Overview

overview

8

Static

static

3

Ferns_Installer.exe

windows10-2004-x64

7

Ferns_Installer.exe

windows11-ltsc_2024-x64

8

Resubmissions

05/07/2026, 20:03

260705-yspppabs5n8

05/07/2026, 19:58

260705-yp3r5sbs2k8

05/07/2026, 19:58

260705-ypsbeaa19q

05/07/2026, 19:56

260705-ynph5aa18n7

Analysis

  • user interaction
    yes
  • max time kernel
    152s
  • max time network
    160s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 20:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Ferns_Installer.exe
  • Size 156.5MB
  • Sample260705-yspppabs5n
  • SHA256 57cbd7129a2942910d80bafaaede133eb03e4d5fe1aaa9fdc754f32c7d24b055
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoveryinstallerpersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 50 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ferns_Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Ferns_Installer.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4996
    • C:\Users\Admin\AppData\Local\Temp\is-UO99N85KRF.tmp\Ferns_Installer.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-UO99N85KRF.tmp\Ferns_Installer.tmp" /SL5="$502B6,162626151,1019904,C:\Users\Admin\AppData\Local\Temp\Ferns_Installer.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:4028
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4704
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2380
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1400
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5140

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        is-F4UGJ45ON8.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\AppTempCommon\LuaApp\Components\is-F4UGJ45ON8.tmp
        • Size 93B
        • SHA256 2a302dfa7c7366044a28fed4ed42b4092b04c323b08ac168208b5e830a08a30d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-8ZAMULE4BT.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\LuaSocialLibrariesDeps\is-8ZAMULE4BT.tmp
        • Size 277B
        • SHA256 7796a00b8760b7193ad3726adbc106160b94ad06be0a59472e806ea709f3f27e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-UFOANZSOZB.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\Core\Utility\is-UFOANZSOZB.tmp
        • Size 941B
        • SHA256 e6612e0e7157bf3c3d17fbc99430cbec36626021d3dda1b0f2f2ec17ef72b521
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-OZLACDT1SL.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\UIBlox\is-OZLACDT1SL.tmp
        • Size 255B
        • SHA256 1d9ea87e234d7c2dfe33a497c8a2d2c31894d970c23f6ce40073efe759e15a09
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-HMTU01170A.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\lua-promise-df090464-1bb842c3\is-HMTU01170A.tmp
        • Size 242B
        • SHA256 9ad175f853d1ac7fdd48697aae9499ff562878fd98df6305d240a1b28b5f655d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-8F7Q3X7K1G.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\lua-promise-df090464-1bb842c3\lua-promise\is-8F7Q3X7K1G.tmp
        • Size 9KB
        • SHA256 5b0d1c93121221674960b7dd154c1b364448f2de922a145d93bc6d4121cae0ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        is-3WZQM9Y0YM.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\roact-navigation\is-3WZQM9Y0YM.tmp
        • Size 245B
        • SHA256 69563265d73a4dc6fcd8dc7037f990e50aaf7cf011e32e096ca9e4f5d97a3eca
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-EDA0UKQW98.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\roblox_asset-card\is-EDA0UKQW98.tmp
        • Size 247B
        • SHA256 968e261b51780a92ed1fe2b671b9e18b436c191be1df5a81734468e1c20578d1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-K46QWCABYM.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\roblox_asset-card\is-K46QWCABYM.tmp
        • Size 242B
        • SHA256 ab359dd77408c471bdc9274ab4547bc4ef9c00c404f29079c1340cdc1e1d32bd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-YWV8SJF3HL.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\roblox_cryo\cryo\Dictionary\is-YWV8SJF3HL.tmp
        • Size 86B
        • SHA256 de12d26fa3ecb2ccd974d61e81e38de0ad81fc74414d4f0ca4a836fff1aa05cb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-ECQUMNLX9W.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\roblox_genericpagination\is-ECQUMNLX9W.tmp
        • Size 239B
        • SHA256 40e55b76ba3d9d9d20a16c89b7d3118b67355858a43778217a8abf2a532b4408
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-8SXN4Z4PIZ.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\roblox_iap-experience\is-8SXN4Z4PIZ.tmp
        • Size 247B
        • SHA256 208c19d2a7b9078f39c6e05e7c6dfe4a9b5e7505e37a045670ccf5789c5f079c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-AAE4XCOLAW.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\roblox_infinite-scroller-98304e77-0.5.6\infinite-scroller\Components\is-AAE4XCOLAW.tmp
        • Size 479B
        • SHA256 ff14bfb9735cd84f4fc42a9555591bdaf16b32db623af3749737985d909995f5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-E6SP4YA70S.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\roblox_infinite-scroller-98304e77-0.5.6\infinite-scroller\Components\is-E6SP4YA70S.tmp
        • Size 763B
        • SHA256 5c64fba19fa8f1463161a2ae63223c53fe4b476cb11798c3b8646ee323bedde6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-H0VG6KCJ9R.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\roblox_infinite-scroller-98304e77-0.5.6\infinite-scroller\Components\is-H0VG6KCJ9R.tmp
        • Size 11B
        • SHA256 91d968cb191d306da58f037c6d77a34080f0b07153b96c0a10a10e0033591859
        • MD5 SHA1 SHA512
        Submit Download

