9360c76ba109aea239aad42308754f1f7b282464f433c571c34cd5108e0efd39

Analysis

max time kernel
151s
max time network
159s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 18:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mercury-desktop.exe
Size 17.9MB
Sample260804-wvvmlseh76
SHA256 9360c76ba109aea239aad42308754f1f7b282464f433c571c34cd5108e0efd39
MD5 647c0378ddaabd2ca783aaf0e3c1a624
SHA1 e296acef04dbbb1541e84c5d49f20ae04d07115d
SHA512 76adfc9e385143f2e1429f643842573e5e472298a4c976096a578269bcf724314f21833eee754925a99ded1f286960930d5adf40ee8b04af210add147708bce6
SSDEEP 98304:XzGK7pi6beU4EoMIziLuNbQsfDZiwOWvmcfTN88wNjXHlS0lLBwwcIwZGXFcSnIa:XSK7p1oMIaEZvRwdHlRpCSHiAM1c15
TLSH
T1A517F625BB5A996CC05AC474834B4A725A7130CB0B35B9FF44C896392F6EBF42F38719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mercury-desktop.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4872_1920168312\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4872_1920168312\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4872_1920168312\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4872_2017523433\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4872_2017523433\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4872_2017523433\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4872_2017523433\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4872_2112526805\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4872_2112526805\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4872_2017523433\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4872_2112526805\manifest.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\mercury\ = "URL:com.mercury.messaging protocol"	mercury-desktop.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\mercury\shell\open\command	mercury-desktop.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\mercury\shell	mercury-desktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\mercury\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\mercury-desktop.exe\" \"%1\""	mercury-desktop.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\mercury	mercury-desktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\mercury\URL Protocol	mercury-desktop.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\mercury\DefaultIcon	mercury-desktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\mercury\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mercury-desktop.exe,0"	mercury-desktop.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\mercury\shell\open	mercury-desktop.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5508	msedgewebview2.exe
5508	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4872	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4880	mercury-desktop.exe
4880	mercury-desktop.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4880	mercury-desktop.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 4872	4880	mercury-desktop.exe	89
PID 4872 wrote to memory of 1960	4872	msedgewebview2.exe	90
PID 4872 wrote to memory of 256	4872	msedgewebview2.exe	91
PID 4872 wrote to memory of 256	4872	msedgewebview2.exe	91
PID 4872 wrote to memory of 256	4872	msedgewebview2.exe	91
PID 4872 wrote to memory of 256	4872	msedgewebview2.exe	91
PID 4872 wrote to memory of 4828	4872	msedgewebview2.exe	92
PID 4872 wrote to memory of 3048	4872	msedgewebview2.exe	93
PID 4872 wrote to memory of 3048	4872	msedgewebview2.exe	93
PID 4872 wrote to memory of 3048	4872	msedgewebview2.exe	93
PID 4872 wrote to memory of 5800	4872	msedgewebview2.exe	94
PID 4872 wrote to memory of 5800	4872	msedgewebview2.exe	94
PID 4872 wrote to memory of 5800	4872	msedgewebview2.exe	94
PID 4872 wrote to memory of 5800	4872	msedgewebview2.exe	94
PID 4872 wrote to memory of 5800	4872	msedgewebview2.exe	94
PID 4872 wrote to memory of 720	4872	msedgewebview2.exe	98
PID 4872 wrote to memory of 720	4872	msedgewebview2.exe	98
PID 4872 wrote to memory of 720	4872	msedgewebview2.exe	98
PID 4872 wrote to memory of 2952	4872	msedgewebview2.exe	99
PID 4872 wrote to memory of 2952	4872	msedgewebview2.exe	99
PID 4872 wrote to memory of 2952	4872	msedgewebview2.exe	99
PID 4872 wrote to memory of 5508	4872	msedgewebview2.exe	100
PID 4872 wrote to memory of 4816	4872	msedgewebview2.exe	101
PID 4872 wrote to memory of 4816	4872	msedgewebview2.exe	101
PID 4872 wrote to memory of 4816	4872	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\mercury-desktop.exe
"C:\Users\Admin\AppData\Local\Temp\mercury-desktop.exe"
1⤵
