89ddf3421051fb1583e593278ad91d2350dcb1e46643d84643b123f4db296d56

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/05/2026, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Dotify.exe
Size 7.9MB
Sample260507-a7wjsacy3v
SHA256 89ddf3421051fb1583e593278ad91d2350dcb1e46643d84643b123f4db296d56
MD5 88833e2a464bf20c0a4adb12cbfd984e
SHA1 84885fa5149d41af55fb9714befb18491cedf8ce
SHA512 767cdf66357048ccca3ae95ea851e38003eeb0e2f1c83bfb6db94e49236f3ed800a5ba9668698cfee35c688d59e9a0daf4d84cdcebb5f6f061811acca2992c7b
SSDEEP 196608:72GQPnci/qnk9ajXsfLrSTPsdOPgw62W7WxJY766BWM:7yclk97UPxPgJ2WSxJ8Bn
TLSH
T18A86223BB24B653EE0691A3679B6D634543B6E2064124C5686E0FC8FFF350B11E3E786
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery installer stealer trojan

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 2 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2356	msedgewebview2.exe
1608	msedgewebview2.exe

Executes dropped EXE 2 IoCs

pid	Process
3632	Dotify.tmp
2628	dotify.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dotify.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 62 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Dotify\dotify.exe	Dotify.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-as.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-el.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\Dotify\is-GH510PD5PT.tmp	Dotify.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\manifest.json	msedgewebview2.exe
File created	C:\Program Files\Dotify\unins000.dat	Dotify.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-uk.hyb	msedgewebview2.exe
File opened for modification	C:\Program Files\Dotify\unins000.dat	Dotify.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-it.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-or.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_279243908\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-la.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-da.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-af.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-te.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-es.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_279243908\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\Dotify\is-6AFINO7RON.tmp	Dotify.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-be.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-nn.hyb	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dotify.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4872-1-0x00000000008F0000-0x00000000009E6000-memory.dmp	innosetup
behavioral1/memory/4872-7-0x00000000008F0000-0x00000000009E6000-memory.dmp	innosetup
behavioral1/memory/4872-34-0x00000000008F0000-0x00000000009E6000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134225887523474844"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\dotify\ = "URL:com.dotify.app protocol"	dotify.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\dotify\DefaultIcon	dotify.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\dotify\shell\open\command	dotify.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\dotify	dotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\dotify\URL Protocol	dotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\dotify\DefaultIcon\ = "C:\\Program Files\\Dotify\\dotify.exe,0"	dotify.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\dotify\shell	dotify.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\dotify\shell\open	dotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\dotify\shell\open\command\ = "\"C:\\Program Files\\Dotify\\dotify.exe\" \"%1\""	dotify.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1584	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3632	Dotify.tmp
3632	Dotify.tmp
2628	dotify.exe
2628	dotify.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2356	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3632	Dotify.tmp
2628	dotify.exe
2628	dotify.exe
2628	dotify.exe
2628	dotify.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2628	dotify.exe
2628	dotify.exe
2628	dotify.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 3632	4872	Dotify.exe	85
PID 3632 wrote to memory of 2628	3632	Dotify.tmp	91
PID 2628 wrote to memory of 2356	2628	dotify.exe	92
PID 2356 wrote to memory of 3092	2356	msedgewebview2.exe	93
PID 2356 wrote to memory of 1888	2356	msedgewebview2.exe	94
PID 2356 wrote to memory of 1888	2356	msedgewebview2.exe	94
PID 2356 wrote to memory of 1888	2356	msedgewebview2.exe	94
PID 2356 wrote to memory of 2284	2356	msedgewebview2.exe	95
PID 2356 wrote to memory of 1960	2356	msedgewebview2.exe	96
PID 2356 wrote to memory of 1960	2356	msedgewebview2.exe	96
PID 2356 wrote to memory of 1608	2356	msedgewebview2.exe	97
PID 2356 wrote to memory of 1608	2356	msedgewebview2.exe	97
PID 2356 wrote to memory of 1608	2356	msedgewebview2.exe	97
PID 2628 wrote to memory of 4324	2628	dotify.exe	98
PID 2628 wrote to memory of 1708	2628	dotify.exe	100
PID 2628 wrote to memory of 4044	2628	dotify.exe	102
PID 2628 wrote to memory of 2372	2628	dotify.exe	104
PID 2628 wrote to memory of 4436	2628	dotify.exe	106
PID 4436 wrote to memory of 1584	4436	cmd.exe	108
PID 2356 wrote to memory of 2848	2356	msedgewebview2.exe	119
PID 2356 wrote to memory of 2848	2356	msedgewebview2.exe	119
PID 2356 wrote to memory of 1260	2356	msedgewebview2.exe	120
PID 2356 wrote to memory of 1260	2356	msedgewebview2.exe	120