        is-DMQS244DVL.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\roblox_networking-users\networking-users\is-DMQS244DVL.tmp
        • Size 1KB
        • SHA256 e0720a05671afc31d0e084d77ca3c3dc7ce70a73082430421a15f224816b2c73
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-NIW5AFPVQ5.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\roblox_networking-users\networking-users\is-NIW5AFPVQ5.tmp
        • Size 112B
        • SHA256 4cb300623ea92cab461551982738574c1c840462a20db4f10180f3c3f704143c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-P20KZOGO09.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\roblox_purchase-prompt-deps\is-P20KZOGO09.tmp
        • Size 279B
        • SHA256 b2b3bea7701e1319ec50b2682bca390d7e4995d36bc9b80925033b1a4ad03376
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-0EF29CVTNJ.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\roblox_purchase-prompt\is-0EF29CVTNJ.tmp
        • Size 259B
        • SHA256 ee2b76b3bf4f07b185a32ca32834a6543ac7e02500d678b753ffcbc03b1ef2c6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-27I4BP3CSS.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\roblox_purchase-prompt\purchase-prompt\Actions\is-27I4BP3CSS.tmp
        • Size 107B
        • SHA256 249e2c590813a8f4ef4acbb0dd049fda5ccffe98ae373f43e38c3c0b1fa4f78d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-SOR4Z7XPGU.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\roblox_purchase-prompt\purchase-prompt\Actions\is-SOR4Z7XPGU.tmp
        • Size 113B
        • SHA256 d0fb8c19897a0fb0535126931f181b6219ff799421d1452c560ca57485fcb0fc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-D6FYHMFZ5D.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\roblox_purchase-prompt\purchase-prompt\Localization\Locales\is-D6FYHMFZ5D.tmp
        • Size 706B
        • SHA256 54439b9542f022d546a2ada7758748406fe9b89641f96411cbe253d9fb168de7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-VPMPAZTG62.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\roblox_roact-gamepad\roact-gamepad\is-VPMPAZTG62.tmp
        • Size 632B
        • SHA256 da001abe84d9ce0f767b8350d0493b5372d13c07285f3ea26fa79f56e9f9f056
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-C4CBFBQ3LG.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\roblox_rodux-a0ab4747-d06ccc8a\rodux\is-C4CBFBQ3LG.tmp
        • Size 264B
        • SHA256 10c508b7b393ad1f0d826befe068b0be96cca79b4966d0c0f181be66f8cca861
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-D9FGIAHDDY.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\roblox_rodux-a0ab4747-d06ccc8a\rodux\is-D9FGIAHDDY.tmp
        • Size 2KB
        • SHA256 96ce1feaa1978b2eca1622a2f5a465ea84222c492aef2697e04d238f44ac975f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-DRD8SVKJED.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\roblox_rodux-a0ab4747-d06ccc8a\rodux\is-DRD8SVKJED.tmp
        • Size 1KB
        • SHA256 495e805fa3011e62edbf2f333316f212fb2a176dd0abe2ce0a84d044246a16ef
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-J5KQFQ712X.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\roblox_rodux-a0ab4747-d06ccc8a\rodux\is-J5KQFQ712X.tmp
        • Size 1KB
        • SHA256 49faff1a64dd19aeb1c9c9572719e7657de451907fd396427c846635785442aa
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-K9RNNZG1WM.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\roblox_rodux-a0ab4747-d06ccc8a\rodux\is-K9RNNZG1WM.tmp
        • Size 493B
        • SHA256 9112ad34ecca4ef942eb930868519b6328a11cfd5a2b519d93002b3e5fd38a57
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-RP8TUWBV4O.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\roblox_rodux-a0ab4747-d06ccc8a\rodux\is-RP8TUWBV4O.tmp
        • Size 178B
