Overview

overview

7

Static

static

3

Linken Sph...up.exe

windows11-21h2-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    173s
  • max time network
    173s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/10/2026, 18:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Linken Sphere 2 Setup.exe
  • Size 1.7MB
  • Sample261002-wneb2sfd97
  • SHA256 524056005fdf43fcff61ee1a6f3d7714fc83ac1abed64564a82c0d1ba02ef021
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutioninstaller

Malware Config

Signatures

  • Executes dropped EXE 15 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks system information in the registry 2 TTPs 1 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Linken Sphere 2 Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Linken Sphere 2 Setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4792
    • C:\Users\Admin\AppData\Local\Temp\is-BU3KQ.tmp\Linken Sphere 2 Setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-BU3KQ.tmp\Linken Sphere 2 Setup.tmp" /SL5="$70242,806912,806912,C:\Users\Admin\AppData\Local\Temp\Linken Sphere 2 Setup.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4420
      • C:\Users\Admin\AppData\Local\Temp\is-MTAIO.tmp\_isetup\_setup64.tmp
        helper 105 0x688
        3⤵
        • Executes dropped EXE
        PID:3788
      • C:\Program Files (x86)\Linken Sphere 2\Linken Sphere 2.exe
        "C:\Program Files (x86)\Linken Sphere 2\Linken Sphere 2.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks system information in the registry
        • Reads the TCP/IP host and domain name from the registry
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5268
        • C:\Program Files (x86)\Linken Sphere 2\Linken Sphere 2.exe
          "C:\Program Files (x86)\Linken Sphere 2\Linken Sphere 2.exe" --splash 692
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4600
        • C:\Program Files (x86)\Linken Sphere 2\ls_crashpad_handler.exe
          "C:\Program Files (x86)\Linken Sphere 2\ls_crashpad_handler.exe" --no-rate-limit "--database=C:\Users\Admin\AppData\Roaming\Linken Sphere\.sentry-native" "--metrics-dir=C:\Users\Admin\AppData\Roaming\Linken Sphere\.sentry-native" --url=https://o4506625583284224.ingest.sentry.io:443/api/4506625688797184/minidump/?sentry_client=sentry.native/0.7.0&sentry_key=4d21e0d2facf2f37f13afbadb0ee9a5c "--attachment=C:\Users\Admin\AppData\Roaming\Linken Sphere\.sentry-native\880d3dde-2e47-48b4-4b83-8401b4033cfa.run\__sentry-event" "--attachment=C:\Users\Admin\AppData\Roaming\Linken Sphere\.sentry-native\880d3dde-2e47-48b4-4b83-8401b4033cfa.run\__sentry-breadcrumb1" "--attachment=C:\Users\Admin\AppData\Roaming\Linken Sphere\.sentry-native\880d3dde-2e47-48b4-4b83-8401b4033cfa.run\__sentry-breadcrumb2" --initial-client-data=0x3c0,0x3c4,0x3c8,0x39c,0x3cc,0x7fff0c200ff0,0x7fff0c201010,0x7fff0c201028
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3636
        • C:\Program Files (x86)\Linken Sphere 2\Linken Sphere 2.exe
          "C:\Program Files (x86)\Linken Sphere 2\Linken Sphere 2.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Roaming\Linken Sphere" --log-severity=disable --gpu-preferences=WAAAAAAAAADgABAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2088,i,7173320913533053874,4332816169730888506,262144 --disable-features=DisallowLegacyPrefMacFallback,PrintCompositorLPAC --variations-seed-version --enable-logging=handle --log-file=2092 --mojo-platform-channel-handle=2084 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4900
        • C:\Program Files (x86)\Linken Sphere 2\Linken Sphere 2.exe
          "C:\Program Files (x86)\Linken Sphere 2\Linken Sphere 2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Roaming\Linken Sphere" --log-severity=disable --field-trial-handle=2148,i,7173320913533053874,4332816169730888506,262144 --disable-features=DisallowLegacyPrefMacFallback,PrintCompositorLPAC --variations-seed-version --enable-logging=handle --log-file=2360 --mojo-platform-channel-handle=2260 /prefetch:11
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Time Discovery
          • Suspicious use of WriteProcessMemory
          PID:5824
          • C:\Program Files (x86)\Linken Sphere 2\ls_crashpad_handler.exe
            "C:\Program Files (x86)\Linken Sphere 2\ls_crashpad_handler.exe" --no-rate-limit "--database=C:\Users\Admin\AppData\Roaming\Linken Sphere\.sentry-native" "--metrics-dir=C:\Users\Admin\AppData\Roaming\Linken Sphere\.sentry-native" --url=https://o4506625583284224.ingest.sentry.io:443/api/4506625688797184/minidump/?sentry_client=sentry.native/0.7.0&sentry_key=4d21e0d2facf2f37f13afbadb0ee9a5c "--attachment=C:\Users\Admin\AppData\Roaming\Linken Sphere\.sentry-native\0481a4cc-acac-4062-b2b4-cab69a04560a.run\__sentry-event" "--attachment=C:\Users\Admin\AppData\Roaming\Linken Sphere\.sentry-native\0481a4cc-acac-4062-b2b4-cab69a04560a.run\__sentry-breadcrumb1" "--attachment=C:\Users\Admin\AppData\Roaming\Linken Sphere\.sentry-native\0481a4cc-acac-4062-b2b4-cab69a04560a.run\__sentry-breadcrumb2" --initial-client-data=0x3a8,0x3ac,0x3b0,0x384,0x3b4,0x7fff0c200ff0,0x7fff0c201010,0x7fff0c201028
