89ddf3421051fb1583e593278ad91d2350dcb1e46643d84643b123f4db296d56

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Dotify.exe
Size 7.9MB
Sample260507-a7wjsacy3v
SHA256 89ddf3421051fb1583e593278ad91d2350dcb1e46643d84643b123f4db296d56
MD5 88833e2a464bf20c0a4adb12cbfd984e
SHA1 84885fa5149d41af55fb9714befb18491cedf8ce
SHA512 767cdf66357048ccca3ae95ea851e38003eeb0e2f1c83bfb6db94e49236f3ed800a5ba9668698cfee35c688d59e9a0daf4d84cdcebb5f6f061811acca2992c7b
SSDEEP 196608:72GQPnci/qnk9ajXsfLrSTPsdOPgw62W7WxJY766BWM:7yclk97UPxPgJ2WSxJ8Bn
TLSH
T18A86223BB24B653EE0691A3679B6D634543B6E2064124C5686E0FC8FFF350B11E3E786
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery installer stealer trojan

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 2 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3352	msedgewebview2.exe
5920	msedgewebview2.exe

Executes dropped EXE 2 IoCs

pid	Process
4216	Dotify.tmp
4956	dotify.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dotify.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Dotify\is-4YLUKYKA8X.tmp	Dotify.tmp
File created	C:\Program Files\Dotify\is-7Y3YOX76SR.tmp	Dotify.tmp
File opened for modification	C:\Program Files\Dotify\unins000.dat	Dotify.tmp
File opened for modification	C:\Program Files\Dotify\dotify.exe	Dotify.tmp
File created	C:\Program Files\Dotify\unins000.dat	Dotify.tmp

Drops file in Windows directory 62 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-mul-ethi.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_338299395\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_2131005172\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_2131005172\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_338299395\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_338299395\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_2131005172\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-la.hyb	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dotify.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4324-0-0x0000000000EE0000-0x0000000000FD6000-memory.dmp	innosetup
behavioral2/memory/4324-7-0x0000000000EE0000-0x0000000000FD6000-memory.dmp	innosetup
behavioral2/memory/4324-34-0x0000000000EE0000-0x0000000000FD6000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134225887518117394"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\dotify\DefaultIcon\ = "C:\\Program Files\\Dotify\\dotify.exe,0"	dotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\dotify\shell	dotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\dotify\shell\open	dotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\dotify\shell\open\command\ = "\"C:\\Program Files\\Dotify\\dotify.exe\" \"%1\""	dotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\dotify	dotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\dotify\URL Protocol	dotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\dotify\shell\open\command	dotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\dotify\ = "URL:com.dotify.app protocol"	dotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\dotify\DefaultIcon	dotify.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2668	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4216	Dotify.tmp
4216	Dotify.tmp
4956	dotify.exe
4956	dotify.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3352	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4216	Dotify.tmp
4956	dotify.exe
4956	dotify.exe
4956	dotify.exe
4956	dotify.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4956	dotify.exe
4956	dotify.exe
4956	dotify.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 4216	4324	Dotify.exe	79
PID 4216 wrote to memory of 4956	4216	Dotify.tmp	80
PID 4956 wrote to memory of 3352	4956	dotify.exe	81
PID 3352 wrote to memory of 612	3352	msedgewebview2.exe	82
PID 3352 wrote to memory of 4388	3352	msedgewebview2.exe	83
PID 3352 wrote to memory of 4388	3352	msedgewebview2.exe	83
PID 3352 wrote to memory of 4388	3352	msedgewebview2.exe	83
PID 3352 wrote to memory of 2204	3352	msedgewebview2.exe	84
PID 3352 wrote to memory of 5232	3352	msedgewebview2.exe	85
PID 3352 wrote to memory of 5232	3352	msedgewebview2.exe	85
PID 3352 wrote to memory of 5920	3352	msedgewebview2.exe	86
PID 3352 wrote to memory of 5920	3352	msedgewebview2.exe	86
PID 3352 wrote to memory of 5920	3352	msedgewebview2.exe	86
PID 4956 wrote to memory of 5804	4956	dotify.exe	87
PID 4956 wrote to memory of 5508	4956	dotify.exe	89
PID 4956 wrote to memory of 1028	4956	dotify.exe	91
PID 4956 wrote to memory of 2008	4956	dotify.exe	93
PID 4956 wrote to memory of 776	4956	dotify.exe	95
PID 776 wrote to memory of 2668	776	cmd.exe	97
PID 3352 wrote to memory of 5660	3352	msedgewebview2.exe	99
PID 3352 wrote to memory of 5660	3352	msedgewebview2.exe	99
PID 3352 wrote to memory of 5180	3352	msedgewebview2.exe	100
PID 3352 wrote to memory of 5180	3352	msedgewebview2.exe	100
PID 3352 wrote to memory of 4400	3352	msedgewebview2.exe	101
PID 3352 wrote to memory of 4400	3352	msedgewebview2.exe	101