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=mercury-desktop.exe --webview-exe-version=0.1.45 --user-data-dir="C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4880.3020.14050931506050473933 /pfhostedapp:a22055427d500fbf76ca2e70f63d8e2ad96bada9
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView /prefetch:4 /pfhostedapp:a22055427d500fbf76ca2e70f63d8e2ad96bada9 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffe9cab5fd8,0x7ffe9cab5fe4,0x7ffe9cab5ff0
    3⤵
    PID:1960
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView" --webview-exe-name=mercury-desktop.exe --webview-exe-version=0.1.45 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1744 --field-trial-handle=1748,i,10859487842498591895,15150815075839854234,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:a22055427d500fbf76ca2e70f63d8e2ad96bada9
    3⤵
    PID:256
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView" --webview-exe-name=mercury-desktop.exe --webview-exe-version=0.1.45 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2024 --field-trial-handle=1748,i,10859487842498591895,15150815075839854234,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:a22055427d500fbf76ca2e70f63d8e2ad96bada9
    3⤵
    PID:4828
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView" --webview-exe-name=mercury-desktop.exe --webview-exe-version=0.1.45 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2316 --field-trial-handle=1748,i,10859487842498591895,15150815075839854234,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a22055427d500fbf76ca2e70f63d8e2ad96bada9
    3⤵
    PID:3048
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView" --webview-exe-name=mercury-desktop.exe --webview-exe-version=0.1.45 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3460 --field-trial-handle=1748,i,10859487842498591895,15150815075839854234,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:a22055427d500fbf76ca2e70f63d8e2ad96bada9 /prefetch:1
    3⤵
    PID:5800
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView" --webview-exe-name=mercury-desktop.exe --webview-exe-version=0.1.45 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4344 --field-trial-handle=1748,i,10859487842498591895,15150815075839854234,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a22055427d500fbf76ca2e70f63d8e2ad96bada9
    3⤵
    PID:720
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView" --webview-exe-name=mercury-desktop.exe --webview-exe-version=0.1.45 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4524 --field-trial-handle=1748,i,10859487842498591895,15150815075839854234,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a22055427d500fbf76ca2e70f63d8e2ad96bada9
    3⤵
    PID:2952
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView" --webview-exe-name=mercury-desktop.exe --webview-exe-version=0.1.45 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4680 --field-trial-handle=1748,i,10859487842498591895,15150815075839854234,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a22055427d500fbf76ca2e70f63d8e2ad96bada9
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5508
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView" --webview-exe-name=mercury-desktop.exe --webview-exe-version=0.1.45 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4736 --field-trial-handle=1748,i,10859487842498591895,15150815075839854234,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a22055427d500fbf76ca2e70f63d8e2ad96bada9
    3⤵
    PID:4816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 01b52565979033e5748d7bbac6adf53f4a5f0e640df2f7f99599ad4a6cd00090
MD5 72ef1d38b6c028fc5473831fd3f61ec0
SHA1 b77583d223e9935bd6ebcae95eff2ef513967da3
SHA512 df593d8df67224e60baf73aa5db179b28b910efc88df5258550b7a29b63d1cbf78ebe857fdf6a1edaed239ee0564fb95b12119ed01520f6c65c761912166503f
TLSH
T155D0123632814138C43021331043654D0840C13B4107800A5438D56D1A044501E06451
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 fde6097a15cbe9f052e6c26d7ed42e3906de53423e0e1c9eb311a41da3a1f2d0
MD5 d4745102653b9a125aba66c3c1db8ee0
SHA1 05518907fcc09578de2ef633c576382169128f26
SHA512 5aaf181908f178bed0d3ef68f669c25226424514b254f6c0a826b23c0ac5ef234f138e329115c4f401e15114c2afc6dc2de27f91079eeee967193f6826e76658
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 b0279248db0f12cfd86eab67ded083552f8acb53e0a1f796c55420f267f126e1
MD5 c6d0e6ca0216d1e076450223b338f737
SHA1 710b9139c19307701380f473211f1a98a5eb8bc7
SHA512 e5f9bb0c841ca09f4ed7503f6d080eedbc522d411b6fa1b5d8f70488b8c50edc987a93653f3ff5a03c39fe5c57240853826dccd5d646c52f89a8d68697e002ac
TLSH
T1DFC092B07CE4500BE300213D54D439123FF0998F0AC34CC945FA1478B4AE3E125A2EA0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a3c8.TMP

