Overview

overview

8

Static

static

3

LarpLedger (1).zip

windows10-2004-x64

1

LarpLedger (1).zip

windows11-ltsc_2024-x64

1

ledgerfile...m.html

windows10-2004-x64

3

ledgerfile...m.html

windows11-ltsc_2024-x64

4

ledgerfile...ta.exe

windows10-2004-x64

7

ledgerfile...ta.exe

windows11-ltsc_2024-x64

7

ledgerfile...ta.exe

windows10-2004-x64

7

ledgerfile...ta.exe

windows11-ltsc_2024-x64

7

ledgerfile...nt.pak

windows10-2004-x64

3

ledgerfile...nt.pak

windows11-ltsc_2024-x64

3

ledgerfile...nt.pak

windows10-2004-x64

3

ledgerfile...nt.pak

windows11-ltsc_2024-x64

3

ledgerfile...47.dll

windows10-2004-x64

1

ledgerfile...eg.dll

windows10-2004-x64

1

ledgerfile...eg.dll

windows11-ltsc_2024-x64

1

ledgerfile...tl.dat

windows10-2004-x64

3

ledgerfile...tl.dat

windows11-ltsc_2024-x64

3

ledgerfile...af.pak

windows10-2004-x64

3

ledgerfile...af.pak

windows11-ltsc_2024-x64

8

ledgerfile...am.pak

windows10-2004-x64

3

ledgerfile...am.pak

windows11-ltsc_2024-x64

3

ledgerfile...ar.pak

windows10-2004-x64

3

ledgerfile...ar.pak

windows11-ltsc_2024-x64

8

ledgerfile...bg.pak

windows10-2004-x64

3

ledgerfile...bg.pak

windows11-ltsc_2024-x64

3

ledgerfile...bn.pak

windows10-2004-x64

3

ledgerfile...bn.pak

windows11-ltsc_2024-x64

3

ledgerfile...ca.pak

windows10-2004-x64

3

ledgerfile...ca.pak

windows11-ltsc_2024-x64

3

ledgerfile...cs.pak

windows10-2004-x64

3

ledgerfile...cs.pak

windows11-ltsc_2024-x64

3

ledgerfile...da.pak

windows10-2004-x64

3

Analysis

  • max time kernel
    152s
  • max time network
    162s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/06/2026, 03:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ledgerfiles/Ledger Live Beta.exe
  • Size 155.8MB
  • Sample260624-egekssh15m
  • SHA256 76151bb3449ee759a4b92455eb960dfa083ab2b8c97fa597e1e3735def8ad60a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ledgerfiles\Ledger Live Beta.exe
    "C:\Users\Admin\AppData\Local\Temp\ledgerfiles\Ledger Live Beta.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5664
    • C:\Users\Admin\AppData\Local\Temp\ledgerfiles\Ledger Live Beta.exe
      "C:\Users\Admin\AppData\Local\Temp\ledgerfiles\Ledger Live Beta.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Ledger Live Beta" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1676 --field-trial-handle=1680,i,13064392901978591516,1997064686012024831,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
        PID:2920
      • C:\Users\Admin\AppData\Local\Temp\ledgerfiles\Ledger Live Beta.exe
        "C:\Users\Admin\AppData\Local\Temp\ledgerfiles\Ledger Live Beta.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Ledger Live Beta" --mojo-platform-channel-handle=1904 --field-trial-handle=1680,i,13064392901978591516,1997064686012024831,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
          PID:4456
        • C:\Users\Admin\AppData\Local\Temp\ledgerfiles\Ledger Live Beta.exe
          "C:\Users\Admin\AppData\Local\Temp\ledgerfiles\Ledger Live Beta.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Ledger Live Beta" --app-path="C:\Users\Admin\AppData\Local\Temp\ledgerfiles\resources\app.asar" --enable-experimental-web-platform-features --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2668 --field-trial-handle=1680,i,13064392901978591516,1997064686012024831,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3728
        • C:\Users\Admin\AppData\Local\Temp\ledgerfiles\Ledger Live Beta.exe
          "C:\Users\Admin\AppData\Local\Temp\ledgerfiles\Ledger Live Beta.exe" C:\Users\Admin\AppData\Local\Temp\ledgerfiles\resources\app.asar\.webpack\main.bundle.js
          2⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:2708
        • C:\Users\Admin\AppData\Local\Temp\ledgerfiles\Ledger Live Beta.exe
          "C:\Users\Admin\AppData\Local\Temp\ledgerfiles\Ledger Live Beta.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Ledger Live Beta" --mojo-platform-channel-handle=3220 --field-trial-handle=1680,i,13064392901978591516,1997064686012024831,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
          2⤵
            PID:3840
          • C:\Users\Admin\AppData\Local\Temp\ledgerfiles\Ledger Live Beta.exe
            "C:\Users\Admin\AppData\Local\Temp\ledgerfiles\Ledger Live Beta.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\Ledger Live Beta" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2556 --field-trial-handle=1680,i,13064392901978591516,1997064686012024831,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3768
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
          1⤵
            PID:5108

          Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                26034700-e664-472e-909c-90f243bd59c8.tmp.node
                • Path C:\Users\Admin\AppData\Local\Temp\26034700-e664-472e-909c-90f243bd59c8.tmp.node
                • Size 1.1MB
                • SHA256 a6e6d835cafa1fc93f4b6ef3595a4c2b8e54fb7c1ee416ed8e379ff5846e048e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                c39097fe-6b03-4feb-96fa-1003b1eeac3b.tmp.node
                • Path C:\Users\Admin\AppData\Local\Temp\c39097fe-6b03-4feb-96fa-1003b1eeac3b.tmp.node
                • Size 275KB
                • SHA256 f00d85eb45b70e6b4456d4916793162dcacac87a49678ea3dc376912bc7392bb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                f4f4b1ab-faf6-4344-af0e-b57ba69a8c85.tmp.node
                • Path C:\Users\Admin\AppData\Local\Temp\f4f4b1ab-faf6-4344-af0e-b57ba69a8c85.tmp.node
                • Size 702KB
                • SHA256 e4541fb7b787cc401721d8568af7f721278ba9440ea33c2fd135e52ffc78b92c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                28d49d8d-0fe8-4bdb-a20a-0e45b9c93907.tmp
                • Path C:\Users\Admin\AppData\Roaming\Ledger Live Beta\28d49d8d-0fe8-4bdb-a20a-0e45b9c93907.tmp
                • Size 57B
                • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                data_0
                • Path C:\Users\Admin\AppData\Roaming\Ledger Live Beta\Cache\Cache_Data\data_0
                • Size 8KB
                • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                data_1
                • Path C:\Users\Admin\AppData\Roaming\Ledger Live Beta\Cache\Cache_Data\data_1
                • Size 264KB
                • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                data_2
                • Path C:\Users\Admin\AppData\Roaming\Ledger Live Beta\Cache\Cache_Data\data_2
                • Size 8KB
                • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                data_3
                • Path C:\Users\Admin\AppData\Roaming\Ledger Live Beta\Cache\Cache_Data\data_3
                • Size 8KB
                • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                f_00000a
                • Path C:\Users\Admin\AppData\Roaming\Ledger Live Beta\Cache\Cache_Data\f_00000a
                • Size 48KB
                • SHA256 8ee020fb2b323aa5c38cb46fa7ce84eda1a1eaf3ff080c150b86c610dc0a9820
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                CURRENT
                • Path C:\Users\Admin\AppData\Roaming\Ledger Live Beta\IndexedDB\file__0.indexeddb.leveldb\CURRENT
                • Size 16B
                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                • MD5 SHA1 SHA512
                Submit Download

                Network Persistent State
                • Path C:\Users\Admin\AppData\Roaming\Ledger Live Beta\Network\Network Persistent State
                • Size 1KB
                • SHA256 d9e03c7f07c160141c54aea036545feb29707f2071eb521f410f2396b05a76db
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Network Persistent State~RFe5a5d44.TMP
                • Path C:\Users\Admin\AppData\Roaming\Ledger Live Beta\Network\Network Persistent State~RFe5a5d44.TMP
                • Size 59B
                • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Roaming\Ledger Live Beta\Network\TransportSecurity
                • Size 1KB
                • SHA256 160e74ade169bc56402aff911897f08c80358f1c121bb59d0a2a31da4671f09f
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Roaming\Ledger Live Beta\Network\TransportSecurity
                • Size 1KB
                • SHA256 d97b6e709b4a58918ecd8fb5ee816cab191750a560231c164580e54d6488de7c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TransportSecurity~RFe5a7aee.TMP
                • Path C:\Users\Admin\AppData\Roaming\Ledger Live Beta\Network\TransportSecurity~RFe5a7aee.TMP
                • Size 1KB
                • SHA256 c46f31f92315d7a01267edf6607aea8ef58e1aeb4f640155ecdac8121902958a
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                app.json
                • Path C:\Users\Admin\AppData\Roaming\Ledger Live Beta\app.json
                • Size 1KB
                • SHA256 dd781d5254230a38de60ba46c72afccae33a120fae694099db73a5d63547abeb
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                app.json
                • Path C:\Users\Admin\AppData\Roaming\Ledger Live Beta\app.json
                • Size 11B
                • SHA256 7fb9d166d1a15bce0b9f085f3818946fd9297e4513a4a034a0ceb749292b4c0d
                • MD5 SHA1 SHA512
                Submit Download

                default.exc
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
                • Size 2B
                • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                • MD5 SHA1 SHA512
                Submit Download

                memory/3768-171-0x00000119720E0000-0x00000119720E1000-memory.dmp
                Download

                memory/3768-176-0x00000119720E0000-0x00000119720E1000-memory.dmp
                Download

                memory/3768-175-0x00000119720E0000-0x00000119720E1000-memory.dmp
                Download

                memory/3768-174-0x00000119720E0000-0x00000119720E1000-memory.dmp
                Download

                memory/3768-173-0x00000119720E0000-0x00000119720E1000-memory.dmp
                Download

                memory/3768-172-0x00000119720E0000-0x00000119720E1000-memory.dmp
                Download

                memory/3768-165-0x00000119720E0000-0x00000119720E1000-memory.dmp
                Download

                memory/3768-167-0x00000119720E0000-0x00000119720E1000-memory.dmp
                Download

                memory/3840-102-0x00007FFEC2980000-0x00007FFEC2981000-memory.dmp
                Download