Overview
overview
7Static
static
3Ghostly_1....up.exe
windows10-2004-x64
7Ghostly_1....up.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3binaries/A...pi.dll
windows10-2004-x64
3binaries/A...pi.dll
windows11-ltsc_2024-x64
3binaries/A...pi.dll
windows10-2004-x64
3binaries/A...pi.dll
windows11-ltsc_2024-x64
3binaries/adb.exe
windows10-2004-x64
3binaries/adb.exe
windows11-ltsc_2024-x64
3ghosty-ios...C4.dll
windows10-2004-x64
1ghosty-ios...C4.dll
windows11-ltsc_2024-x64
1ghosty-ios...20.dll
windows10-2004-x64
1ghosty-ios...20.dll
windows11-ltsc_2024-x64
1ghosty-ios...20.dll
windows10-2004-x64
1ghosty-ios...20.dll
windows11-ltsc_2024-x64
1ghosty-ios...de.dll
windows10-2004-x64
1ghosty-ios...de.dll
windows11-ltsc_2024-x64
1ghosty-ios...es.dll
windows10-2004-x64
1ghosty-ios...es.dll
windows11-ltsc_2024-x64
1ghosty-ios...ni.dll
windows10-2004-x64
1ghosty-ios...ni.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
60s - max time network
67s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 16:24
Behavioral task
behavioral1
Sample
Ghostly_1.0.5_x64-setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
60 seconds
Behavioral task
behavioral2
Sample
Ghostly_1.0.5_x64-setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
60 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
60 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
60 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
60 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
60 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
60 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
60 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
60 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
60 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
60 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
60 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
60 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
2 signatures
60 seconds
Behavioral task
behavioral15
Sample
binaries/AdbWinApi.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
60 seconds
Behavioral task
behavioral16
Sample
binaries/AdbWinApi.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
60 seconds
Behavioral task
behavioral17
Sample
binaries/AdbWinUsbApi.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
60 seconds
Behavioral task
behavioral18
Sample
binaries/AdbWinUsbApi.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
60 seconds
Behavioral task
behavioral19
Sample
binaries/adb.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
60 seconds
Behavioral task
behavioral20
Sample
binaries/adb.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
60 seconds
Behavioral task
behavioral21
Sample
ghosty-iosd/_internal/Crypto/Cipher/_ARC4.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
60 seconds
Behavioral task
behavioral22
Sample
ghosty-iosd/_internal/Crypto/Cipher/_ARC4.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
60 seconds
Behavioral task
behavioral23
Sample
ghosty-iosd/_internal/Crypto/Cipher/_Salsa20.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
60 seconds
Behavioral task
behavioral24
Sample
ghosty-iosd/_internal/Crypto/Cipher/_Salsa20.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
60 seconds
Behavioral task
behavioral25
Sample
ghosty-iosd/_internal/Crypto/Cipher/_chacha20.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
60 seconds
Behavioral task
behavioral26
Sample
ghosty-iosd/_internal/Crypto/Cipher/_chacha20.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
60 seconds
Behavioral task
behavioral27
Sample
ghosty-iosd/_internal/Crypto/Cipher/_pkcs1_decode.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
60 seconds
Behavioral task
behavioral28
Sample
ghosty-iosd/_internal/Crypto/Cipher/_pkcs1_decode.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
60 seconds
Behavioral task
behavioral29
Sample
ghosty-iosd/_internal/Crypto/Cipher/_raw_aes.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
60 seconds
Behavioral task
behavioral30
Sample
ghosty-iosd/_internal/Crypto/Cipher/_raw_aes.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
60 seconds
Behavioral task
behavioral31
Sample
ghosty-iosd/_internal/Crypto/Cipher/_raw_aesni.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
60 seconds
Behavioral task
behavioral32
Sample
ghosty-iosd/_internal/Crypto/Cipher/_raw_aesni.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
60 seconds
General
- Target Ghostly_1.0.5_x64-setup.exe
- Size 57.1MB
- Sample260801-twdpdade25
- SHA256 7246f76cedaf13023b6010c3d9a3aa6f5f4903880c1797f9c952ae813173b5ff
- MD5 26224b8d3b8db52897e55ccf3b72e0b5
- SHA1 d46542c600abcad33f0a5756876e10c1a3f9499a
- SHA512 442a4dc3d8af9e545bc3c507bcf888168bc92ae2dfcb4923b63b1f26a11d55a1ffe1335ef9d16b587079ca36d84d5f89fc93da3be554ec60f481814ecd72b7e9
- SSDEEP 1572864:L10w/SNIIHf86tdYbRJlStfZXDk233btPJxNSL3XV:L10MSII3WIZdHbtRO3l
- TLSH T151D7334C1E7C4C6ADA0AFFFBA9C8D3E895E179EB740BF4C2D31B6624D1809EC2405965
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 8 IoCs