Path C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59a3c8.TMP
Size 48B
SHA256 f4f20982cf31fe0888a52aedd16c5cfce4e504a5c2e3e59b118030c6b2be423c
MD5 77a31169708f1ded799c3b1ff2081195
SHA1 204e0888171a4c02e572d61bc1be72ea041232ad
SHA512 4711963c3f150c9165370f424c215d35ed0e67f612de2bd457c657139887f44eba81d351819a0fb05c0214436eae69554d7baf4b8ba53ec1593eae8b589331e6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 e960bc9145c42e12db3406d4fde6a7ceaa47048aca6a553ddeff6eceb25a010a
MD5 66324cf88509066e9a1d698a23c7daad
SHA1 d74d3666593ed12c1489a19752cdc07fc16edaf2
SHA512 a2236a334deb7752c98d9e1cc7698cf75ba0368cda6d57981dce04bb57fc25ed4026ec9c1d118a4b0042b35866cc6edb4ac1f1556e8c702a850da087cd448c5a
TLSH
T1A401B1A2C3D4C6BD8A4117E06B347823CD2E051992283E37CDEAEFEA9BE1471D11054F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a5fa6.TMP

Path C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView\Default\Network\Network Persistent State~RFe5a5fa6.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView\Default\Preferences
Size 6KB
SHA256 d877e27d8e99c1691470c39d9c0ac1d91224b836dd3d29b3caa9465f12e65dbd
MD5 9c23dac5192d27c22ff51692ed981dac
SHA1 697764191e5b52dabb3ed013b06cae217048b5cd
SHA512 05c192435d072e4f59c515144d7b94360a685cc76edec1f02d8c1eb6e55f3054318eab767bddab28ff60a5ac9e9d26b620bcebbd217d4f956294c0f62c33360f
SSDEEP 96:st7/dZaXfpb9/kHo5h16Z0ks7/x+6MhmuecJ1p1ejeRK+g328XM1C7K:stDy7sonksV+Fd1pQj/ZG6K
TLSH
T13AD1A6015F28B9BB4CC6E159BB29BB17E2F6603164D21E58EBF8866C14DA6CC2317907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView\Default\Preferences
Size 6KB
SHA256 98bd7d89e7c1bec0a33df6cde27059f66bbb72ed93f4c0aca0ab30933b862f5a
MD5 0e489d1488aba44e500c96203ac2531c
SHA1 457bc5f1c1c230bd1bdc0d7e28fb82f92f6113ff
SHA512 b1d212a5532ce25c27ca16bc258338d24e11dadaee223c6fc304f67f758286e655399be560ce88b54ea11760abf2feb7591f21b3289565a9c89b557f1d262f28
SSDEEP 96:st7/dZaXeGpb9/kHo5h16Z0ks7/x+6MhmuecJ1p1ejeRK+gC28XM1C7K:stDyNsonksV+Fd1pQj/QG6K
TLSH
T132D1B6025F2878BB4CC7E119FB297B13E2F6607164921E58EBFC4A6C14DA6CC2213907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59d7e8.TMP