            5⤵
            • Executes dropped EXE
            PID:2200
        • C:\WINDOWS\system32\cmd.exe
          /c netstat -na | find "9100"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5704
          • C:\Windows\system32\NETSTAT.EXE
            netstat -na
            5⤵
            • Gathers network information
            • Suspicious use of AdjustPrivilegeToken
            PID:4852
          • C:\Windows\system32\find.exe
            find "9100"
            5⤵
              PID:404
          • C:\Program Files (x86)\Linken Sphere 2\Linken Sphere 2.exe
            "C:\Program Files (x86)\Linken Sphere 2\Linken Sphere 2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Roaming\Linken Sphere" --log-severity=disable --field-trial-handle=2380,i,7173320913533053874,4332816169730888506,262144 --disable-features=DisallowLegacyPrefMacFallback,PrintCompositorLPAC --variations-seed-version --enable-logging=handle --log-file=3272 --mojo-platform-channel-handle=3284 /prefetch:13
            4⤵
            • Executes dropped EXE
            PID:6108
          • C:\Program Files (x86)\Linken Sphere 2\Linken Sphere 2.exe
            "C:\Program Files (x86)\Linken Sphere 2\Linken Sphere 2.exe" --type=renderer --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Roaming\Linken Sphere" --log-severity=disable --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3856,i,7173320913533053874,4332816169730888506,262144 --disable-features=DisallowLegacyPrefMacFallback,PrintCompositorLPAC --variations-seed-version --enable-logging=handle --log-file=3924 --mojo-platform-channel-handle=3920 /prefetch:1
            4⤵
            • Executes dropped EXE
            PID:5912
          • C:\Program Files (x86)\Linken Sphere 2\Linken Sphere 2.exe
            "C:\Program Files (x86)\Linken Sphere 2\Linken Sphere 2.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Roaming\Linken Sphere" --log-severity=disable --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3864,i,7173320913533053874,4332816169730888506,262144 --disable-features=DisallowLegacyPrefMacFallback,PrintCompositorLPAC --variations-seed-version --enable-logging=handle --log-file=4040 --mojo-platform-channel-handle=3944 /prefetch:1
            4⤵
            • Executes dropped EXE
            PID:5380
          • C:\Program Files (x86)\Linken Sphere 2\tor_expert_bundle\tor\ls_tor.exe
            "C:\Program Files (x86)\Linken Sphere 2\tor_expert_bundle\tor\ls_tor.exe" --SocksPort 9100 --DataDirectory "C:\Users\Admin\AppData\Roaming\Linken Sphere\tor_cache"
            4⤵
            • Executes dropped EXE
            PID:4660
          • C:\Program Files (x86)\Linken Sphere 2\Linken Sphere 2.exe
            "C:\Program Files (x86)\Linken Sphere 2\Linken Sphere 2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Roaming\Linken Sphere" --log-severity=disable --field-trial-handle=700,i,7173320913533053874,4332816169730888506,262144 --disable-features=DisallowLegacyPrefMacFallback,PrintCompositorLPAC --variations-seed-version --enable-logging=handle --log-file=4280 --mojo-platform-channel-handle=4308 /prefetch:12
            4⤵
            • Executes dropped EXE
            PID:1116
          • C:\Program Files (x86)\Linken Sphere 2\Linken Sphere 2.exe
            "C:\Program Files (x86)\Linken Sphere 2\Linken Sphere 2.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Roaming\Linken Sphere" --log-severity=disable --field-trial-handle=3592,i,7173320913533053874,4332816169730888506,262144 --disable-features=DisallowLegacyPrefMacFallback,PrintCompositorLPAC --variations-seed-version --enable-logging=handle --log-file=4772 --mojo-platform-channel-handle=4768 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • Suspicious use of WriteProcessMemory
            PID:4508
            • C:\Program Files (x86)\Linken Sphere 2\ls_crashpad_handler.exe
              "C:\Program Files (x86)\Linken Sphere 2\ls_crashpad_handler.exe" --no-rate-limit "--database=C:\Users\Admin\AppData\Roaming\Linken Sphere\.sentry-native" "--metrics-dir=C:\Users\Admin\AppData\Roaming\Linken Sphere\.sentry-native" --url=https://o4506625583284224.ingest.sentry.io:443/api/4506625688797184/minidump/?sentry_client=sentry.native/0.7.0&sentry_key=4d21e0d2facf2f37f13afbadb0ee9a5c "--attachment=C:\Users\Admin\AppData\Roaming\Linken Sphere\.sentry-native\69da0182-a771-4b7c-63b9-133e8ed0eba5.run\__sentry-event" "--attachment=C:\Users\Admin\AppData\Roaming\Linken Sphere\.sentry-native\69da0182-a771-4b7c-63b9-133e8ed0eba5.run\__sentry-breadcrumb1" "--attachment=C:\Users\Admin\AppData\Roaming\Linken Sphere\.sentry-native\69da0182-a771-4b7c-63b9-133e8ed0eba5.run\__sentry-breadcrumb2" --initial-client-data=0x3a8,0x3ac,0x3b0,0x384,0x3b4,0x7fff0c200ff0,0x7fff0c201010,0x7fff0c201028
              5⤵
              • Executes dropped EXE
              PID:3388
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
      1⤵
        PID:4832