pid Process 3352 Ghostly_1.0.5_x64-setup.exe 3352 Ghostly_1.0.5_x64-setup.exe 3352 Ghostly_1.0.5_x64-setup.exe 3352 Ghostly_1.0.5_x64-setup.exe 3352 Ghostly_1.0.5_x64-setup.exe 3352 Ghostly_1.0.5_x64-setup.exe 3352 Ghostly_1.0.5_x64-setup.exe 3352 Ghostly_1.0.5_x64-setup.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\hvac\hvac\api\auth_methods\radius.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\openpyxl\openpyxl\reader\workbook.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\openpyxl\openpyxl\worksheet\hyperlink.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\pyflakes\pyflakes\reporter.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\python-xlib\Xlib\support\__init__.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\reportlab\reportlab\platypus\tableofcontents.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stdlib\lib2to3\fixes\fix_funcattrs.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\console-menu\consolemenu\items\selection_item.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Africa\Malabo Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\requests-oauthlib\requests_oauthlib\compliance_fixes\plentymarkets.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\pmd_pytcp\protocols\tcp\state\tcp__state__window.py Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\aws-xray-sdk\aws_xray_sdk\ext\sqlalchemy\query.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\dateparser\dateparser\data\__init__.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\seaborn\seaborn\_core\scales.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\vobject\vobject\icalendar.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\Authlib\authlib\integrations\requests_client\__init__.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\aws-xray-sdk\aws_xray_sdk\core\sampling\local\reservoir.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\networkx\networkx\algorithms\centrality\current_flow_closeness.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\psutil\psutil\_psutil_osx.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\av\container\streams.pyd Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stdlib\lib2to3\fixes\fix_idioms.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\binaryornot\binaryornot\__init__.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\Authlib\authlib\integrations\django_oauth1\nonce.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\pywin32\isapi\threaded_extension.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\django-stubs\django-stubs\contrib\staticfiles\management\commands\collectstatic.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\flake8\flake8\style_guide.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\tensorflow\tensorflow\python\trackable\__init__.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\tqdm\tqdm\contrib\itertools.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\av\plane.pyd Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\cryptography-50.0.0.dist-info\RECORD Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stdlib\tkinter\tix.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stdlib\tracemalloc.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\protobuf\google\protobuf\compiler\__init__.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Adak Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Dublin Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\braintree\braintree\exceptions\authentication_error.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\pmd_pytcp\protocols\icmp4\icmp4__echo_options.py Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\networkx\networkx\algorithms\mis.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stdlib\getpass.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stdlib\webbrowser.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\braintree\braintree\connected_merchant_paypal_status_changed.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\openpyxl\openpyxl\worksheet\pagebreak.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\pywin32\win32\win32crypt.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Swift_Current Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stdlib\stringprep.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\setuptools\setuptools\_distutils\dep_util.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Aden Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stdlib\encodings\iso8859_11.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\pmd_net_proto\protocols\raw\__init__.py Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\pmd_pytcp\runtime\packet_handler\packet_handler__ethernet_802_3__tx.py Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stdlib\telnetlib.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\xmldiff\xmldiff\__init__.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\pmd_net_proto\protocols\ip6_hbh\__init__.py Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\MET Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\django-stubs\django-stubs\contrib\syndication\views.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\django-stubs\django-stubs\db\models\functions\__init__.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\networkx\networkx\readwrite\p2g.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\pywin32\win32\win32evtlog.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\pymobiledevice3\usbmux.py Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\PyMeeus\pymeeus\Jupiter.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\dateparser\dateparser\__init__.pyi Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\s2clientprotocol\s2clientprotocol\data_pb2.pyi Ghostly_1.0.5_x64-setup.exe File created C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Almaty Ghostly_1.0.5_x64-setup.exe File opened for modification C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\django-stubs\django-stubs\contrib\auth\models.pyi Ghostly_1.0.5_x64-setup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghostly_1.0.5_x64-setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe - Kills process with taskkill 2 IoCs
