LegionLoader IE Registry Enumeration for Sandbox Detection

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

Detects when a process, not identified as a standard web browser, queries specific Internet Explorer or Internet Settings registry keys from suspicious file paths (AppData\Roaming, AppData\Local\Temp, Temp). This behavior could indicate an attempt by malware or an attacker to gather browser-related information or modify settings.