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            SQLiteCpp.dll
            • Path C:\Program Files (x86)\Linken Sphere 2\SQLiteCpp.dll
            • Size 64KB
            • SHA256 959ea961fd69ca3a653623bf654b74bcf0a0728543d50f7f2c985967b33ce8cc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ChromeExtMalware.store
            • Path C:\Program Files (x86)\Linken Sphere 2\Safe Browsing\ChromeExtMalware.store
            • Size 1.9MB
            • SHA256 a648f61626fcf320d4fa5940adaf12651d46603dbd37f9d00a3f8667db80a358
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            unins000.exe
            • Path C:\Program Files (x86)\Linken Sphere 2\Uninstall\unins000.exe
            • Size 3.2MB
            • SHA256 2fc36873719fb599700a58765acd3d30b4ad91d6eaf3d17e97f660fa835fdb45
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            abseil_dll.dll
            • Path C:\Program Files (x86)\Linken Sphere 2\abseil_dll.dll
            • Size 1.7MB
            • SHA256 1581f37dfdcccdbfbccbfaad2522b8bcf7ae24d7ad06f6aa161053f09e5f5e99
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bz2.dll
            • Path C:\Program Files (x86)\Linken Sphere 2\bz2.dll
            • Size 73KB
            • SHA256 47d677be0c3c936a12ff7bcaf8e224d05dfaacd67537b09e4448b910d28ffdaf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cares.dll
            • Path C:\Program Files (x86)\Linken Sphere 2\cares.dll
            • Size 144KB
            • SHA256 f9a0c98287ef2e1498e0413a9539be5483ba6f38e788168e31de66ea2d85a11e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_elf.dll
            • Path C:\Program Files (x86)\Linken Sphere 2\chrome_elf.dll
            • Size 1.3MB
            • SHA256 84395bc3b0078e211fcc832b6461c2f051d7ba266dc96f389f6ac8516b8a3af4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            af_MASCULINE.pak
            • Path C:\Program Files (x86)\Linken Sphere 2\chromium-bin\154.0.8037.58\Locales\af_MASCULINE.pak
            • Size 18B
            • SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
            • MD5 SHA1 SHA512
            Submit Download