pid Process 1892 taskkill.exe 2152 taskkill.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3352 Ghostly_1.0.5_x64-setup.exe 3352 Ghostly_1.0.5_x64-setup.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2152 taskkill.exe Token: SeDebugPrivilege 1892 taskkill.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3352 wrote to memory of 2152 3352 Ghostly_1.0.5_x64-setup.exe 89 PID 3352 wrote to memory of 1892 3352 Ghostly_1.0.5_x64-setup.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ghostly_1.0.5_x64-setup.exe"C:\Users\Admin\AppData\Local\Temp\Ghostly_1.0.5_x64-setup.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM ghosty-iosd.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2152
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM adb.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1892
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\ifaddr-0.2.0.dist-info\INSTALLER
- Size 4B
- SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
- MD5 365c9bfeb7d89244f2ce01c1de44cb85
- SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
- SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
- MD5 SHA1 SHA512
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\django-stubs\django-stubs\contrib\flatpages\urls.pyi
- Size 59B
- SHA256 a0869d2c9451a944b87f059edc5d93c1d415888b98b9247b8aeb5489d9dcba7d
- MD5 72baef07657af40bbb9421362b0c67cd
- SHA1 e0e802c0e54240712b8bd8418627b2ffa123bc94
- SHA512 32e4cddc4df9759ad46f617cd69b2adc130a918cac4f588cf563d8e3c298ece3a5bb0a9dc9a082cbdc015f2789336a6e67d545603ea69477fc5de28256fd6d06
- TLSH T156A002864456BD866BEB4C0C50294030492D50C26F55493582A9936053914E48439119
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\django-stubs\django-stubs\core\mail\backends\filebased.pyi
- Size 103B
- SHA256 ae9de027f591acfedc0ba387099c4398c0841a9c126535d313ffbdb18184eea0
- MD5 7f6526c1bbcb2aa7ba6a8cde268765bc
- SHA1 cfc87c1fd110239d47886e0c5ebcad54bd453bbe
- SHA512 3c6f26b5f0ab2bc22e72e116ffe28624e5d971a86b9d85e5f733844827e784b8349c46fa46ca5390bc972607b7fb5b37a6fb47b410e105f02b147dfe77a737c7
- TLSH T193B0924460A342810FF69AE230F431905998340B8D38980A4F0031140B30C463E0A11E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\django-stubs\django-stubs\core\management\commands\testserver.pyi
- Size 85B
- SHA256 1a4fa10dd76be871ebe4f02bc9ccf70eaa1e178efa5291aa6aff471a9fcdb272
- MD5 6b8cad3305cef8186496283d80f5ea37
- SHA1 418009700ba673f4aebf49db46d1f44384d4f8f8
- SHA512 e06ba45ea1bd65681f3be4a85118d4bc75c961e82dc6d319c6a2b1a7a39533732fe7c5d152ea978e0dd62c1ea520eb62c9322eaed82ca5588495fa1465f71555
- TLSH T1C3A01208F0BD01E301CA80C6080422B134F1320245580C0315347D380C208C71C43101
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stdlib\encodings\cp1026.pyi
- Size 730B
- SHA256 08663c54b1b600c85ea305e6103d01bb350ae41c9f0cd52b264a3650974551be
- MD5 ee8b2dc81acd1ed83a5aadc71d839ce7
- SHA1 96317badd9a196e246d8f585d1be38f32c007a8f
- SHA512 cf08c5275aae96033c1746de24e32af2f2c784d043bd6f22d50e3c64e9da59e27e059ae0e1814a4c0f6f9a7eb84652fa01a8e79030750554ee0af2a1abd3b685
- TLSH T1CF01C0891D2689D067BD91BA9000CD3B964E76E1893E2C65BCF2C3901EC062D95B5B0C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stdlib\encodings\cp737.pyi
- Size 733B
- SHA256 22e29100d1453aa2195b8ae046ded4aa77761f1c9e82d60ab983b055b451f606
- MD5 c56b5725a62194037e8c04af982f8ed4
- SHA1 8d4d4abab0f489006f2d70d14d2ad4fed6936b51
- SHA512 0552ab7ae35e7ed6e8050d50fecc1bbb8320d91f69daf3ec68340e4b70a821d751b6f9e0127488256833e53e2e69b3ef9862f66b7bfae64f5491a153edfe2553
- TLSH T11C01C0891D6686D197FD96BAD140CD3B954E76F18D3E2C217CF182A01EC082C427670C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stdlib\encodings\cp932.pyi
- Size 920B
- SHA256 9564886ba7353ce6726f0857c0d39e4e6c3996d26215389ec32185aab054dfe5
- MD5 b5d3ebfb8bdcb8319a2a3f3d2f376ebb
- SHA1 8cb636f53dcc85457c4f81103e710ed31ef32eba
- SHA512 ef538eeb071bac17353e65d389841ed7bf702ae7cba4ee5025f67ef19af94fd3c872d0f592afbc0cfddfaab205632946cff243bcdaeea9a2ba88871bc39ea654
- TLSH T1921125832DF646A1D6BF0196BE16DE21911C3A639B990E0E3FB183A80FA9D10D12436C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\aws-xray-sdk\aws_xray_sdk\ext\httpx\__init__.pyi
- Size 55B
- SHA256 d3b7520fe93d3fc021e4c0c938c23dd6c42c56f9d6caa17826c054bd2c0bb018
- MD5 6c3c6e8309bd9a65a0e520484605613f
- SHA1 4c4e070a122c5789571045af366b094daa65b7ba
- SHA512 fca6cb5328d31e5b4ee74dfe53e66e5a19f190d346a5021fd7bd408c3bda9d3de78f5d8e820cc1dad434cd837f470a90da96e79dcb1509fea96d732b583c2013
- TLSH T1219002F71DE5171084208103035F631145279E915F6010556514092553459420900810
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\aws-xray-sdk\aws_xray_sdk\ext\psycopg\patch.pyi
- Size 25B
- SHA256 9dd03142ef8ea162b2dc2cee6d01577c7e9b25eb176dea913d1808dfb52beabb
- MD5 e9a0de49fc11967b387f0d27e9bef737
- SHA1 7a5439ff1539eb600aebd08ae71f0e9f4112560a
- SHA512 93163e8ab9cec33998fe73b5878ddf438219391c0dd48a64037d0c165e831b92a73a6562829f5edb3f5ad22f028a7305f34adac48278e82b5d93381d2df8272f
- MD5 SHA1 SHA512
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\aws-xray-sdk\aws_xray_sdk\ext\sqlalchemy_core\__init__.pyi
- Size 86B
- SHA256 e4a70cfc5c6ccdeaf213ed803b109ba89f07a61635ec8483b6f697e6c2b54ed4
- MD5 fee3b8e503100f2b9de5c476e73fd292
- SHA1 1657b5dd55aeede530158aec1809337eb715ea63
- SHA512 e384cc9fd5e80d206c63e2f253698d7f5e2d9e17b4a669bf69d6c5e4d7bece1b0e7337cc33028ae0a67ffb1a651473f5bd646e866d471ed7c841b3a981efe7a5
- TLSH T189A002F71EF9172198308113036F6322496BBFD95F6135A5E5254F35934BD820F05D20
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\docker\docker\version.pyi
- Size 17B
- SHA256 636e67e38a72137be9f763220012ab70adc8591c90d491b5ad9e147eacb69c2d
- MD5 3cfcd308f6cee078df2a3b8453aa210b
- SHA1 24063dd2fd1ad006b8e74517b956ff3fd0bb0b71