        • SHA256 2b5ae697c53843e3a47406bf183a7e6bb11d2d3c6558122e48c7b9928699a2a0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-SZZSOOY1FN.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\roblox_rodux-a0ab4747-d06ccc8a\rodux\is-SZZSOOY1FN.tmp
        • Size 1KB
        • SHA256 93b4f42e6a929cdca91aa0ce852ed8b8dfece2ef638948fabf8ab960ddb5f278
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        loggerMiddleware.spec.lua
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\roblox_rodux-a0ab4747-d06ccc8a\rodux\loggerMiddleware.spec.lua
        • Size 1KB
        • SHA256 c3d600481ef7544a4b53326354269a74916854bb7dd158e10771d13889f75046
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-YZSHQ1JRLR.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\roblox_rodux-users\is-YZSHQ1JRLR.tmp
        • Size 280B
        • SHA256 1a162fb261072bbc9261ef2fe32273cab5f9c07b9e0222d3ee7e5c53ba82a95d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-O7K7IIL7WL.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\rodux-networking-0bf501c2-f322c986\is-O7K7IIL7WL.tmp
        • Size 270B
        • SHA256 8cb6aa6d41f241e088c860714f633def082d8264c2d1318abb580038f54d6216
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-164ZIS8EXG.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\rodux-networking-78851836-f6938ebd\rodux-networking\NetworkStatus\is-164ZIS8EXG.tmp
        • Size 431B
        • SHA256 3eabe75a8daaa45c0f9b83c66899dadc82576b53022078db2c26b45036937ae7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-3EWX2QZUOA.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\rodux-networking-78851836-f6938ebd\rodux-networking\NetworkStatus\is-3EWX2QZUOA.tmp
        • Size 99B
        • SHA256 07578aec1292beffd3811cce7ed09d496253245970feed11596dec4c6dba4456
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-EDD0LAT7CL.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\rodux-networking-78851836-f6938ebd\rodux-networking\NetworkStatus\is-EDD0LAT7CL.tmp
        • Size 227B
        • SHA256 4fc12be217b12d6b163803195bc647d38265ef2afe2dde8dab1d0741701cf160
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-MCXJ3HXAGW.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\rodux-networking-78851836-f6938ebd\rodux-networking\NetworkStatus\is-MCXJ3HXAGW.tmp
        • Size 277B
        • SHA256 aa2d6899ec3f36f3637fb13e4db490e726ee53c88689dc088e33a71b87ccd9b6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-P25WVADLY8.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\rodux-networking-78851836-f6938ebd\rodux-networking\NetworkStatus\is-P25WVADLY8.tmp
        • Size 101B
        • SHA256 6519f59d68989568a88e2f20fffdda72087311daafd8124e3b7829d05ab901a5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-V9OY04PBNL.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\rodux-networking-78851836-f6938ebd\rodux-networking\NetworkStatus\is-V9OY04PBNL.tmp
        • Size 86B
        • SHA256 10d8af321ed223823b0f8c5e2a1de4eac4dab87e3397db8b46abec59f1107e2d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-JGNLXR73RP.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\rodux-networking-78851836-f6938ebd\rodux-networking\RequestBuilder\is-JGNLXR73RP.tmp
        • Size 3KB
        • SHA256 5e73bef439d48980573eea1f52dceb176def1449ff36758029c0b5bf4da6dac0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-LSFPE460PT.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\rodux-networking-78851836-f6938ebd\rodux-networking\RequestBuilder\is-LSFPE460PT.tmp
        • Size 100B
        • SHA256 8ca0e3b50c875b8ece36b159068fd3ca73c677f3ee13ecc287a6f85ebde28903
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-NPTRDE2M8W.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\rodux-networking-78851836-f6938ebd\rodux-networking\RequestBuilder\is-NPTRDE2M8W.tmp
        • Size 39B
        • SHA256 4af127b610dc880d82427ed4f8b752b0800bc9af11995850e33074cbb71b50f3
        • MD5 SHA1 SHA512
        Submit Download