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5804	attrib.exe
5508	attrib.exe
1028	attrib.exe
2008	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Dotify.exe
"C:\Users\Admin\AppData\Local\Temp\Dotify.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Users\Admin\AppData\Local\Temp\is-JZJTHG5IIF.tmp\Dotify.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-JZJTHG5IIF.tmp\Dotify.tmp" /SL5="$4021A,7037399,948736,C:\Users\Admin\AppData\Local\Temp\Dotify.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Program Files\Dotify\dotify.exe
    "C:\Program Files\Dotify\dotify.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4956
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=dotify.exe --webview-exe-version=2.2.4 --user-data-dir="C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --app-name=Dotify --app-user-model-id=com.dotify.app --autoplay-policy=no-user-gesture-required --disable-component-extensions-with-background-pages --disable-dev-shm-usage --disable-extensions --disable-features=HardwareMediaKeyHandling,MediaSessionService,GlobalMediaControls,DevTools,RemoteDebugging,InspectElement --disable-gpu-program-cache --disable-gpu-shader-disk-cache --disable-logging --enable-features=NetworkServiceInProcess --remote-debugging-port=-1 --lang=en-US --mojo-named-platform-channel-pipe=4956.6028.11085402216536624348
      4⤵
      Uses browser remote debugging
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:3352
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ff9d686b078,0x7ff9d686b084,0x7ff9d686b090
        5⤵
        
        PID:612
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView" --webview-exe-name=dotify.exe --webview-exe-version=2.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --subproc-heap-profiling --gpu-preferences=UAAAAAAAAADgABQEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1672,i,8028207180769831264,5214606436574727283,262144 --enable-features=NetworkServiceInProcess --disable-features=DevTools,GlobalMediaControls,HardwareMediaKeyHandling,InspectElement,MediaSessionService,RemoteDebugging --variations-seed-version --disable-logging --mojo-platform-channel-handle=1684 /prefetch:2
        5⤵
        
        PID:4388
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView" --webview-exe-name=dotify.exe --webview-exe-version=2.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --subproc-heap-profiling --always-read-main-dll --field-trial-handle=1904,i,8028207180769831264,5214606436574727283,262144 --enable-features=NetworkServiceInProcess --disable-features=DevTools,GlobalMediaControls,HardwareMediaKeyHandling,InspectElement,MediaSessionService,RemoteDebugging --variations-seed-version --disable-logging --mojo-platform-channel-handle=1916 /prefetch:11
        5⤵
        
        PID:2204
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView" --webview-exe-name=dotify.exe --webview-exe-version=2.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --subproc-heap-profiling --always-read-main-dll --field-trial-handle=1696,i,8028207180769831264,5214606436574727283,262144 --enable-features=NetworkServiceInProcess --disable-features=DevTools,GlobalMediaControls,HardwareMediaKeyHandling,InspectElement,MediaSessionService,RemoteDebugging --variations-seed-version --disable-logging --mojo-platform-channel-handle=2188 /prefetch:13
        5⤵
        