- SHA512 91e11dc2417a60fb9b157ad529406ec7d420488846fb34ef343a50e06de35f052a58b0bfd2e4b604ccc2e2f60d21778c5ec6b1d6bf7952521e05723e575db53b
- MD5 SHA1 SHA512
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\docutils\docutils\languages\cs.pyi
- Size 180B
- SHA256 e8750bad8cd7bb1eefc49bf468ce786c1eb3c62ff4fa9a6a15b74a453f9d4d47
- MD5 e825c0c02c43a3a70ae156b5b768fde6
- SHA1 b7924c4e7ccd057e22104d414b31e086fb4dd398
- SHA512 343d9e39ad524653735da4a7b9c8c75a5c8d91e5e8928202925ba284ab28d26f309d6b05d9010ecb3b2e21ab2e259ddec041afe72b0111f6b464eb931b67db85
- TLSH T1EAC0129304A35C4AA7ED5435A520551257AA00E0D72A4A8D615C1638D95711E1935668
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\docutils\docutils\parsers\rst\languages\ca.pyi
- Size 117B
- SHA256 7dd28eca78db7632bd9dc70a8c31e555699fad5332a04e51f5cabe4f5b51c97d
- MD5 08ccc9e8b111b3d302bab36507f97044
- SHA1 7af52592c734749229462c144c04451052bf125d
- SHA512 6b02a0fcdbf20815180c3c13dd6b5fa9b486442dcaddd99b8e0289b77e08585f8f4c75f44866643283d79805f8a2f217dd6f2b74a6d097adb4365c077484ec69
- TLSH T1CDB0925349A7244A23F0553442240A322BBE01D1932E5ADC25A426388D4561D197126D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\lupa\lupa\lua53.pyi
- Size 3KB
- SHA256 71b5af692107be0868cd47af49779406b579e82c384648ad82d113c9469be167
- MD5 3260bf4d47f9f5f99857c70147b8b361
- SHA1 71928660e4ea929a0d4ea3029ffb80dba902ef00
- SHA512 62e0fd4b96630a9b7c2c64e082771febf7d4f8fef3e8cebb652459d5be8d8a7b66974cc3f3dce8d62d21d15da248c1bfdb088b5e8aef6f82b7ac5daa5d6ee36f
- TLSH T13181200D821AF2F302AADDB544162BB7DE29C1935E7CB43464F4F4ED1BD7038C8A6699
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\lupa\lupa\version.pyi
- Size 50B
- SHA256 1bc0f1ada46ee63106faf7b4ea6b29f57a07a90c2d9c512356d0922deeef693c
- MD5 2e0a8f4a89631f160794c3be3eceea9b
- SHA1 8c65677e5de8ab21145fdd21a8e80812bb9fc390
- SHA512 50822084e85dd25c6cbd88f09744199005d0b4fec3f1496572d7bcb89fb99a9bcff3b11fb2f069dd00fee6098313a901476f3af6a6f5ca2e9464e3682b9c1673
- TLSH T1AE9002410A31455655F98629122D5018132301A02741460813846238A39159F55751AC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\six\six\moves\SimpleHTTPServer.pyi
- Size 26B
- SHA256 bed05425469b4eb2152bdec29f43212d48474a56e61c1f10810956c1a747fbac
- MD5 59c113ba8da07ed8b8cf1d9fa0cb0a08
- SHA1 b29c918fa7f8eb1f29f0a940f7bc3473d1f5d5e1
- SHA512 98a1b860fb715c34568ec9247df52f480fd5fa72eac8c3b34954bfc2b35fb4b0bf73ea421950a9c027a20fc364207bf930edff3033490acf4011098afbe098e1
- MD5 SHA1 SHA512
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\jedi\third_party\typeshed\stubs\tensorflow\tensorflow\python\keras\__init__.pyi
- Size 53B
- SHA256 85c7c729385046289b3971a73de1141ee9ebb6f88c768ae3d0cb5d9c8c0bb65f
- MD5 da2d0a9a18322c50cf5fa08e2a669637
- SHA1 edea4946228aec0136eaf76e4877e35829569da6
- SHA512 771ba360ef0b6a82b059526ff686e2bbcf6b72c8c8c15fcf91b8962c6bf8b751fd1538c822de5f18c5da0923db0a7b2c88e825072c69c6f331c0026e5c4e3de5
- TLSH T13290021B41797996472A095AED320595595429448258405054455059128E10985552DD
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\parso\python\grammar39.txt
- Size 7KB
- SHA256 715ad56c5f4f8395092c58b6b6f2deb4f906f81380929a836bd86ab253634875
- MD5 fbbad176c79cc8670f9c2b4a0078b4fe
- SHA1 b63c75589d719f28bb59b6ecab806d9b57701da9
- SHA512 15833d8c2df3fd51fc387a19c0880361cf9ff664da8ba33b6ee764bf6220634a151aae729db3f1e5b05aa3bc7c56782754d060fc7cc1af7a938dfe042a98a340
- SSDEEP 96:d8cvbzNX3X1pR3SylUHu5riFl69BFmlETSX6MckQlb99c83OiEhNhfO5ZCCv2OGf:d8cFX3X1pR3SylUrgM4B9hUi+
- TLSH T1EAF1911CA6D70B450BD150B7554CF3BA49C9D18E203B8176FBCD92FD8FCB0982622B6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\pmd_pytcp-0.3.0.dist-info\WHEEL
- Size 91B
- SHA256 2b6eb4118ce7cd7b09601406aa623c553c4476265836f0d9c16f5c061f7efcc0
- MD5 d8484b2712d6275b37660ce7c74212ff
- SHA1 e28579fb4ecc8d36e494d12789590d234e656931
- SHA512 750688b867d714e8f1894966b2f117b453aef8e8a69eaaf904e40ce183d5a0d8a092cce7cc713b1ba5a66779edf87ecca86eb869122ba08b5018550069cefbc7
- TLSH T108B01215094014FC54A0EE134074A1201B6085455895707DF04A03446549D4406CDC5E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\pmd_pytcp-0.3.0.dist-info\licenses\LICENSE
- Size 31KB
- SHA256 af85d629f041f624f69ad1d22b6cc16a4c521b97e63df64d293eeba8fa2c0421
- MD5 90abddbf5efdd9ab79e95051f75b8e89
- SHA1 7ceac9fc9230dc92d7cfdfb4b3de31483156ab2c
- SHA512 3d5300b0ad85cd6a9c0ae9ee68953854d32b5c8c29251d07dced3d26332a171e06549b623f18058c2a59d228aac6329e67bc7d18aae95c6f8994f638a4676bae
- SSDEEP 384:FAvdfQM8xcy2qVTfofITuM2Vs6aHGUa1lufWkGVBmnLRfCiR1XAnLuaa9f/dQOaO:Fo1acy3LTB2VsrHG/OfvMmnBCtLmJ9T
- TLSH T1A4E2635FB74413B2028206A26A9B68DEE31DD039776640A5785DC15C27B3E3483BFBED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Africa\Asmera
- Size 191B
- SHA256 0783854f52c33ada6b6d2a5d867662f0ae8e15238d2fce7b9ada4f4d319eb466
- MD5 fe54394a3dcf951bad3c293980109dd2
- SHA1 4650b524081009959e8487ed97c07a331c13fd2d
- SHA512 fe4cf1dd66ae0739f1051be91d729efebde5459967bbe41adbdd3330d84d167a7f8db6d4974225cb75e3b2d207480dfb3862f2b1dda717f33b9c11d33dcac418
- TLSH T105C02B886B10D0B0F08148348EF30606DE51C3B8032200F37C0C281003740602A460E0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Africa\Bamako
- Size 130B
- SHA256 f3e7fcaa0e9840ff4169d3567d8fb5926644848f4963d7acf92320843c5d486e
- MD5 796a57137d718e4fa3db8ef611f18e61
- SHA1 23f0868c618aee82234605f5a0002356042e9349
- SHA512 64a8de7d9e2e612a6e9438f2de598b11fecc5252052d92278c96dd6019abe7465e11c995e009dfbc76362080217e9df9091114bdbd1431828842348390cb997b
- TLSH T15FC00289B7080942C45063B90D8723A8DF15C009D53153B338187208CCAA9D42E145C5
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Africa\Douala
- Size 180B
- SHA256 e5ef1288571cc56c5276ca966e1c8a675c6747726d758ecafe7effce6eca7be4