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4324	attrib.exe
1708	attrib.exe
4044	attrib.exe
2372	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Dotify.exe
"C:\Users\Admin\AppData\Local\Temp\Dotify.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Users\Admin\AppData\Local\Temp\is-D6IB122QXI.tmp\Dotify.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-D6IB122QXI.tmp\Dotify.tmp" /SL5="$B0056,7037399,948736,C:\Users\Admin\AppData\Local\Temp\Dotify.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Program Files\Dotify\dotify.exe
    "C:\Program Files\Dotify\dotify.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=dotify.exe --webview-exe-version=2.2.4 --user-data-dir="C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --app-name=Dotify --app-user-model-id=com.dotify.app --autoplay-policy=no-user-gesture-required --disable-component-extensions-with-background-pages --disable-dev-shm-usage --disable-extensions --disable-features=HardwareMediaKeyHandling,MediaSessionService,GlobalMediaControls,DevTools,RemoteDebugging,InspectElement --disable-gpu-program-cache --disable-gpu-shader-disk-cache --disable-logging --enable-features=NetworkServiceInProcess --remote-debugging-port=-1 --lang=en-US --mojo-named-platform-channel-pipe=2628.4888.998499821074635447
      4⤵
      Uses browser remote debugging
      Drops file in Program Files directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:2356
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffbf9c2b078,0x7ffbf9c2b084,0x7ffbf9c2b090
        5⤵
        
        PID:3092
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView" --webview-exe-name=dotify.exe --webview-exe-version=2.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgABQEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1744,i,17564902797805807411,14387349875631516268,262144 --enable-features=NetworkServiceInProcess --disable-features=DevTools,GlobalMediaControls,HardwareMediaKeyHandling,InspectElement,MediaSessionService,RemoteDebugging --variations-seed-version --disable-logging --mojo-platform-channel-handle=1716 /prefetch:2
        5⤵
        
        PID:1888
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView" --webview-exe-name=dotify.exe --webview-exe-version=2.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1976,i,17564902797805807411,14387349875631516268,262144 --enable-features=NetworkServiceInProcess --disable-features=DevTools,GlobalMediaControls,HardwareMediaKeyHandling,InspectElement,MediaSessionService,RemoteDebugging --variations-seed-version --disable-logging --mojo-platform-channel-handle=1948 /prefetch:3
        5⤵
        
        PID:2284
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView" --webview-exe-name=dotify.exe --webview-exe-version=2.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2292,i,17564902797805807411,14387349875631516268,262144 --enable-features=NetworkServiceInProcess --disable-features=DevTools,GlobalMediaControls,HardwareMediaKeyHandling,InspectElement,MediaSessionService,RemoteDebugging --variations-seed-version --disable-logging --mojo-platform-channel-handle=2304 /prefetch:8
        5⤵
        
        PID:1960
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView" --webview-exe-name=dotify.exe --webview-exe-version=2.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --remote-debugging-port=-1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3372,i,17564902797805807411,14387349875631516268,262144 --enable-features=NetworkServiceInProcess --disable-features=DevTools,GlobalMediaControls,HardwareMediaKeyHandling,InspectElement,MediaSessionService,RemoteDebugging --variations-seed-version --disable-logging --mojo-platform-channel-handle=3380 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1608
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView" --webview-exe-name=dotify.exe --webview-exe-version=2.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2152,i,17564902797805807411,14387349875631516268,262144 --enable-features=NetworkServiceInProcess --disable-features=DevTools,GlobalMediaControls,HardwareMediaKeyHandling,InspectElement,MediaSessionService,RemoteDebugging --variations-seed-version --disable-logging --mojo-platform-channel-handle=4172 /prefetch:8
        5⤵
        