            libcrypto-3-x64.dll
            • Path C:\Program Files (x86)\Linken Sphere 2\libcrypto-3-x64.dll
            • Size 4.5MB
            • SHA256 01cd7a0a11b8ac85238f83ad74318be71f4739cfcab2b8c8112e3e4a2b3c76db
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libprotobuf.dll
            • Path C:\Program Files (x86)\Linken Sphere 2\libprotobuf.dll
            • Size 2.4MB
            • SHA256 8e193d23445ca35d184095331914922349444d03d7643bcd5f0c1816d8a2c63c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libssl-3-x64.dll
            • Path C:\Program Files (x86)\Linken Sphere 2\libssl-3-x64.dll
            • Size 762KB
            • SHA256 125fe0c6c7ad9d9390be33e36187c1559509827d76c19d1871e3c4c8de2d379f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libzippp.dll
            • Path C:\Program Files (x86)\Linken Sphere 2\libzippp.dll
            • Size 50KB
            • SHA256 ec0faf53d7ffb05fe4ab339f4e2ae8e2c1e007c3d94faa2c45c80678144f5506
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ls_crashpad_handler.exe
            • Path C:\Program Files (x86)\Linken Sphere 2\ls_crashpad_handler.exe
            • Size 563KB
            • SHA256 99e388a29a60d6935866eb495c0dfa83cd621b68a3a9f65400dc4ef07b5723b9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msvcp140.dll
            • Path C:\Program Files (x86)\Linken Sphere 2\msvcp140.dll
            • Size 566KB
            • SHA256 cb3c74d6fcc091f4eb7c67ee5eb5f76c1c973dea8b1c6b851fcca62c2a9d8aa8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            re2.dll
            • Path C:\Program Files (x86)\Linken Sphere 2\re2.dll
            • Size 1.0MB
            • SHA256 9f3d8cf3247c62697adfaea916ad40a45c79cb4143620bf168df847391eda7b8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sentry.dll
            • Path C:\Program Files (x86)\Linken Sphere 2\sentry.dll
            • Size 270KB
            • SHA256 222f1d8c27a8567bdc8c9d3f73095b25a4f5e233f8148d60a66c83f030f0882b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sqlite3.dll
            • Path C:\Program Files (x86)\Linken Sphere 2\sqlite3.dll
            • Size 1.0MB
            • SHA256 7e45813f820fafe73792d2b384254835bee1f6dbddb70ed7de4e57a08be52d49
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ls_tor.exe
            • Path C:\Program Files (x86)\Linken Sphere 2\tor_expert_bundle\tor\ls_tor.exe
            • Size 8.1MB
            • SHA256 3b2b11c7e54ff4e46eacd35eb7184afb6a064b5310da1f8b4e8aeb832f3a1ff5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcruntime140.dll
            • Path C:\Program Files (x86)\Linken Sphere 2\vcruntime140.dll
            • Size 106KB
            • SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcruntime140_1.dll
            • Path C:\Program Files (x86)\Linken Sphere 2\vcruntime140_1.dll
            • Size 48KB
            • SHA256 e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vk_swiftshader_icd.json
            • Path C:\Program Files (x86)\Linken Sphere 2\vk_swiftshader_icd.json
            • Size 106B
            • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            zip.dll
            • Path C:\Program Files (x86)\Linken Sphere 2\zip.dll
            • Size 108KB
            • SHA256 2b638416e413924ad4e225d360e0ef5855f34076d83722f76774b61f29894b31
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            zlib1.dll
            • Path C:\Program Files (x86)\Linken Sphere 2\zlib1.dll
            • Size 87KB
            • SHA256 66bd6bd96d6b0f35d2bfec1e860be6c2cc60e392458942b281e9d630bb0ed92f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            zstd.dll
            • Path C:\Program Files (x86)\Linken Sphere 2\zstd.dll
            • Size 634KB
            • SHA256 7425fcceca72233ee76287c1dd1784e45f170159a8fdfd7c562afa30220cc62e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Linken Sphere 2 Setup.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\is-BU3KQ.tmp\Linken Sphere 2 Setup.tmp
            • Size 3.1MB
            • SHA256 9f77b4333d7b826cfc3fd0da049d047f90d0ab34afceb28b3604dc51e9df11a9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _setup64.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\is-MTAIO.tmp\_isetup\_setup64.tmp
            • Size 6KB
            • SHA256 388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            settings.dat
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\.sentry-native\settings.dat
            • Size 40B
            • SHA256 bfc7409954dd5dbb8f04d7ba2ae14524941c2e39e873b4aa9c06297cabd87e9c
            • MD5 SHA1 SHA512
            Submit Download