- MD5 89de77d185e9a76612bd5f9fb043a9c2
- SHA1 0c58600cb28c94c8642dedb01ac1c3ce84ee9acf
- SHA512 e2fb974fa770639d56edc5f267306be7ee9b00b9b214a06739c0dad0403903d8432e1c7b9d4322a8c9c31bd1faa8083e262f9d851c29562883ca3933e01d018c
- TLSH T14FC012C073B00497CA50773C0FA32AD3DE018914CAAA37EB2954158C09790D07AAB9E8
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Africa\Gaborone
- Size 131B
- SHA256 910c97c091cd34ae7427c83226234ce7b4f2f425c5822d6669c24be62010a792
- MD5 9c92339423e915befec45cc4752a75ce
- SHA1 d336e337b0cafc1205ba041fac447b8ae3074dbe
- SHA512 e5a3a1ab74a2620743964583ab960be126448ed013b57393eca6b397ac020de0be5763b6d40443b1976e0d3e6a533e8c46123fcb0428e5e233b076cf9ba69667
- TLSH T1D5C02200F30C882AC00003FA0BAF0300AC0BC200CB0022B328203008CCCA0802E003C0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Africa\Mbabane
- Size 190B
- SHA256 d19aebe2435c4e84bf7ae65533d23a9d440f98162e5b4d69c73f783e02299ec8
- MD5 a46a56e63a69fd5c5373a33203250d39
- SHA1 da4256239fbc544037f0d198cd407e6a202d1925
- SHA512 fc9c48be574219047f00bf2ba91e085076aec96db89f5e44741596b10b8766d4f80da3676d421a6a929b48a7eb85e4eafa4cc4673fc40d8f45aa96569c48e12b
- TLSH T1F7C0924C7E27AA27E9D576FE2A170B19AD4AC19580222DAB7CA63804147B984AE25181
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Aruba
- Size 177B
- SHA256 abbe8628dd5487c889db816ce3a5077bbb47f6bafafeb9411d92d6ef2f70ce8d
- MD5 92d3b867243120ea811c24c038e5b053
- SHA1 ade39dfb24b20a67d3ac8cc7f59d364904934174
- SHA512 1eee8298dffa70049439884f269f90c0babcc8e94c5ccb595f12c8cfe3ad12d52b2d82a5853d0ff4a0e4d6069458cc1517b7535278b2fdef145e024e3531daad
- TLSH T15AC01205BB415584E2E177B503F703D7CE1C80048C00DEABF907369508B88503FB0C80
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Catamarca
- Size 708B
- SHA256 502d1fc71ed93e68cfc370f404afb9bdaa7e735701cdb811dbddcc76611f3b1d
- MD5 e3467a68822f3d1365e3494970219b03
- SHA1 3b37cd19a0ecda386ce185f888f4830d4767ac35
- SHA512 4ae79f4a57134ebae1776c259af4236fb75827e4feadf952eafcd33a15f1cae49a68855eb67b1a129dfb2cfe44ade4bba274051c972434517e179fd36e4b6534
- TLSH T12901E14DFDB33407D9CC4EFA4987D07290ECA33975519F659DE130931434500EC0C400
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Coral_Harbour
- Size 149B
- SHA256 a78d73067ba3cbd94f8a23dfdd6aa8b68cb33b18484bc17b4e20ea1aec2f0a81
- MD5 595e67b4c97fda031a90e5ef80813e7d
- SHA1 7194eb1a70c1acc1749c19617601595d910b9744
- SHA512 27925a87379552403a0960c2ec191994610bc05b2d67fb1fbbeeb6086a16091bdc69449bce3426b31a2775f3845ed8cc07d1882f8b3b4e63f437775a2eea5d76
- TLSH T1C3C01214B7480A16C55132BA2A410100CC044300A12202B36C4C231804585C26630182
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Indianapolis
- Size 531B
- SHA256 e678f42a13efbd7be0f26a9ce53e04b1c28a582eab05611cb01c16836432f07b
- MD5 9208172103191bf0d660e0023b358ea1
- SHA1 6f19863d563ade21b63df66afd12e0c67903a341
- SHA512 013be7c175dba66510fbd2972e0d4b76b7073a079aaed9e0a454753dc5e18fb1133b2947c48bd7e1cfa70820b397af6ff49b41434a4909906f87a8c91b853178
- TLSH T18BF02B84E73984C4EBF176F6050805E84F50F1C5DF2780C72C6E2A081A79FD507A66B2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Nipigon
- Size 1KB
- SHA256 815ab4db7a1b1292867d2f924b718e1bba32455ce9f92205db2feb65029c6761
- MD5 3fa8a9428d799763fa7ea205c02deb93
- SHA1 222b74b3605024b3d9ed133a3a7419986adcc977
- SHA512 107a4dbb64107f781e3ed17b505baea28d4ca6683c2b49d146dda41c28ca3f9c307809ed938e4152011e199a7be6913de6f7b78cafe8ef300dc3034397945238
- TLSH T1143183969418B8DFDF0145B90560C03CCB6431C30B2B91C6C74D67402578F5D89A5DF6
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Rosario
- Size 708B
- SHA256 f488f75a34fd99630a438dcb792508a90b836fdcd2dc54a51d83d535025315fd
- MD5 5c57dc3d11f5a64fac22a08ea0c64d25
- SHA1 53f6da348a256b7f84be5e9088a851331b82db9d
- SHA512 18f23ddb3dca6fa3efe9cbea294bdfc6ad9db3bea98fc1766e0f317754d8a452e12edd692b1505810ec7842d0f8dbdcf1f50a4027dbc2621cde865311ff5b259
- TLSH T1F3018B4EFEB3380BD9C95EFE4983D176A0ECA33976519F65EDE174A31838501E80C801
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\America\Tijuana
- Size 1KB
- SHA256 af9aea4aee505143fa5e847643c0ffe164190c38411010ac7f0b170f4098a6c8
- MD5 6c06020a12ab12660084ac48ae52bf03
- SHA1 ca115af4844f677fdc7ef4fc96f7d3c616826030
- SHA512 fce8525090704d839dabdfc5f1e3cba622dbf9668756acf327d0f9042ee59976ef5aef5f1635ef0f8bbbec44882a72d7a68294c286d69b11c89dca912a024d56
- TLSH T10521D50AD0033493C4CE637B7E3B00A21E648180FE1E937E603E87842BF77200E1C2AA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Harbin
- Size 393B
- SHA256 bf8b7ed82fe6e63e6d98f8cea934eeac901cd16aba85eb5755ce3f8b4289ea8a
- MD5 dff9cd919f10d25842d1381cdff9f7f7
- SHA1 2aa2d896e8dde7bc74cb502cd8bff5a2a19b511f
- SHA512 c6f4ef7e4961d9f5ae353a5a54d5263fea784255884f7c18728e05806d7c80247a2af5d9999d805f40b0cc86a580a3e2e81135fdd49d62876a15e1ab50e148b7
- TLSH T1EBE0C20C52681DCAD3ADF3FA265589A68B01E1838F52159B1446AA0DA57FB9618180F0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Kuwait
- Size 133B
- SHA256 46853e94276af2eea8e86c2f152a871c092df195dc51273b8fc7091faa4b461c
- MD5 165baa2c51758e236a98a6a1c4cf09a0
- SHA1 dbf6914834465a72dc63d15272d309a4331cd1c3
- SHA512 82f71fe26f83940b802676221f6efc6cfd66aa0cf0c3befdab9b60d7a8e951e504c547f90876890e7ecb18c7f89a41152d276f32f7e5ac6abead24b6fd47f3e5
- TLSH T16EC0028A770E4946ED9207790B572B82FD15C13AC5028AF77A59348C9CDC6E07A950E0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Ulan_Bator
- Size 594B
- SHA256 fbe23c3fafdee01b5121edf009290fb701cebbf93dacfb30f8aa90287242f6f3
- MD5 66a0ec5d00519d1826d055514861779d
- SHA1 a64af00e5941a77ddba4deaf4e68943beaabea61
- SHA512 2e02a6e7e1cb5ff51c8edf86ab6e901e10ddb95817469678a296f484eb8b7edc52235c1f2d6775778c2bb29a53874c90376517c1e3d5af3875b5a05a5da74e12