        PID:5232
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView" --webview-exe-name=dotify.exe --webview-exe-version=2.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --subproc-heap-profiling --autoplay-policy=no-user-gesture-required --remote-debugging-port=-1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3320,i,8028207180769831264,5214606436574727283,262144 --enable-features=NetworkServiceInProcess --disable-features=DevTools,GlobalMediaControls,HardwareMediaKeyHandling,InspectElement,MediaSessionService,RemoteDebugging --variations-seed-version --disable-logging --mojo-platform-channel-handle=3332 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5920
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView" --webview-exe-name=dotify.exe --webview-exe-version=2.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --subproc-heap-profiling --always-read-main-dll --field-trial-handle=4216,i,8028207180769831264,5214606436574727283,262144 --enable-features=NetworkServiceInProcess --disable-features=DevTools,GlobalMediaControls,HardwareMediaKeyHandling,InspectElement,MediaSessionService,RemoteDebugging --variations-seed-version --disable-logging --mojo-platform-channel-handle=4228 /prefetch:14
        5⤵
        
        PID:5660
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView" --webview-exe-name=dotify.exe --webview-exe-version=2.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --subproc-heap-profiling --always-read-main-dll --field-trial-handle=4228,i,8028207180769831264,5214606436574727283,262144 --enable-features=NetworkServiceInProcess --disable-features=DevTools,GlobalMediaControls,HardwareMediaKeyHandling,InspectElement,MediaSessionService,RemoteDebugging --variations-seed-version --disable-logging --mojo-platform-channel-handle=4260 /prefetch:14
        5⤵
        
        PID:5180
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView" --webview-exe-name=dotify.exe --webview-exe-version=2.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --subproc-heap-profiling --always-read-main-dll --field-trial-handle=756,i,8028207180769831264,5214606436574727283,262144 --enable-features=NetworkServiceInProcess --disable-features=DevTools,GlobalMediaControls,HardwareMediaKeyHandling,InspectElement,MediaSessionService,RemoteDebugging --variations-seed-version --disable-logging --mojo-platform-channel-handle=4404 /prefetch:14
        5⤵
        
        PID:4400
  - - C:\Windows\system32\attrib.exe
      "attrib" +H C:\Users\Admin\dotify\dotify.db-wal
      4⤵
      Views/modifies file attributes
      PID:5804
  - - C:\Windows\system32\attrib.exe
      "attrib" +H C:\Users\Admin\dotify\dotify.db-shm
      4⤵
      Views/modifies file attributes
      PID:5508
  - - C:\Windows\system32\attrib.exe
      "attrib" +H C:\Users\Admin\dotify\settings.db-wal
      4⤵
      Views/modifies file attributes
      PID:1028
  - - C:\Windows\system32\attrib.exe
      "attrib" +H C:\Users\Admin\dotify\settings.db-shm
      4⤵
      Views/modifies file attributes
      PID:2008
  - - C:\Windows\system32\cmd.exe
      "cmd" /C "REG QUERY HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Dotify"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:776
    - - C:\Windows\system32\reg.exe
        
        REG QUERY HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Dotify
        5⤵
        Modifies registry key
        