        PID:2848
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView" --webview-exe-name=dotify.exe --webview-exe-version=2.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4228,i,17564902797805807411,14387349875631516268,262144 --enable-features=NetworkServiceInProcess --disable-features=DevTools,GlobalMediaControls,HardwareMediaKeyHandling,InspectElement,MediaSessionService,RemoteDebugging --variations-seed-version --disable-logging --mojo-platform-channel-handle=4172 /prefetch:8
        5⤵
        
        PID:1260
  - - C:\Windows\system32\attrib.exe
      "attrib" +H C:\Users\Admin\dotify\dotify.db-wal
      4⤵
      Views/modifies file attributes
      PID:4324
  - - C:\Windows\system32\attrib.exe
      "attrib" +H C:\Users\Admin\dotify\dotify.db-shm
      4⤵
      Views/modifies file attributes
      PID:1708
  - - C:\Windows\system32\attrib.exe
      "attrib" +H C:\Users\Admin\dotify\settings.db-wal
      4⤵
      Views/modifies file attributes
      PID:4044
  - - C:\Windows\system32\attrib.exe
      "attrib" +H C:\Users\Admin\dotify\settings.db-shm
      4⤵
      Views/modifies file attributes
      PID:2372
  - - C:\Windows\system32\cmd.exe
      "cmd" /C "REG QUERY HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Dotify"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4436
    - - C:\Windows\system32\reg.exe
        
        REG QUERY HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Dotify
        5⤵
        Modifies registry key
        
        PID:1584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dotify.exe

Path C:\Program Files\Dotify\dotify.exe
Size 16.8MB
SHA256 fc5a9c731a59a0bc3e46ec2d651a39dce831859bd3cbe8aead44c1c105a2b8e6
MD5 bcf2fadb42ac7c9b1a093db4c4b475f3
SHA1 77f0f90fbb0712355c2c8861155c2c25a70da4d1
SHA512 f2ac3a78732f3a5001f97191da258c38fb3b51f0f61f5a7fc5e3668d70c9035aa022173ef33d434444b766d554c737df5aa3488a058c63a1d067352906c8a34d
SSDEEP 98304:mLXTdITPQEkas1F0RWpdFmUQme6OLZXIvBv004qgUhoLDZcUZeqPOAt2djRdj3C1:yRIa4wdFCpZxeqvQwBsOQPBjPhmNVvp
TLSH
T1EB073947F66291E8C069C075931AA233FB71BC4D47357AEB5BE04B223E65F906A3DB04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-af.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-af.hyb
Size 70KB
SHA256 5487ee44a4cd706d0086522e90c59c76cdf2ac68ce506fd3eae6054b9220c0cf
MD5 ffa9db945f0f0c15b8bba75a6e064880
SHA1 49217a9d5bb7a868464403b4e3c82e80df53456c
SHA512 cc67b2dfbbb009dd3fdb999fe86410425455613c12dac755a3cded435cd25ca4363782d70f3b7bb7c0fdd63e2eb649ae6a4053d929f463b646b43d7dbfda79c0
SSDEEP 1536:dH4Yzf/r1T2bhKC+wQ/MJ4tpBMfWDMxFaye3yrGZ3vGV9YODhX3yKfhGt:dxLr1qFKpNpufWIqye3KgGVnDxe
TLSH
T1D56329C3C62BDF90CC6419F4594D0AA811D816C6E7C039BE9B6C54797A27CB82BC13EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2356_1961549264\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2356_279243908\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