- TLSH T160F0DC40D20BB86FD2802E7405272AB24D354901F12E63BAE2101AC5B878700BF9DCC2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Asia\Vientiane
- Size 152B
- SHA256 cdc8e2c282d8bc9a5e9c3caf2fc45ff4e9e5cd18f5dec8cb873340ad7c584d64
- MD5 ff94f36118acae9ef3e19438688e266b
- SHA1 b68e4823cff72b73c1c6d9111be41e688487ec8a
- SHA512 e2ded089e3f51c57e2c32333dbca528551440ca76cdbcbaab9d627f8ee0824f1b3cae20f26352dc7edd6887e74fc78357ab52044fbfadf2192129052f82cbee6
- TLSH T1DFC01204B6240D45C45602B80C2A1500CCAC811D470F16F32408204C14B84419F521C1
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Australia\NSW
- Size 904B
- SHA256 820d45a868a88f81c731d5b2c758b4ed000039b6260a80433f8e0f094a604b59
- MD5 a1085ba102822f56191705c405f2a8ad
- SHA1 ccb304b084e1121dd8370c3c49e4d9bea8382eb6
- SHA512 3d2fa63913f22aedbffad9f94697a19aefe0920c1b9e4be47144022706fb309e46b38d85322f9ff4d8fc2472ca43fe3c5aec6486f94a89fb728a05753c075239
- TLSH T1701188508152A560E2413DFDB5274D0CACCD84C51B591E533286B31485703463D93464
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Australia\Tasmania
- Size 1003B
- SHA256 d4801581fd00037b013d71616b119fbbd510fdca5de06369b10f718a8da5e32d
- MD5 8371d9f10ef8a679be6eadedc6641d73
- SHA1 541dd89e23dc4e37e77fe3991b452915e465c00f
- SHA512 0c08054c08a4aa20efd8ef18af57fbd914fa99b5ce1aa837e8c491274b09ef934a831e4a36c4b64332d2d47f5e3083f30d4e505560c5a3188c02a4cebbf820e9
- TLSH T132119984965394D6DA412D72A84B1D1C3D5DC5C42F610B1F3365336C50F4346FE434BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Brazil\Acre
- Size 418B
- SHA256 563b9052bebaf2986ae5b707e34afde013e7641287cc97ff31005f33a0dbf7a5
- MD5 0b427173cd7de48179954c1706df9f0f
- SHA1 6f3bb01406ad71ca9718e7bc536fca9251754938
- SHA512 2be3257bef4949ce42d143d3f0e095ea26347ac22fd436d98445af8590186f74a165777e9f423b8bdac416758e42a636fc6bdb86a097256100d61c2828b522d9
- TLSH T1DEE07DDC3D0DA600E44C2C351B66D16055E5AB14F3D5DF827C8E42C81479701545230F
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Canada\Central
- Size 1KB
- SHA256 00dcf0606054d4f927416e0b47e1fdda2e5ce036fde4b53e51084f8566428c3a
- MD5 1ee6e72e10673d4a16b6e24671f793ec
- SHA1 439bd8f20d919a71ac25cec391caa8084f3b7cc3
- SHA512 dbcc75cd333e3565c5bda2329f69ff83816b1383456a5f4f11b960fe90436798182565119a48dfe590a7eed5a82e436fe39a1d5d2d71a4c12bdced265d89d7b0
- TLSH T1072194A8966880D4E310D9F207A38AD80F68F0C55F2E4483107B552C1DB8B933790875
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Canada\Mountain
- Size 1KB
- SHA256 d52173b56a28205d8d6f792bcfa8bc07614ee0d269f7bf6e43ec91f68d410600
- MD5 832f4f2fa5d0b434873da01b78b20085
- SHA1 d8cb91bfcbff2e26deb035c06a5335f4f71437a2
- SHA512 b966758ea6bb5e0404966813f51f7744c61ec3bbf887bb5ae7ad89197218b93451a1bc82ba71114a84b16a4c92aee8ac7de191a480a6063ea9946d68b8d96645
- TLSH T1EA2154DD56D1A639D65C703442B3F9A01C6844585F4F4CBF547B3834ADFCB06726059A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Etc\GMT-0
- Size 111B
- SHA256 dc4a07571b10884e4f4f3450c9d1a1cbf4c03ef53d06ed2e4ea152d9eba5d5d7
- MD5 e7577ad74319a942781e7153a97d7690
- SHA1 91d9c2bf1cbb44214a808e923469d2153b3f9a3f
- SHA512 b4bc0ddba238fcab00c99987ea7bd5d5fa15967eceba6a2455ecd1d81679b4c76182b5a9e10c004b55dc98abc68ce0912d4f42547b24a22b0f5f0f90117e2b55
- MD5 SHA1 SHA512
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Etc\Universal
- Size 111B
- SHA256 fddce1e648a1732ac29afd9a16151b2973cdf082e7ec0c690f7e42be6b598b93
- MD5 51d8a0e68892ebf0854a1b4250ffb26b
- SHA1 b3ea2db080cd92273d70a8795d1f6378ac1d2b74
- SHA512 4d0def0cd33012754835b27078d64141503c8762e7fb0f74ac669b8e2768deeba14900feef6174f65b1c3dd2ea0ce9a73bba499275c1c75bcae91cd266262b78
- MD5 SHA1 SHA512
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Berlin
- Size 705B
- SHA256 a7fd9932d785d4d690900b834c3563c1810c1cf2e01711bcc0926af6c0767cb7
- MD5 2577d6d2ba90616ca47c8ee8d9fbca20
- SHA1 e8f7079796d21c70589f90d7682f730ed236afd4
- SHA512 f228ca1ef2756f955566513d7480d779b10b74a8780f2c3f1768730a1a9ae54c5ac44890d0690b59df70c4194a414f276f59bb29389f6fa29719cb06cb946ceb
- TLSH T15E0120325142CA46D19C20F5077468D30F45168D4B9C02FF5739D12B77F03901D420D0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Brussels
- Size 1KB
- SHA256 b10f9542a8509f0a63ebca78e3d80432dd86b8ea296400280febd9cfa76e8288
- MD5 7a350885dea1ebe1bf630eb4254e9abc
- SHA1 5036277ce20a4d75d228cf82a07ed8e56c22e197
- SHA512 524ed4fb0c158a1d526dd9071df7111fb78940d468e964bf63ba5418f9b551ec28c38fa1dc2711415aa31f926d8729eac63d6b1e2946b7942ce822f09d00c5ae
- TLSH T18B11001AA1138BFAF86C74B53A605DC24745368C98BF516DD52C53E951B4F5499024F0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Isle_of_Man
- Size 1KB
- SHA256 676541f0b8ad457c744c093f807589adcad909e3fd03f901787d08786eedbd33
- MD5 d111147703d04769072d1b824d0ddc0c
- SHA1 0c99c01cad245400194d78f9023bd92ee511fbb1
- SHA512 21502d194dfd89ac66f3df6610cb7725936f69faafb6597d4c22cec9d5e40965d05dd7111de9089bc119ec2b701fea664d3cb291b20ae04d59bcbd79e681d07a
- TLSH T17631710B85868B0AD0FC277A3AF3A3056D584588D3AE8161F4ECC3E896FA3095D6D8C0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Podgorica
- Size 478B
- SHA256 a8c964f3eaa7a209d9a650fb16c68c003e9a5fc62ffbbb10fa849d54fb3662d6
- MD5 a4ac1780d547f4e4c41cab4c6cf1d76d
- SHA1 9033138c20102912b7078149abc940ea83268587
- SHA512 7fd5c4598f9d61a3888b4831b0c256ac8c07a5ae28123f969549ae3085a77fece562a09805c44eab7973765d850f6c58f9fcf42582bdd7fd0cdba6cd3d432469
- TLSH T175F0267651228F48D11C94BA1718A91B4FA4530ECB8C03B226A9A91E527CBE4EE060E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Uzhgorod
- Size 558B
- SHA256 0589e80ddecebf9d3077898c12975d2be7393df2856ee9926c534763e1e26bf2
- MD5 f2dfc019c4f320ae616a51ab406e8c70
- SHA1 03ba6cc273c409aaa5c207e0cefbe23b2b0b150e