            5ded11f9-5e39-4943-b5f0-8a774976a4db.tmp
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\5ded11f9-5e39-4943-b5f0-8a774976a4db.tmp
            • Size 2KB
            • SHA256 746f3d6882b0a04ee7cc2d8fac88dbe166dd8d158631b85e062b80eed8061a6f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            8fb5c914-5f0f-4c58-9837-57657181bcea.tmp
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\8fb5c914-5f0f-4c58-9837-57657181bcea.tmp
            • Size 1KB
            • SHA256 dd7d308a697561f32a2421f0972f5e1e8e016d7a578c6a5d8b6da6356752457a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            364e2246-dd2e-4b8e-bd2c-b9ae9777aec6.tmp
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\Default\364e2246-dd2e-4b8e-bd2c-b9ae9777aec6.tmp
            • Size 7KB
            • SHA256 dd7e22bb559a2e0c23150b43e5d6376b3ecf195006c4f37bb49535bb8a3dcc29
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            47084ee2-4768-4cfb-b2b5-57627e5d84ae.tmp
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\Default\47084ee2-4768-4cfb-b2b5-57627e5d84ae.tmp
            • Size 7KB
            • SHA256 a211b0ee7141de433a57ad57eef5911ea78ca2ec6fde3cc8ffaa12e173c13480
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Network Persistent State
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\Default\Network\Network Persistent State
            • Size 59B
            • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            SCT Auditing Pending Reports
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\Default\Network\SCT Auditing Pending Reports
            • Size 2B
            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
            • MD5 SHA1 SHA512
            Submit Download

            ef79ab10-f951-4195-80d9-1866c2385df6.tmp
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\Default\Network\ef79ab10-f951-4195-80d9-1866c2385df6.tmp
            • Size 652B
            • SHA256 d67340bb2dcf3b441749863cc3726cbea1de65b9c9e9aa9b49cf030f282f9860
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\Default\Preferences
            • Size 7KB
            • SHA256 8e4254a9b9db4902debdab9be2fc4c80bd1c257b2c31d16603eb163e538aeed3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MANIFEST-000001
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\Default\Site Characteristics Database\MANIFEST-000001
            • Size 41B
            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
            • MD5 SHA1 SHA512
            Submit Download