Dotify.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-D6IB122QXI.tmp\Dotify.tmp
Size 4.2MB
SHA256 3b01ac42521486d3240ab71c20fb7c405c8af938420947f37637767c27920b36
MD5 142abf6d3aa0fca9ab4e25522f0b5d86
SHA1 a9eb0cea23177d33c01e4090a826179964c0c433
SHA512 3973476b7d43ca426e5a889dcaf47c58e86d7b8ba2553c880e6a80f0bfbb4e8585e0c454cde580419c3dc5dd5bb4c9e6dce53cd9552b89373fd9db772d7971ae
SSDEEP 98304:ZYU5hnuOajWwMPdCpepI3GrwrA+JP333W:bxuHjWfZIzK
TLSH
T146267D03B388713EE4571A3A483BE2A0983F7E213A26CD4B67F42D5D9F395416D2A753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ffd38b6d1d75b3ecae6dd7823f65344b84989736f17c9a39166b4de11fa0c88f
MD5 738d481af5280c1853c41dbff9c790ba
SHA1 28ef6a388de17c61071662c36251571278b7811c
SHA512 42a4b9f085bb44db1314ed36ad2fdce6dd684141e5365e1942d0962e5f1544fc371b246ad74892f03d891d682a48694d8b5d9c8b092350303c508c17b2b8779a
TLSH
T117D012623605013CC01024B30102E50D0440C30B42454001942C951D5F440D00A034D2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d634bc1fbef39e786a2dd5c8209b5ef268f4214b82e955962bf85049b6a1a5a4
MD5 dcbdfd9028ff7fe7c275bebfd8c087bd
SHA1 593d65d6307d490b37fe476845ef258945d571ed
SHA512 984d474114e4dffec01d4096fee13dd563dd86a7845c0279fef98fa5cc55cd78e52994da132504b7214c100b187a680acee5eae0aa91259d0186c084177fd3b1
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 d2895822d7be021e3149d983a66f8c2dad51eb3196644b8f6851a979ef937762
MD5 d006240476127a18b8905e047d73332a
SHA1 782024b208fc3f9f9d19989b266d9b3d20e9e089
SHA512 e4cbda51f8a2b6b75cac686f70cf3830e7a163a34be6e2f706a9ca843253ca5e7212ac2dcb5a9f69d974d22fe50ae64278df2c71b29b478f670ab6fb3870787d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 18fc2dd74ff26d74086e54fa17b200bbb5172c8d1b885551b773a6f06389f36b
MD5 7afb0566a99f178743ddd7e4413ad156
SHA1 1be3822f2e3bb1f58bd6a056fbffe37ac72e09fe
SHA512 931827ae9ddcbc8d4a1ef759f5623d064419214f1374c6f4ca34c6d322f34a773bfa4516db2c5e0668c095e93211605b2f140d14fb741aec7c4ff7b1e287bc5f
TLSH
T14FA002A24180458FC1544FB151C321707772481013534A8596A8237599D23A1653A046
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 004893b3876c9cf45c24310b722173ca39d545cb8b1b01519a27cf5f3a3357dd
MD5 143401d84c75451a4c27ef219b41a346
SHA1 ceb3cd827f41e1ad7dcdaf195b7024e94d0338b8
SHA512 450e0f575d3ed923174b7239ac7f3a4e4d663391582d7f49fa555cf1a36ad9e27cf99c8539875538dd0c61e69dad0230576543b09d8bf7badab955673ca9d81b
TLSH
T13901AFA2C3E8C6BD4A4126E426347917CC2E041952243D26CDE9EBD957E1071D11054F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59d75b.TMP

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Default\Network\Network Persistent State~RFe59d75b.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Default\Preferences
Size 6KB
SHA256 654a0b9be07d99361f0d0dcd252fddd938e69a0663e8b0d615ec59b13016aa84
MD5 880b78d6bbb262d942ca268661099f86
SHA1 d6a88f6f32c4cca4046afa43006bc4e64eef4da9
SHA512 21272d77b0d3a079f59aaa60438dc1a8f4c309c3bc6a2620f8e266275a0c0855ff5716900f7cd762206b5612b18416710cfea03141eca15098efc27ad9cc7e97
SSDEEP 192:stC70Bzz3fsHZ8paZW/S+WiTBWwY4VPSjtMC:stCQBzTU2j/VgwhC
TLSH
T12FE1A9435E686D7B4CC7F6197935BB52E3F9502262D50E94EBFCCA0C04E6ADC620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe595d1a.TMP

