memory.dmp

                            memory/3552-14187-0x00007FFE8A080000-0x00007FFE8A081000-memory.dmp

                            memory/4472-14458-0x00000184C4FE0000-0x00000184C4FE3000-memory.dmp

                            memory/4472-14330-0x00000184CE7C0000-0x00000184CE7C2000-memory.dmp

                            memory/4472-14343-0x00000184CEB40000-0x00000184CEB42000-memory.dmp

                            memory/4472-14344-0x00000184CEB30000-0x00000184CEB34000-memory.dmp

                            memory/4472-14346-0x00000184CEB50000-0x00000184CEB52000-memory.dmp

                            memory/4472-14348-0x00000184CEB60000-0x00000184CEB63000-memory.dmp

                            memory/4472-14349-0x00000184CEB40000-0x00000184CEB46000-memory.dmp

                            memory/4472-14321-0x00000184C73C0000-0x00000184C73C2000-memory.dmp

                            memory/4472-14323-0x00000184C73D0000-0x00000184C73D5000-memory.dmp

                            memory/4472-14324-0x00000184C35C0000-0x00000184C35C9000-memory.dmp

                            memory/4472-14326-0x00000184CCA20000-0x00000184CCA24000-memory.dmp

                            memory/4472-14327-0x00000184CCA10000-0x00000184CCA17000-memory.dmp

                            memory/4472-14302-0x00000184C42F0000-0x00000184C42F4000-memory.dmp

                            memory/4472-14303-0x00000184C35E0000-0x00000184C35E8000-memory.dmp

                            memory/4472-14313-0x00000184C7350000-0x00000184C7352000-memory.dmp

                            memory/4472-14314-0x00000184C7340000-0x00000184C7344000-memory.dmp

                            memory/4472-14305-0x00000184C7320000-0x00000184C7323000-memory.dmp

                            memory/4472-14306-0x00000184C42F0000-0x00000184C42F6000-memory.dmp

                            memory/4472-14307-0x00000184C7320000-0x00000184C7321000-memory.dmp

                            memory/4472-14308-0x00000184C7330000-0x00000184C7332000-memory.dmp

                            memory/4472-14310-0x00000184C7340000-0x00000184C7344000-memory.dmp

                            memory/4472-14311-0x00000184C7320000-0x00000184C7328000-memory.dmp

                            memory/4472-14340-0x00000184CEB30000-0x00000184CEB35000-memory.dmp

                            memory/4472-14338-0x00000184CEB10000-0x00000184CEB12000-memory.dmp

                            memory/4472-14337-0x00000184CE7E0000-0x00000184CE7E1000-memory.dmp

                            memory/4472-14336-0x00000184CE7C0000-0x00000184CE7C4000-memory.dmp

                            memory/4472-14335-0x00000184CE7E0000-0x00000184CE7E2000-memory.dmp

                            memory/4472-14333-0x00000184CE7D0000-0x00000184CE7D2000-memory.dmp

                            memory/4472-14331-0x00000184CE7B0000-0x00000184CE7B4000-memory.dmp

                            memory/4472-14341-0x00000184CEB20000-0x00000184CEB2A000-memory.dmp

                            memory/4472-14320-0x00000184C35C0000-0x00000184C35C1000-memory.dmp

                            memory/4472-14319-0x00000184C35B0000-0x00000184C35B7000-memory.dmp

                            memory/4472-14318-0x00000184C35C0000-0x00000184C35C4000-memory.dmp

                            memory/4472-14300-0x00000184C35F0000-0x00000184C35F2000-memory.dmp

                            memory/4472-14298-0x00000184C3570000-0x00000184C3578000-memory.dmp

                            memory/4472-14297-0x00000184C35E0000-0x00000184C35E4000-memory.dmp

                            memory/4472-14295-0x00000184C3560000-0x00000184C3562000-memory.dmp

                            memory/4472-14294-0x00000184C35E0000-0x00000184C35E1000-memory.dmp

                            memory/4472-14074-0x00007FFE8A080000-0x00007FFE8A081000-memory.dmp

                            memory/4472-14412-0x00000184C4F00000-0x00000184C4F06000-memory.dmp

                            memory/4472-14416-0x00000184C4F10000-0x00000184C4F14000-memory.dmp

                            memory/4472-14438-0x00000184C4F50000-0x00000184C4F54000-memory.dmp

                            memory/4472-14459-0x00000184C4FD0000-0x00000184C4FD5000-memory.dmp

                            memory/4472-14444-0x00000184C4F50000-0x00000184C4F58000-memory.dmp

                            memory/4472-14456-0x00000184C4FC0000-0x00000184C4FC1000-memory.dmp

                            memory/4472-14455-0x00000184C4FB0000-0x00000184C4FB7000-memory.dmp

                            memory/4472-14454-0x00000184C4FC0000-0x00000184C4FC4000-memory.dmp

                            memory/4472-14452-0x00000184C4F70000-0x00000184C4F7A000-memory.dmp

                            memory/4472-14451-0x00000184C4FB0000-0x00000184C4FB5000-memory.dmp

                            memory/4472-14449-0x00000184C4F80000-0x00000184C4F82000-memory.dmp

                            memory/4472-14447-0x00000184C4F90000-0x00000184C4FA5000-memory.dmp

                            memory/4472-14411-0x00000184C4F10000-0x00000184C4F13000-memory.dmp

                            memory/4472-14415-0x00000184C4F20000-0x00000184C4F22000-memory.dmp

                            memory/4472-14435-0x00000184C4F40000-0x00000184C4F43000-memory.dmp

                            memory/4472-14439-0x00000184C4F40000-0x00000184C4F47000-memory.dmp

                            memory/4472-14432-0x00000184C4F30000-0x00000184C4F33000-memory.dmp

                            memory/4472-14433-0x00000184C4F20000-0x00000184C4F25000-memory.dmp

                            memory/4472-14436-0x00000184C4F30000-0x00000184C4F36000-memory.dmp

                            memory/4472-14441-0x00000184C4F60000-0x00000184C4F62000-memory.dmp

                            memory/4472-14443-0x00000184C4F70000-0x00000184C4F74000-memory.dmp