        is-R9FMJB3Y1U.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\rodux-networking-78851836-f6938ebd\rodux-networking\RequestBuilder\is-R9FMJB3Y1U.tmp
        • Size 98B
        • SHA256 063e091b70949bd1e52d57ae6805949d37f53c6f193dae108970c6d01200882b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-8GK9YGW5LS.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\rodux-networking-78851836-f6938ebd\rodux-networking\is-8GK9YGW5LS.tmp
        • Size 94B
        • SHA256 186e3ccd9a001df0eb061577947ec2d8b8b5b26b08a69f4a572b40e86b275f73
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-AL4S6OTPR0.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\rodux-networking-78851836-f6938ebd\rodux-networking\is-AL4S6OTPR0.tmp
        • Size 513B
        • SHA256 b9532584ac376ac0ff794dc49faf6ff46c7fb41b27d6a7f4bade1c6cbe8a2d53
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-DS8AJJOC4N.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\rodux-networking-78851836-f6938ebd\rodux-networking\is-DS8AJJOC4N.tmp
        • Size 91B
        • SHA256 5293c0086c40ddb2cc13d4c3a63310939d36e4688d7108b31bc7d3bd97326db9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-E4FUKWCHYW.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\rodux-networking-78851836-f6938ebd\rodux-networking\is-E4FUKWCHYW.tmp
        • Size 97B
        • SHA256 d724788dd7f461984ce924d751e9d6258a779e66c9c04c9806e83a4b001a1d6f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-I3036Y2BV2.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\rodux-networking-78851836-f6938ebd\rodux-networking\is-I3036Y2BV2.tmp
        • Size 154B
        • SHA256 f29fcd2635b4951684ab6c6774f3f2bdf7b7c50211a4189be589bdebf93c1f0f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-IDX7N90M2S.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\rodux-networking-78851836-f6938ebd\rodux-networking\is-IDX7N90M2S.tmp
        • Size 391B
        • SHA256 1cdbe8651b99a04ffbffcf15f1e12a96d0026a38e5da7eba8344376d71b65855
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-IUL6EEFT4X.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\rodux-networking-78851836-f6938ebd\rodux-networking\is-IUL6EEFT4X.tmp
        • Size 1KB
        • SHA256 30daab8b42dd1733d08d1db1427c63a06b2a26b4b7e7efba91018cb70fbfe7bf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-L4Q7LKHBSE.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\rodux-networking-78851836-f6938ebd\rodux-networking\is-L4Q7LKHBSE.tmp
        • Size 155B
        • SHA256 219258dad492c3446064bea71bc006badee416cf7ecdfbddb3d25dcdf514ae2f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-SOC62VFAQJ.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\rodux-networking-78851836-f6938ebd\rodux-networking\is-SOC62VFAQJ.tmp
        • Size 1KB
        • SHA256 f82e3b36d8204961ababa9be3cdf3304fc531871e0b59524a172096fe8222509
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-PR1CW31FAF.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\rodux-networking-e2ed13e9-8902a6aa\is-PR1CW31FAF.tmp
        • Size 242B
        • SHA256 c1403279db23f924c7b9a5737002d4d9fd39fbf774fb2027822965f5464162c2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-5M7O33N4QS.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\rodux-networking-e2ed13e9-8902a6aa\rodux-networking\NetworkStatus\is-5M7O33N4QS.tmp
        • Size 668B
        • SHA256 673fa1519ce542d1c8fb6edb56d011e06d9fe7f50097f3be5a6ff704aa7a7db7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-B7R5BY822N.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\rodux-networking-e2ed13e9-8902a6aa\rodux-networking\NetworkStatus\is-B7R5BY822N.tmp
        • Size 100B
        • SHA256 530d0c8472b0879a6674e9bd743bced935e8e9c8111e82e5080a966ea5431e20
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-PGAY6KL4XQ.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\rodux-networking-e2ed13e9-8902a6aa\rodux-networking\NetworkStatus\is-PGAY6KL4XQ.tmp
        • Size 635B
        • SHA256 7726cb609cf22c037e02ccb0701f6cc218bb76cda5c3a35fc38bb563d79146f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-FHEB87O4TI.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\Packages\_Index\rodux-networking-e2ed13e9-8902a6aa\rodux-networking\is-FHEB87O4TI.tmp
        • Size 93B
        • SHA256 2e74892968e4e166e80c6da97c585e39918ee6e9c614f42ec9e3e1a724428b5b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-78NUO5DQ04.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\LuaPackages\RoactUtilities\is-78NUO5DQ04.tmp
        • Size 207B
        • SHA256 0e9c0118853f1e532c8d685ba49f866db0d985d4eb75bf0f08e5fb906f0a3821
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-18UZHIM0IT.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\textures\ui\LuaApp\graphic\is-18UZHIM0IT.tmp
        • Size 71KB
        • SHA256 1a03e6f6a0de045aa588544c392d671c040b82a5598b4246af04f5a74910dc89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        is-M1N8EWJ74Q.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\textures\ui\LuaApp\graphic\is-M1N8EWJ74Q.tmp
        • Size 20KB
        • SHA256 fc57f32c26087eef61b37850d60934eda1100ca8773f08e487191a74766053d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        is-C6EL0KUD0P.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\ExtraContent\textures\ui\LuaDiscussions\is-C6EL0KUD0P.tmp
        • Size 247B
        • SHA256 0a6a5cafb4dee0d8c1d182ddec9f68ca0471d7fc820cf8dc2d68f27a35cd3386
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-5TICA0CYR8.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\PlatformContent\pc\textures\cobblestone\is-5TICA0CYR8.tmp
        • Size 176B
        • SHA256 ff11c95774ee0405666fa313f1e53ebb46b1352bfff3456ac2b2caccdab07b4d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-2XC9VYO3AQ.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\content\configs\DateTimeLocaleConfigs\is-2XC9VYO3AQ.tmp
        • Size 2KB
        • SHA256 39c368d993bba3f5ed4a5912705ded57293b4a908c1379d2883f9bd65cd4deea
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-7O17VRBYCM.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\content\configs\DateTimeLocaleConfigs\is-7O17VRBYCM.tmp
        • Size 2KB
        • SHA256 5d588b6cb27cfcf985e460635ec1b331d090345455592c4ab7a1d4e82dba4c03
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-RVJI5HWSA8.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\content\textures\MorpherEditor\is-RVJI5HWSA8.tmp
        • Size 546B
        • SHA256 993e3655350f2292ce54b472f355aaf42d0d71fde4ffea717d0b9875f6dd204e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-1BO049GZUX.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\content\textures\StudioUIEditor\is-1BO049GZUX.tmp
        • Size 130B
        • SHA256 630303ec4701779eaf86cc9fbf744b625becda53badc7271cbb6ddc56e638d70
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-DKI8F09OIA.tmp
        • Path C:\Users\Admin\AppData\Local\Ferns\Client\content\textures\TerrainTools\is-DKI8F09OIA.tmp
        • Size 985B
        • SHA256 c7bae6d856f3bd9f00c122522eb3534d0d198a9473b6a379a5c3458181870646
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 599B
        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Ferns_Installer.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-UO99N85KRF.tmp\Ferns_Installer.tmp
        • Size 3.7MB
        • SHA256 34826c370a10e036f8edaf778ee7a5ef5c337a499a99f052df8e602b27610a66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1400-6805-0x0000023494200000-0x0000023494220000-memory.dmp
        Download