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Default\Preferences~RFe595d1a.TMP
Size 6KB
SHA256 905c2608cd9b616dea842b054364089c954f43e8c5942ac4c7a8fa79d8caff9a
MD5 c13e2e86721668a04c5158164c908fa6
SHA1 1f0f454f586f19d523d8a8565370105ee932640a
SHA512 cdedca1f89ea2686f402b9cfecbf1ce4d0f5ff452f78039fa591a311a75e5e571241009566701f9dd694997f449a34365bf119f55d0e88489b333751f6bdd7a9
SSDEEP 192:stC70BzznfsHZ8paZW/S+WiTBWwY4VPmjtM8:stCQBzLU2j/Vgwh8
TLSH
T127D1B8035F686D7B4CC7E6197A39BB52D3FA106162D40E98EBFC8A1C08D66DC620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Local State
Size 1KB
SHA256 58b5f20cb9f32a21f8b196a4cf0ab9c7404b66f42af5f72f3001db787cef2b29
MD5 74a9d0bf7cd333410bec8e8467432372
SHA1 77cccac084f73edb86b7455ed452681844771007
SHA512 9848b16a4320f78a1436d9751c8a7243fe4c7dcaf225c515d2fd514813b6ca9c863c0bd10b5ad00bd29143b825561155873d1a37608fe49ac9aafc29fc85f373
TLSH
T19B318773F4546F365CC1959A72067B572F36406AC1108F8856EC0B0C01DBAFC9C29E33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Local State
Size 2KB
SHA256 94e6546a21184895b9c8c4026393d4cda4550bc30d303f9b50ee78aad2ad6953
MD5 f8d079c857c34f61a021fa9b3f778bcf
SHA1 bb9abd0274ee7593cf7a8b68af4b2e825280b476
SHA512 33cdf31b27ba3c1fbd47c9ad1c4bee07256f1c3d3d74bf5f8613b123f820e9d70f9b082293b1f325c4dfd461fdeb2217454517a8ae3a66c902f06701b7bf3437
TLSH
T1AD51987378149E3B89D39558BA093F135B7A4065D6551F949AEC0B0C01DFAAC2B12D37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Local State
Size 3KB
SHA256 01d57705bc07517e050a03ecd776719a05361e92fb12db28ccb61ca5f4e80b83
MD5 b2e58f4d936eb345ad83c2fb3f4b38a6
SHA1 b44901f99052c1bedad14fde7384f299b0ff5b72
SHA512 ad8b4696faa0997b535a4d2bb8b9b0fa437f7e82a277b56f477ecd876bbde66d93d63da076fd2bebd51f6d1366dbbe3fd9b423aff21ab9bd089e252c8bd601b4
TLSH
T1E371A537B864ED3B4DE39949B9892B1677AA4027D5942FD8DAEC0F0C01DB7E81702D17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Local State
Size 16KB
SHA256 84c32405a37e011ecebdc39f42561d861236f85392918f3e03e1b8d986f4245e
MD5 0ea46a31a0fa1dcd5a2cac368b668d7a
SHA1 349623a3db7baa2f3761d77d4300f16d7b3ad749
SHA512 9fc490cdf57ba9d75a6875242070e1c5aa51a26debd34bd5dd0b846943f4af7a554034d4d428a69952720246307c1f9352f74ce1abbeed80cb3564f243ab2e20
SSDEEP 384:zdfTPLdSWCUkEaV8DNYi0qnSXaqZvsNbLtrrMqFmC:tTRMUVai1SKqv2tnJFB
TLSH
T1A972BEB3AC78992B0CAE9969F65B3A075AB9D054C1D42F4CDDED0F0E06C66E80B11D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58beb7.TMP

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Local State~RFe58beb7.TMP
Size 1KB
SHA256 3f7bfff4986d9aa37a2d124cd61ef784b0a40b790d883e3dc80fa66a4863cdf3
MD5 f3f199c26a923f524fd6f8fa55f7053b
SHA1 8ac1ab922df3acecca9f5a0d0cd04a586e1755ea
SHA512 d3e40fd59464d6305faf129786e6561a152632c2542a30ce400aa589999f35df7e602e7a557fba6e690ea4a9dd24653e0c6d759207e9054b3167029e1af8b0ee
TLSH
T1E4213573E454AE3998D194AAB2067B872E75406AD1148F4C96EC071D01DF9FCDD3AD33
MD5 SHA1 SHA512 TLSH