Path C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView\Default\Preferences~RFe59d7e8.TMP
Size 5KB
SHA256 a4d81ea8c16be6f38b990587e049c9ae053b23d022685e5d3d9f2a7046f589cd
MD5 7868ec18e7f2b252d1f5f1123b9213ef
SHA1 3cd602b81462a025bf2b6ec4737340777b7b05a2
SHA512 8ef6238b40d0ea02bceb843fe3dd2378a69c0e1b80498f1efd1f7f9bc179a28cb1c532e0ccb99c047e747c8c64ba939a3a2b7437fb5daa77e5da3afeaf0f754e
SSDEEP 96:r7/dZaXfpb9/kTdo616Z0ks7/x+6MhmuecJ1p1ejeRK+gg28XM1C7K:rDy7Ao6ksV+Fd1pQj/SG6K
TLSH
T127C1B6025B28B9BB4CC6E10DFB357B17D2F6603165D61D58E7F88A6C14DA5CC231790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView\Local State
Size 2KB
SHA256 7ba4dc797455319ac8a8d7c3e0b662280d934b01226fb1745d4b540d05796c4a
MD5 7710da5c42bb3f5567a459b49cdefedf
SHA1 bbf580d3170712d851dd055111db7583aeb3ac60
SHA512 56f7957a25fd52e76090e14f25ae64b2c958fa00c61ea8ecd1fa9d7de074079475316307ba1ca619ea2cbf30492ea0c2e9bab41666f238c8d28a71b7f7a5cf2c
TLSH
T1DE5174737A18AB779EE286497A4F3F238E3BA06695522F20D6DD1B0801C719C1342C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView\Local State
Size 3KB
SHA256 ebc1bcbcfb4d2e8f425387725d5084d90d16ab9e1ae99a73e613fedc7334f20d
MD5 83da023c1dcafcb5f2310039f3c9a332
SHA1 eb8d9fa9b45b3fee5a903a2a0f1cc5ec755661cd
SHA512 c1f68d0033b4711a6f0a2e245bf4ac6b0b77a97ad99bd7029839a7c91a58abb4faca95abf099a51a1b007cc40e9f1ce660080536189d747097cee0a905e93d09
TLSH
T1C86186776A28EA774EE3DA09B98A3B16AB665027E4913F65D6EC0F0C01D72DC1352C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView\Local State
Size 3KB
SHA256 0544ae8a70e6dda0d3aa47292212e87330d31651ab61f81fdb070ba007bf9b11
MD5 4e5bc5b20089fb73119316f99b0c5e1f
SHA1 d30eca2b3c69564ce7e4d36a439c810580946a61
SHA512 36b0c708eeedacb7a43e12ebf63e17663e70b2d1a2a10fc3f7b7966f02b95cd6a8ae6b01f95acaa79a3c85866cc69abd0d3891c83d29be771a349dcbc4415534
TLSH
T1177185736934A9774EF2D909794A3F03AB66502394917FA9D6EC0F0C12D72CC0382C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView\Local State
Size 15KB
SHA256 d66f0b53b247787628956ee9f0475c52ac5175bab3876e10fcd9de241f4430c4
MD5 671664be94e2fb9f3baf0e1370077dfd
SHA1 10e22f66fb016c6e972a769a80048dfdfe4f5e6c
SHA512 c3a2a4e1116bd2fdede2c12e70d6d8485aefb80208309f03613dc5cd38027c33edf4db8aa21f8416eaef4e912bc6de733f6611ba9026405fa864eded80d1c43a
SSDEEP 384:u+aQikB+z/xvxjg/qhEwNBSwDiVDbSd6W7x9zz:5/UxvxjgC+NV66W7xFz
TLSH
T1E472AF27966D7E63AAF3E9057A5D0B4BCBB998B350826E7849ED5F0906C72D80342813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe594905.TMP

Path C:\Users\Admin\AppData\Local\com.mercury.messaging\EBWebView\Local State~RFe594905.TMP
Size 1KB
SHA256 5a5d7c26b5d161e3790dc76569f688ab3bab812c06c75a58ccc07c6df3dc3cd9
MD5 b1557852e0296d5dc22b405cd3f2a811
SHA1 12eacb70f09e92edd8f9a013cef1d9d18f0b5b63
SHA512 163b81a955e502acd72c9ea3923d906a41ef0b5eb74fcb717b522841e4e2b1e53fd67c0e99b1fc861229eb462e75f604a0b379f020726e9db43480608ba481d9
TLSH
T1662162B3A6285F73ADC2928A320B6B575F32507B80518F04A2DE4B5D22D619C9766C33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/256-197-0x000001D9B8DE0000-0x000001D9B8E92000-memory.dmp

Download

memory/256-19-0x00007FFEBE1F0000-0x00007FFEBE1F1000-memory.dmp

Download

memory/256-359-0x000001D9B8DE0000-0x000001D9B8E92000-memory.dmp

Download

memory/720-291-0x00007FFEBD520000-0x00007FFEBD521000-memory.dmp

Download

memory/720-290-0x00007FFEBF250000-0x00007FFEBF251000-memory.dmp

Download

memory/5508-338-0x0000024437D30000-0x0000024437D31000-memory.dmp

Download

memory/5508-329-0x0000024437D30000-0x0000024437D31000-memory.dmp

Download

memory/5508-337-0x0000024437D30000-0x0000024437D31000-memory.dmp

Download

memory/5508-336-0x0000024437D30000-0x0000024437D31000-memory.dmp

Download

memory/5508-335-0x0000024437D30000-0x0000024437D31000-memory.dmp

Download

memory/5508-334-0x0000024437D30000-0x0000024437D31000-memory.dmp

Download

memory/5508-333-0x0000024437D30000-0x0000024437D31000-memory.dmp

Download

memory/5508-327-0x0000024437D30000-0x0000024437D31000-memory.dmp

Download

memory/5800-198-0x000001A98FBE0000-0x000001A98FC92000-memory.dmp

Download

memory/5800-101-0x00007FFEBE1F0000-0x00007FFEBE1F1000-memory.dmp

Download