        PID:2668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dotify.exe

Path C:\Program Files\Dotify\dotify.exe
Size 16.8MB
SHA256 fc5a9c731a59a0bc3e46ec2d651a39dce831859bd3cbe8aead44c1c105a2b8e6
MD5 bcf2fadb42ac7c9b1a093db4c4b475f3
SHA1 77f0f90fbb0712355c2c8861155c2c25a70da4d1
SHA512 f2ac3a78732f3a5001f97191da258c38fb3b51f0f61f5a7fc5e3668d70c9035aa022173ef33d434444b766d554c737df5aa3488a058c63a1d067352906c8a34d
SSDEEP 98304:mLXTdITPQEkas1F0RWpdFmUQme6OLZXIvBv004qgUhoLDZcUZeqPOAt2djRdj3C1:yRIa4wdFCpZxeqvQwBsOQPBjPhmNVvp
TLSH
T1EB073947F66291E8C069C075931AA233FB71BC4D47357AEB5BE04B223E65F906A3DB04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dotify.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-JZJTHG5IIF.tmp\Dotify.tmp
Size 4.2MB
SHA256 3b01ac42521486d3240ab71c20fb7c405c8af938420947f37637767c27920b36
MD5 142abf6d3aa0fca9ab4e25522f0b5d86
SHA1 a9eb0cea23177d33c01e4090a826179964c0c433
SHA512 3973476b7d43ca426e5a889dcaf47c58e86d7b8ba2553c880e6a80f0bfbb4e8585e0c454cde580419c3dc5dd5bb4c9e6dce53cd9552b89373fd9db772d7971ae
SSDEEP 98304:ZYU5hnuOajWwMPdCpepI3GrwrA+JP333W:bxuHjWfZIzK
TLSH
T146267D03B388713EE4571A3A483BE2A0983F7E213A26CD4B67F42D5D9F395416D2A753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c79914c4cbf0094d0cf00b6220a76c4c9c92915381caf8ea95d6d9fac7e6634c
MD5 108538232620f26c1ab09a9bc79e4e92
SHA1 b4be89320517ae5ea26231efa7e8e72f9d0ac099
SHA512 28343bde46fced7ce79f1101803ad296aa4150dd8eb98685e0f78535684355ba17bb8e430c1d774aaa30a6140b930181d1afe286fce55fd72cadbbe50612a7cf
TLSH
T1F1D0122276410238C0102437050271481881C13B81054060AA29D5AD2E340500906441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 39f7845aa31ff0693bc291e1f08294eee0ef460e7479bcca9b96880ec165ebfe
MD5 eaefe22e18991c4e0eccff8c43a8ea9c
SHA1 d1edbe81558cc51b81cadc775137ccee19bca6d4
SHA512 20406d51910a04224adda7fce4c5bf14b17e44fb656002f7b71869845e8f4eb54f256a9b10d7931cef25b8fff8302cd0bc94122992abfbf2eb503faaeeabd1a7
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 93aa90f88cc9d055002de9808dc9f8ef96b4c7bcff18aa7b8170331a05d426b4
MD5 dd02bcec110ea051b5eb9a5f3c7b74af
SHA1 3a57d9eaacca452e92a3c9582da05d82c58a3cb3
SHA512 7e720cf9ab548b6c19fba447211502a9907e89ecb6f90a0f0416fe2300b45da5a9989b77ebb69a389d75e79df914079f90cc5137c05967042d75fbfad3f76742
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 436f6d402db8960b3f90807ec9f28fe73ef6de3ddf5709c6b6697f45425b7b6a
MD5 42a757928738b8c2fcd453f9f0992219
SHA1 f0459011a526059bed1f0b82e88c70c963d6307a
SHA512 8ad91013bc3cf5c7e1f35c7ec978f0379bd7469a8b92945a827e970ebed0a026ea33dd759648bea90ce821af4fc8fc95f986bc320016d0bdcb93ff77d3206470
TLSH
T188A0026542D04963D1204FB066D3255032B1487503230602D6982174BCA936452F55A2
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 bbfda8010443ccdfea35f4ecbe9f808035a252f4404681572948fb74772aaf29
MD5 8eacf8d875733ada548059e966ffb1c1
SHA1 b1c6fa23655eebd0a67db819615d4d26d05fb625
SHA512 7d577b08d6ab2dc6266b4084c673f6ae656c7a60ed6c1beed3818b48b74cd9288b937e971ea0a572fad30dddbfd209fe62041c0e3613df1c6e31cfcc5b70403b
TLSH
T1F601C2A2C3D8C6BD4A4112E476387913CD2E041992243D37CDEEEBDE57E1075D11024F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a202c.TMP

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Default\Network\Network Persistent State~RFe5a202c.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Default\Preferences
Size 6KB
SHA256 2bfdad82bcc2167804a7f36b3052c1543738250af713f1e045c0ac983e5f9319
MD5 f5e06442a0748c6cf754b1f57c289a6d
SHA1 e9516ec7b11b2067c82807b76f5f708a564256a9
SHA512 a1e49bd8a85ea2a147146bf438b2dda4894efbbe539f28c0a5d8c7b1a9b43073df545fad3872171508e2a32c440953b5cffcdf042acf5dd824a3070788f6d4e6
SSDEEP 192:stc0BCMmfSZ8pajU/S+WiTsbwYhEsgYMC:st9BDm9P/VwwjC
TLSH
T148E1C9435F685D7B4CC7E6197A35BB12E3F9102266D40E98EBFC8B0C04D6ADD620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59a658.TMP