Submit Download

dotify.db-wal

Path C:\Users\Admin\dotify\dotify.db-wal
Size 152KB
SHA256 6671d0ead6fe41c93df97360b7cc2e261c91c80d2de401101308760cc1692edc
MD5 785045d0d03ecce6cf6d439b353caf81
SHA1 7ebb9fd5ffd245bf408daac4c018c2d0011e3f50
SHA512 92cf7e1ca7eabb8a0ce53f2abcdc62ef90ace49a382e4787ea2ddbb30072fcb40eb660cc8bab5d6f3a0f80273813e68d022f1c081ca3a619f611c91eaf07af0f
SSDEEP 192:cGQiU0MvErPErNErrEr/ErMErQEErxkcEraYJkEr5SxkEr2MN13ErOQ9EVREr:9MlUZQK0U
TLSH
T155E3A98E1A652210C5D07233DEA2C823283C991FCE9B7FC4BA9C81D25F5BD6EC5359B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.db-wal

Path C:\Users\Admin\dotify\settings.db-wal
Size 36KB
SHA256 af415e0c1e39a955d3d3b8e67f15abe457b058da8c8fa1e13f964dddedba2206
MD5 6a58932cf712719e8f802a6453460c40
SHA1 c60aab920b9453470e8a1a5423b6702dae0d3211
SHA512 0b9f2c9c24b365ab142d6732f815d60022678b439c26d80330fcb0792fe8e9404443c4c4d654fc553a9d843dd9937d5fa00aa856003b332587c02779ae59227f
SSDEEP 24:KXYzylnu57upJ8RGpSFgnA+d57upKlv9Mo7FgnAbFHGpSFgnA+d57upG:OYzyNuhu0Rg2fwhuslv9MoBfFg2fwhu
TLSH
T14DF2C15A971062A0C1D904B1FCA3172419388A1F47E3BD633AFD10A3AFC5E8AF5395BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1608-152-0x00007FFC15010000-0x00007FFC15011000-memory.dmp

Download

memory/1888-56-0x00007FFC15010000-0x00007FFC15011000-memory.dmp

Download

memory/1960-107-0x00007FFC154C0000-0x00007FFC154C1000-memory.dmp

Download

memory/1960-106-0x00007FFC16A30000-0x00007FFC16A31000-memory.dmp

Download

memory/2356-201-0x00000164572A0000-0x00000164572AC000-memory.dmp

Download

memory/2356-200-0x0000016457260000-0x000001645728C000-memory.dmp

Download

memory/2356-203-0x0000016460100000-0x000001646013B000-memory.dmp

Download

memory/2356-202-0x00000164600D0000-0x00000164600F7000-memory.dmp

Download

memory/3632-14-0x0000000000830000-0x0000000000C80000-memory.dmp

Download

memory/3632-32-0x0000000000830000-0x0000000000C80000-memory.dmp

Download

memory/3632-33-0x0000000000E80000-0x0000000000EDF000-memory.dmp

Download

memory/3632-27-0x0000000000830000-0x0000000000C80000-memory.dmp

Download

memory/3632-9-0x0000000000830000-0x0000000000C80000-memory.dmp

Download

memory/3632-10-0x0000000000E80000-0x0000000000EDF000-memory.dmp

Download

memory/3632-11-0x0000000000600000-0x0000000000601000-memory.dmp

Download

memory/3632-5-0x0000000000600000-0x0000000000601000-memory.dmp

Download

memory/4872-34-0x00000000008F0000-0x00000000009E6000-memory.dmp

Download

memory/4872-35-0x0000000001250000-0x00000000012AF000-memory.dmp

Download

memory/4872-1-0x00000000008F0000-0x00000000009E6000-memory.dmp

Download

memory/4872-8-0x0000000001250000-0x00000000012AF000-memory.dmp

Download

memory/4872-7-0x00000000008F0000-0x00000000009E6000-memory.dmp

Download