        memory/1400-6772-0x0000023493E80000-0x0000023493F80000-memory.dmp
        Download

        memory/1400-6771-0x0000023483920000-0x0000023483940000-memory.dmp
        Download

        memory/1400-6791-0x0000023483C80000-0x0000023483CA0000-memory.dmp
        Download

        memory/1400-6709-0x00000234801E0000-0x00000234802E0000-memory.dmp
        Download

        memory/2380-9409-0x000000000E760000-0x000000000EFDB000-memory.dmp
        Download

        memory/2380-9173-0x000000000E760000-0x000000000EFDB000-memory.dmp
        Download

        memory/4028-6865-0x0000000000D80000-0x0000000001144000-memory.dmp
        Download

        memory/4028-679-0x0000000000CD0000-0x0000000000CD1000-memory.dmp
        Download

        memory/4028-6-0x0000000000CD0000-0x0000000000CD1000-memory.dmp
        Download

        memory/4028-9408-0x0000000000D80000-0x0000000001144000-memory.dmp
        Download

        memory/4028-668-0x0000000000D80000-0x0000000001144000-memory.dmp
        Download

        memory/4028-9444-0x0000000000D80000-0x0000000001144000-memory.dmp
        Download

        memory/4996-0-0x0000000000F90000-0x0000000001098000-memory.dmp
        Download

        memory/4996-663-0x0000000000F90000-0x0000000001098000-memory.dmp
        Download

        memory/4996-9445-0x0000000000F90000-0x0000000001098000-memory.dmp
        Download