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Default\Preferences~RFe59a658.TMP
Size 6KB
SHA256 82966a7904fe400edd85f62125a8b495f07fe9d7dfa872f30e5769303942c91c
MD5 e2c9a7a94822ba86043e47d474dd3871
SHA1 7e8766127374f46ae70168f8c748eb861a7d7dfa
SHA512 029112d14d966dc3fc3af3aea1ab58c15cb58203001817c594c9b500031ed6ea7b867d96379fd14686c9e72885eacfe1a08192c1d0888616f13da6bf56b02123
SSDEEP 192:stc0BCMqfSZ8pajU/S+WiTsbwYhEsOYM8:st9BDq9P/VwwT8
TLSH
T137D1BA035F686D7B4CC7E2197A39BB52D7F9106166D40E98EBFC8A0C08D6ADC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Local State
Size 1KB
SHA256 5887066c2365ad9e2c2cbe66e90c3ad8ee59c64c51131a5370f341c8e43bc5c3
MD5 7038b1de3cc837ea0313bbc4e5f8a475
SHA1 39706f49cec891817cfb664858da9f7dd309906a
SHA512 df36f23d801185712f3d4e4b2a8462dda759b2a9be9c14232114a8fa1442507bb6948a88d60d6d745a099e2888a73564acd0eb4363ea096a3b1ccf3f10c1db5d
TLSH
T1283145F3E8501F77DDD2D615B4857A472E14006BD1144E84A2DD4F0941E7ADC592AE33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Local State
Size 2KB
SHA256 d4492e74686b3ff011c73471e679b5413ad801b99e101437455ef88960955b03
MD5 9b0e6ac8a779e825674aae67f79636a5
SHA1 5fc477a36c1be98a9f9ff592ee858ffc7dc4edd1
SHA512 4cb0b23ab0b37188709f6ee961a23c2463167ba5e5557ccc626afd2d9702f4ea45d4cf41fe41cda9f21df91ce375e3e0a604c0d4ddd6e4b7ff592cca366533b8
TLSH
T1B851A8B3AC145E7B8DE38A14B8893F126F39415699552FD0A5DC0F0C40EBAAC2702D37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Local State
Size 3KB
SHA256 e0b75551d56cca2aa64ebf4a1ec702aaeaf332f3d560f810ed922bcb55256459
MD5 4d45289b875f4c023cc69719ee9ae900
SHA1 b9275ce31a517ddd992fc1fe32efe4aff5ff161b
SHA512 523490e60268510441495c285e6791d0b6cb6c93ca69ed55d119780bf3591df7484b133889012d1dbb659d2c0a4c04b0fcabdccd6efa1e2133de8b9c1f16a43a
TLSH
T14A719673A864992B8DE3D904B8C93B067B694127E5943FD4D5EC0F0D01E77D81742D27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Local State
Size 16KB
SHA256 cebf69d4cf9cbea33e8032d6e9a134de6db74730bc4445f71bc145d9e975512a
MD5 41bea1ba090ff9d6dd611eb003d6913d
SHA1 d01ab7067abd4db054cfffd83fcf71c85dd33c99
SHA512 9fb8dec1d93b34706f17aa2ead773afa75fd8a9ab60d196b06d10addb8000fcf76cba1ff0493139c4ee039d5fbf9315c9292adcb5f6b758d94d2188bd240ae79
SSDEEP 384:zyfTPLdSWCUkEaV8DNYi0qnSXaqZvsNbL094+oEMmj:mTRMUVai1SKqv20XzMW
TLSH
T16472AEB3AC78891B0DFE9929EA5A36065AA8D055C1D42F9CDDED0F0E06C66D81B21D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe590805.TMP