- SHA512 d5fd4ac155e5cfb26b587d71b3f5997498ae14737c5f5b629fa40e01f32afffb2f6462d74847318c6badcbede9fa775949c8222d418091911425ff5900b8b059
- TLSH T177F09741631BAAEFC30570BABB6B40348E456014436032CA221AC35883F4700FE1C091
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Vatican
- Size 947B
- SHA256 86bd26a06fe3057b36cf29dd7a338f2524aff8116ef08d005aa2114ea6122869
- MD5 c57843caa48aa4715344a26830df1f13
- SHA1 c2f1530fce47b5a7d976f0bd4af28e273a02d706
- SHA512 5e93be3d2a9f4fe6ce98c938cc08ea6c08c36c05ef797c639f97cda82c1bd272e7826df413991929a94a33b8b0c96656f3f96f61d338737ccc26be72388c6408
- TLSH T13C112C20C853FECFC76C55B40A20983A8B81338A3C4E4276D26C631E03F8B1047049B0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Europe\Zurich
- Size 497B
- SHA256 199062b1c30cfeb2375ec84c56df52be51891986a6293b7a124d3a62509f45e9
- MD5 07b0081174b26fd15187b9d6a019e322
- SHA1 f5b9e42b94198a4d6e8a7ae1d4bdd6b7255ce1f6
- SHA512 18916dc499f8b0a600cbe03dca3509465c7693b64c9c27cda3c97d0de7269279b4c9c918c3a9aafc4a3c9f3eab79a521f791dba257aaf436d906aaf4526bd369
- TLSH T142F0C026E053FF43C12C38F81B28FD5A4E50524DBD0C02672798A82F5B7D1606F0A0E0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Indian\Cocos
- Size 187B
- SHA256 e89d835c811d4da44aa8b386782ce8828df085aa0ee8f25661a9881d2f00e90c
- MD5 37f26cf8b8fe9179833e366ca13b8916
- SHA1 da0b9ee83039fcd70fb0d439fac9f453768abc28
- SHA512 60817dde97cea65dd16de8b91d0fd6475a8a2151881a1e3a9a496d143c71509ca6d6f802505cdfd6b8b91f6478717d5509abee8e301a926207a8fac7630bf1db
- TLSH T18BC09200B74128A6F88A137C1A3A024ECD48E854840B12EA2D6814840CBB8D963C10D0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Indian\Mahe
- Size 133B
- SHA256 0d9ea5053e83188032a6fb4d301d5db688f43011e5b6b1f917a11b71a0da7b16
- MD5 667e494c45d181f0706bd07b211c850b
- SHA1 bb2072fbc0357111a7570af852bc873b0f0070e1
- SHA512 57a367ee2efb608cb11fa83d2ce4be99c55f223b717ee9da3d78a5f273a6dc0e8face0d255304d3ab99f1dc7c6155376afb53eda8bc0b8ac481fcd54b3a3313e
- TLSH T16DC00286B74C1847C590137B5E472B999F22D154994252F73D1D30589C9DA81FA220C4
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Israel
- Size 1KB
- SHA256 9fcde8d584dea0585f5c8727aaf35f48a149e0dbd3a83bf6cef8bca9c14021e3
- MD5 9360bb34802002d91d9bba174c25a8dc
- SHA1 fb7e5e8341272ebd89210ece724b9a6c685b8a69
- SHA512 6e0d68f6c58a2f7aba3e1b0d85ccaea46b63695edf7a4476f0b65f7853d3c28b086d5c8a2f0f6e1dc2f7ef6a71b2165e3f07a885e3307c8488ef739ffe429f50
- TLSH T142118629F90B308FE119B17C290742F1CA04C2E77F4914DFD70B430C98F1158DB66981
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\MST
- Size 240B
- SHA256 ae11453c21d08984de75f2efec04dc93178a7b4e23c5e52f2098b8bd45ccb547
- MD5 db536e94d95836d7c5725c3b3c086586
- SHA1 f0c3fb96c02359a66ed4f7000a6ecda3d4a699ec
- SHA512 87aa4f9f8b3b01c4bdc96fe971be12b38e16219f58b741c93a52c369146f6a3ae669e2bff2021403f5c1aee1f216c02d1faeb30012454e1de463c467c7f6b374
- TLSH T110D0800DF3C73715D975663845791141C876C485A54CC6DF261F25125DF551405719C5
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\MST7MDT
- Size 1KB
- SHA256 9bb703920eca4b6119e81a105583a4f6ca220651f13b418479ab7cd56c413f3e
- MD5 c1b9655d5b1ce7fbc9ac213e921acc88
- SHA1 064be7292142a188c73bf9438d382002c373c342
- SHA512 2a188d7bcc48acc17b229e50e136b55dbc59058ae9be6ef217238cd1b6c0a59817954ab98817d2e2ff836a6f7d7461be5850ad73a9096d7a14ce9fd8c2a3c29a
- TLSH T1961120C9AAE1B575E15D543047B3D0800CAC48855F0FC98F20BEB52A8EF6B5936741A9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\NZ
- Size 1KB
- SHA256 0e06e7e55aedbc92ef5b3d106e7c392ab1628cfd8a428b20e92e99028a0bfbb9
- MD5 655680c9ae07d4896919210710185038
- SHA1 fa67d7b3440bbcef845611a51380d34524d5df4a
- SHA512 28ca8023b1091b2630bf46314fa1737ac66a3b464cdd48c2d8300edcb2eb5847710e98e4f63be358e443bfa8ca6dc73a8b3f38fc6df4f7c0ff324520c91bc498
- TLSH T10B114109C4B372F3C725ABFA5A04F629C079684AF61102EAEF9A6195A63040DDD81930
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Pacific\Johnston
- Size 221B
- SHA256 1daa5729aa1e0f32cd44be112d01ad4cc567a9fe76d87dcbb9182be8d2c88ff0
- MD5 5ed332a521639d91536739cfb9e4dde6
- SHA1 0c24de3971dc5c1a3e9ec3bc01556af018c4c9ea
- SHA512 0014e8f2499fe415644e21456f5ca73297c36603de24d60459355a55174e1db81e6929278ccd0df79c750c519d2d6e5ee49019feb63b42f9240c8b8402f3db98
- TLSH T167D08C0CF3A50E06ECD2F23AA287A5C2CC7040446D203683B8AC3F24D7FCA4005A198C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Pacific\Ponape
- Size 134B
- SHA256 522f0f374b61e2c6f5fa7d19f1c7acccd09e4a213462ee3b42c90d32bf2bf18c
- MD5 44355d47052f97ac7388446bce23e3ab
- SHA1 2035f1c7a9ff65687b1e765ce240f701cdc7bc82
- SHA512 3dde34960b8aa19fe30f43588b3ba8a25b256f918a19cd03594e15ca482252eed1e987611fdc6b09997205efe1ceb93cf77e487a2dfea54a21214c66a394a086
- TLSH T114C0029DF76C8856D061537E59AF57409D75D408897783E73819394CAC982D0AB194C1
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Pacific\Port_Moresby
- Size 154B
- SHA256 683001055b6ef9dc9d88734e0eddd1782f1c3643b7c13a75e9cf8e9052006e19
- MD5 bcf8aa818432d7ae244087c7306bcb23
- SHA1 5a91d56826d9fc9bc84c408c581a12127690ed11
- SHA512 d5721c5bf8e1df68fbe2c83bb5cd1edea331f8be7f2a7ef7a6c45f1c656857f2f981adb2c82d8b380c88b1ddea6abb20d692c45403f9562448908637d70fa221
- TLSH T10AC0120162E70C0AC660023505494793DD48D50180062BDB24041199F47D78136000C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Pacific\Samoa
- Size 146B
- SHA256 650d918751366590553063cd681592fdca8a09957e0ce2c18d6697ec385ef796
- MD5 f789c65f289caa627ea1f690836c48f6
- SHA1 dd4dadc39a757b9a02efd931a5e9a877e065441f
- SHA512 f7461e9b6c0af87b45dccc1a8884c47bca59462c9cb5ceac74aebc314cc924c2aebefa993a7466d4d3d4ab3fcdc76c6bc43c7522395f8f053273f55f3eb8305e
- TLSH T1CCC0124065442C82C0F813BD030602405E048C10904112E3A850210DCC560401B05088