            CURRENT
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\Default\Sync Data\LevelDB\CURRENT
            • Size 16B
            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
            • MD5 SHA1 SHA512
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\Local State
            • Size 890B
            • SHA256 82efdd5d1017f508979dbeecfa54f2db2ae3cbcc3f4e7a2554044c2ae884efc9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ChromeUrlClientIncident.store
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\Safe Browsing\ChromeUrlClientIncident.store
            • Size 717B
            • SHA256 5fd1ef6f94975a2d0300084db01d9c591566bdce06b4acfed0f4b3780792aedf
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            IpMalware.store
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\Safe Browsing\IpMalware.store
            • Size 106B
            • SHA256 3d5c2fe68b30d6e5a487be700c862ec6710984dd6df51e6798e4376d4f13076c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            UrlBilling.store
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\Safe Browsing\UrlBilling.store
            • Size 49KB
            • SHA256 eb4a79d15f58ec5737d9769462929aedffb2d3ad01c53b18a36a4cda7f49f0cf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UrlCsdAllowlist.store
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\Safe Browsing\UrlCsdAllowlist.store
            • Size 4KB
            • SHA256 d40d4b8adbadcecc2f711457c6be5af503a5ceb0799da809b17bd944a2c7ce18
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UrlCsdDownloadAllowlist.store
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\Safe Browsing\UrlCsdDownloadAllowlist.store
            • Size 33KB
            • SHA256 cd14b119e9cf6d6bc657f2f7f3c8541a42fa3d8ee3343a4978e2d908cbfaa34d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UrlHighConfidenceAllowlist.store
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\Safe Browsing\UrlHighConfidenceAllowlist.store
            • Size 308KB
            • SHA256 20b6d131c96f64709e9b832d923e2936f00affe21249f85d0ffb3b24c65796d7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UrlMalBin.store
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\Safe Browsing\UrlMalBin.store
            • Size 1015KB
            • SHA256 5bb23989747231ad03ac8444082905fe944f5bb03f9e43f7651fa5aac33be929
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UrlMalware.store
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\Safe Browsing\UrlMalware.store
            • Size 279KB
            • SHA256 0ccb1f95abb628e03c88497183e6a6ff805e65cadf005ab73699542aa86c63d3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UrlSoceng.store
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\Safe Browsing\UrlSoceng.store
            • Size 27.6MB
            • SHA256 3b1b737f204bbc63c4f3a920842908a1c4c7ecf64f79c7bdce4c051a099256cf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UrlSubresourceFilter.store
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\Safe Browsing\UrlSubresourceFilter.store
            • Size 154KB
            • SHA256 b0f0bd3e924f3012030620e96bb673c6d193dbc3fe803e86c3c1e70a87474840
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UrlSuspiciousSite.store
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\Safe Browsing\UrlSuspiciousSite.store
            • Size 13KB
            • SHA256 e19be4aa49eef0373a658c916cecf3e6fdac9aaa93def40c2bb261d9d9ae5f32
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UrlUws.store
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\Safe Browsing\UrlUws.store
            • Size 127KB
            • SHA256 219c710fb55846318cf3d110a184080d8c4cd35cca76cb2ed0f1928e62fb514e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f0256de9-2644-4ee7-a77a-d1764ae5e31f.tmp
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\f0256de9-2644-4ee7-a77a-d1764ae5e31f.tmp
            • Size 2KB
            • SHA256 fb7fb4f31d55c0fb2df310fca198ddfc55c4993867e779a0ea3489e62e06336b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            cached-microdescs.new
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\tor_cache\cached-microdescs.new
            • Size 10.6MB
            • SHA256 649190e99f06dd1ed1390e9b4ae0e2b4e15b971e6dd4855bb694675e7ea636eb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            state
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\tor_cache\state
            • Size 232B
            • SHA256 f69ac406aa20c7796994f6ead7b81f94a33d4a35dfa93e522fe559eea437b463
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            unverified-microdesc-consensus
            • Path C:\Users\Admin\AppData\Roaming\Linken Sphere\tor_cache\unverified-microdesc-consensus
            • Size 3.2MB
            • SHA256 f111dcbe4c8f223ebe1ffda9c2689410b07c2b5f5533c3bf3dabf3a4a52e82a6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/4420-5-0x0000000000CF0000-0x0000000000CF1000-memory.dmp
            Download

            memory/4420-1880-0x0000000000D60000-0x0000000001092000-memory.dmp
            Download

            memory/4420-11-0x0000000000D60000-0x0000000001092000-memory.dmp
            Download

            memory/4420-11348-0x0000000000D60000-0x0000000001092000-memory.dmp
            Download

            memory/4420-30-0x0000000000D60000-0x0000000001092000-memory.dmp
            Download

            memory/4420-8-0x0000000000D60000-0x0000000001092000-memory.dmp
            Download

            memory/4420-9-0x0000000000CF0000-0x0000000000CF1000-memory.dmp
            Download

            memory/4420-11264-0x0000000000D60000-0x0000000001092000-memory.dmp
            Download

            memory/4792-0-0x0000000000FC0000-0x0000000001093000-memory.dmp
            Download

            memory/4792-7-0x0000000000FC0000-0x0000000001093000-memory.dmp
            Download

            memory/4792-11349-0x0000000000FC0000-0x0000000001093000-memory.dmp
            Download

            memory/5380-11552-0x0000023C713F0000-0x0000023C71493000-memory.dmp
            Download

            memory/5380-11583-0x0000023C713F0000-0x0000023C71493000-memory.dmp
            Download

            memory/5912-11551-0x0000022B14110000-0x0000022B141B3000-memory.dmp
            Download

            memory/6108-11543-0x0000017C73D20000-0x0000017C73DC3000-memory.dmp
            Download

            memory/6108-11401-0x00007FFF1B6F0000-0x00007FFF1B6F1000-memory.dmp
            Download

            memory/6108-11402-0x00007FFF1B700000-0x00007FFF1B701000-memory.dmp
            Download

            memory/6108-11728-0x0000017C73D20000-0x0000017C73DC3000-memory.dmp
            Download