Path C:\Users\Admin\AppData\Local\com.dotify.app\EBWebView\Local State~RFe590805.TMP
Size 1KB
SHA256 14b8d439010d37fce8a11ce0efe70daef1d532972461dad6a2540da29cd865c1
MD5 0d5a416c2326fba360d08444c39056a3
SHA1 12e2ceb85126e57e2f69acefca82b3ef8db698e5
SHA512 199111247b9c553decf3bf22035160b4bc90210ab22ad45c116fd19aeab3632220899d211a396d23c4fa4e8a7ccb17a3973ca7bb70ad9ffeb6d9b1586216fa09
TLSH
T1732195F3DC541EBBEDD29525F4867B4A2E04006F90184F48A2DC0B0941EBAEC0A3BD33
MD5 SHA1 SHA512 TLSH

Submit Download

dotify.db-wal

Path C:\Users\Admin\dotify\dotify.db-wal
Size 152KB
SHA256 55b98fd035d0adb4b27677a18b4e4268e9700b5c987c7a71287f29c1f0781e42
MD5 612bf2743772f09aaceb8af13b9141ae
SHA1 e5f9c71376f5cd8e61e6cfa02a658e945b04c26c
SHA512 c1dc03bea978daedcefac349417d3e4d0480ae72ce8374e990f4f3ce19b60f9665a2f6f309afd6ee5693e667ed27110de0208f8572d332ff08e905b1572d91bf
SSDEEP 192:zQH3oErAEqEreEr8ErBErTpEr/ErKkcErPYYJkEr+SxkEr6tN13ErwtWQ9EVREr:Aw3dyl/
TLSH
T17BE3898E1A252210C5D07232DEE1C823283C991FCE9B7FC4BA9C81D29F5BD6ED5359B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.db-wal

Path C:\Users\Admin\dotify\settings.db-wal
Size 36KB
SHA256 019af5541af20af482790d74b0c7e509d329c2146f0b541a5b37fff72cec39e0
MD5 014cd4003f2af048530301b4e1d45de9
SHA1 8a8620849a85587e3fd5e681dd1d75a77d4bed74
SHA512 0753aa0b9544f8167119cfae9078155d76f1f98bdfd4b24bdfbe197a3deec95223c1b63514b3cbfac2667a7de8f8027c8ade95392d76f551b8a5519613a9703d
SSDEEP 24:KuDzylnu57upGKRGpSFgnA+d57upgaMo7FgnAbFHGpSFgnA+d57upYZ:/DzyNuhuxRg2fwhuuaMoBfFg2fwhum
TLSH
T1B5F2D15E67106261C1EA04B1DD931750283CCA1F07E3FD623AFC11956FC6D89E53B4BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_2131005172\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_2131005172\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_338299395\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3352_97823804\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4216-9-0x0000000000550000-0x00000000009A0000-memory.dmp

Download

memory/4216-5-0x00000000013B0000-0x00000000013B1000-memory.dmp

Download

memory/4216-32-0x0000000000550000-0x00000000009A0000-memory.dmp

Download

memory/4216-28-0x00000000012D0000-0x000000000134C000-memory.dmp

Download

memory/4216-14-0x0000000000550000-0x00000000009A0000-memory.dmp

Download

memory/4216-33-0x00000000012D0000-0x000000000134C000-memory.dmp

Download

memory/4216-10-0x00000000012D0000-0x000000000134C000-memory.dmp

Download

memory/4216-27-0x0000000000550000-0x00000000009A0000-memory.dmp

Download

memory/4216-11-0x00000000013B0000-0x00000000013B1000-memory.dmp

Download

memory/4324-34-0x0000000000EE0000-0x0000000000FD6000-memory.dmp

Download

memory/4324-8-0x0000000002F50000-0x0000000002FB4000-memory.dmp

Download

memory/4324-7-0x0000000000EE0000-0x0000000000FD6000-memory.dmp

Download

memory/4324-35-0x0000000002F50000-0x0000000002FB4000-memory.dmp

Download

memory/4324-0-0x0000000000EE0000-0x0000000000FD6000-memory.dmp

Download

memory/4388-210-0x000001FB908D0000-0x000001FB90C48000-memory.dmp

Download

memory/4388-56-0x00007FF9F44F0000-0x00007FF9F44F1000-memory.dmp

Download

memory/5920-150-0x00007FF9F44F0000-0x00007FF9F44F1000-memory.dmp

Download

memory/5920-211-0x0000021B33620000-0x0000021B33998000-memory.dmp

Download