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Pacific\Tarawa
- Size 134B
- SHA256 09035620bd831697a3e9072f82de34cfca5e912d50c8da547739aa2f28fb6d8e
- MD5 ba8d62a6ed66f462087e00ad76f7354d
- SHA1 584a5063b3f9c2c1159cebea8ea2813e105f3173
- SHA512 9c5dba4f7c71d5c753895cbfdb01e18b9195f7aad971948eb8e8817b7aca9b7531ca250cdce0e01a5b97ba42c1c9049fd93a2f1ed886ef9779a54babd969f761
- TLSH T146C00280F71818D3C455577E058F17949D57D6418D0287B7398A34CDFD983916B288D0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Singapore
- Size 256B
- SHA256 0954b2d9a301d94f4348024606a71bbcb2fa24d3cd3709f5bc8bca605039785d
- MD5 8a2bb95893137bb40748ef4ecd8d7435
- SHA1 6d65ec8958626477d7cb6ddfc036e70e7949c533
- SHA512 360d4e0ff1f06c63be5abf3d2fc336d5f11e5e0db055999fa856f03344c16d30b7b8b4145e7fb5f8a6bc0b912c4db46b8f66af586fddcb74225228dd1805e6bc
- TLSH T1B5D0129863A5A80EC535A73BDDEA2A02DC57D29A8512023B3C2411C95DB90549F491D6
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\Turkey
- Size 1KB
- SHA256 2a7163b16b94806f69991348e7d0a60c46eb61b1f0305f5f4b83f613db10806f
- MD5 48252c9a797f0f4bea97557a5094cf98
- SHA1 6e6893d64fa2e3249efdb170face5085e5f5945d
- SHA512 f091784b4dd4a9683c5a70194dd957e6bbf3a43a0bc469fa12c9788f1f478256dae78dd7f5eb1b49753f3661893f8dfaf1f988b07a00a0209106d4d231a27bea
- TLSH T1F2218849D16BFABFC719343B216B45BA4DE5871634DD1780D686231150F524C7648D86
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\US\Aleutian
- Size 969B
- SHA256 abfb1980e20d5f84ec5fd881c7580d77a5c6c019f30a383aaa97404212b489e0
- MD5 1df7e605c33529940c76c1c145c52fc5
- SHA1 09c48d350827083bd4579e0cabf5be2ff7bf718b
- SHA512 27af4d1bb570244667132cf8981f62f245b2228518324ecc67867eb15c8440446ddd6f2a221cbb2aeb15adfd955dab01bd708ac2c2723a113aa30839ff6632c6
- TLSH T10F11EB3BA10101D2C6E0243042B3968974F35EB47F5F6FDAAC42B23408B2100ED21B88
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\US\Central
- Size 1KB
- SHA256 c27b739ff46a7df0594e120d725b439217e11e44ea9a50cdc49130383b5482e7
- MD5 85435a33486747b319872947c68317f3
- SHA1 32e3c6ad26d613ef495d7d5d433edfc8314c702b
- SHA512 1c6327903e9a396a278cc15ac97bbcef48b96bdd9e8c6f9948297e9d3eb2aae9692c2714071f6d58c84fbb24d636bf96fd82f1bd424031a53551f8b50f981b2e
- TLSH T18C316319962DB4CFE66185B2498318FD0F74F2D16F2B8413D13A174C26B6F923635C72
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\US\Eastern
- Size 1KB
- SHA256 d7f2206b3a45989fc9ad63d558922532fa7352280d5f87176bf1db79cb1d1fa9
- MD5 763d7a8374a42066d2b0bb81bd47218f
- SHA1 b75087bc45aea07d6c6f9c17ac87eab1ef826f3a
- SHA512 ed227c915d7a595d4247c53d2e5c90a9209d2b1252390464661393ed8d94555e9a968c550c145ba2712f5de4ffd441d81492820a3a361a7203dc53dd3622a430
- TLSH T1ED31639A852978DFDF1189BE1224803CC76834835B3795C6D24D2B006678F9DC969EF2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\US\Indiana-Starke
- Size 1016B
- SHA256 2890b35dcb7c093308b552d82d8781a8ce9a4fa6f9de058283a6836ec1f9f282
- MD5 964fb4bc6d047b2a8826a0734633ab0b
- SHA1 e22e9a86e34a20fbeb4087fd94145b287c28e74f
- SHA512 869203f9854bf2cd0ffcc75f4524965757ecb03879a08e1275404b7eaeb5942eb25dff0f6ca6bfa236e659e2fb315c1b9dfcfc544a59ff7b3cdd6ab6904aa298
- TLSH T15F11FD64566DA0DFDA3095F10A4705F85F70F2CA6F2B8883A86E2B1C1AB57D23B31D21
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\US\Pacific
- Size 1KB
- SHA256 200d05754f6d83a371cf408d7085125797657b3b0bebeba1e508cffe86a3e5c8
- MD5 641e03b9a1178df8c823447ea6563f25
- SHA1 6ef797d8023f26139b78a452f630893c70b4d0b9
- SHA512 c959cea5dddf0edb9c910a1c45a5d2a0e1d406cda39bbc2176d0af76feac26f4358bad4d94bf2abfca4f4f35d518721004be3ddca76432c38e45cff046f8a6cf
- TLSH T19621C806D1040546C8DE23767A7F01770C608284EB2EE7BD147D85901FFB3241E5C2CA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Ghostly\ghosty-iosd\_internal\tzdata\zoneinfo\WET
- Size 1KB
- SHA256 44d2f6cf84737e6a1e0daf914109e94256beca40b40c9a11b7a04e8bddaee4ec
- MD5 811ad23dd5d9f6100864211855fda211
- SHA1 6424d0f2f76f55f4662ea272ee236355b1dd46d3
- SHA512 a0af630b88b325be0c1ed27cc1bb118301acf71241683c72cc1bb1259aaff4d1a0dcf2a6fb26eba1488d2f9adf767abd79f93af6fab8b4383f3c5d1051b0950b
- TLSH T1A631301961348AD0C91C68BEB0278F459F403A2A8B9F0A12EF5C5FC9A171F649D1A1F5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsw866E.tmp\System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsw866E.tmp\modern-wizard.bmp
- Size 150KB
- SHA256 084dec4fa7121522b5cfa4f0e173dfc32d7fc0f064ba3840fd8af51e52a883bd
- MD5 9d883082f562ced2e8d29e61da7d9259
- SHA1 d82195414d44ee387dd596e2c20aa78d0f89ea6b
- SHA512 0a4ade0f6213297cc59f2de5e0138c9cd25acee7874c6571c8697c757c00b0543e991c644752c12554f5f70cc3de0fcbe84f67029fb1ed32186dc60b12c9ee84
- SSDEEP 3072:yD+GIBm4rzzIzzzzczzzzzzizzzzzzzz9zzzzzzzzPzzzzzzzzEzzzzzzzz5zzzQ:ySm4rzzIzzzzczzzzzzizzzzzzzz9zz5
- TLSH T16CE3414177A6E5C9B31C94074F0B5D2C4408A6CDEEFAABED722ACDCEA559702232DC4D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsw866E.tmp\nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsw866E.tmp\nsExec.dll
- Size 7KB
- SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
- MD5 8fe362ffdfa66269b8a64e3a87f68e52
- SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
- SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
- SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
- TLSH T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsw866E.tmp\nsis_tauri_utils.dll
- Size 33KB
- SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
- MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
- SHA1 75197fee3c6a814fe035788d1c34ead39349b860
- SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
- SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
- TLSH T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
- MD5 SHA1 SHA512 SSDEEP TLSH