Analysis

  • user interaction
    yes
  • max time kernel
    1050s
  • max time network
    1050s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 04:04

General

  • Target
    https://steamrip.com/doki-doki-literature-club-plus-free-download-1f/
  • Sample260808-enbsgshm21
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 13 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://steamrip.com/doki-doki-literature-club-plus-free-download-1f/
    1⤵
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1400
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff8ae7c188,0x7fff8ae7c194,0x7fff8ae7c1a0
      2⤵
        PID:2456
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,6055515479716638447,12421478519505190338,524288 --field-trial-handle=2584,i,17880247048991912614,262141744544628006,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:3
        2⤵
        • System Time Discovery
        PID:1116
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,11304833124336465778,14655157210218167339,262144 --field-trial-handle=2584,i,17880247048991912614,262141744544628006,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:2
        2⤵
          PID:4988
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,12040724383753258399,9848471427857344411,524288 --field-trial-handle=2584,i,17880247048991912614,262141744544628006,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
          2⤵
            PID:4704
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,6324958236673364795,10663202057485410211,2097152 --field-trial-handle=2584,i,17880247048991912614,262141744544628006,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
            2⤵
              PID:3932
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,7762843356057737762,8040195036919064821,2097152 --field-trial-handle=2584,i,17880247048991912614,262141744544628006,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
              2⤵
                PID:5100
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4084,i,2690900448021112695,68005701511085391,2097152 --field-trial-handle=2584,i,17880247048991912614,262141744544628006,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:1
                2⤵
                  PID:5060
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4092,i,9889900061458508184,6944953765250414827,2097152 --field-trial-handle=2584,i,17880247048991912614,262141744544628006,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:2
                  2⤵
                    PID:5048
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,13785381294141592914,7858793826962248666,524288 --field-trial-handle=2584,i,17880247048991912614,262141744544628006,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
                    2⤵
                      PID:1032
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,16678338996147915116,6825290542360442633,524288 --field-trial-handle=2584,i,17880247048991912614,262141744544628006,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
                      2⤵
                        PID:3840
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5580,i,6430820650892641741,2235076609991953775,2097152 --field-trial-handle=2584,i,17880247048991912614,262141744544628006,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
                        2⤵
                          PID:3732
                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,6273415396251486523,1315908884608110991,524288 --field-trial-handle=2584,i,17880247048991912614,262141744544628006,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
                          2⤵
                            PID:1616
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,6273415396251486523,1315908884608110991,524288 --field-trial-handle=2584,i,17880247048991912614,262141744544628006,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
                            2⤵
                              PID:2440
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6748,i,13303506839645909513,18376208231204515422,2097152 --field-trial-handle=2584,i,17880247048991912614,262141744544628006,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:1
                              2⤵
                                PID:700
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,10808614135913935103,2597591450351769362,524288 --field-trial-handle=2584,i,17880247048991912614,262141744544628006,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
                                2⤵
                                  PID:3476
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6868,i,6668204626125842397,4447530750890333235,2097152 --field-trial-handle=2584,i,17880247048991912614,262141744544628006,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:1
                                  2⤵
                                    PID:1316
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,16519770167523535765,3905987666711234062,524288 --field-trial-handle=2584,i,17880247048991912614,262141744544628006,262144 --variations-seed-version --mojo-platform-channel-handle=1224 /prefetch:8
                                    2⤵
                                      PID:1644
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,1656211719427207949,9151223276028053440,524288 --field-trial-handle=2584,i,17880247048991912614,262141744544628006,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:8
                                      2⤵
                                        PID:724
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4140,i,18406128782234076635,8716323978272216553,524288 --field-trial-handle=2584,i,17880247048991912614,262141744544628006,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
                                        2⤵
                                          PID:4552
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,4957027046014511096,6500484573183089866,524288 --field-trial-handle=2584,i,17880247048991912614,262141744544628006,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:8
                                          2⤵
                                            PID:3532
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7456,i,13215477077145092413,16466179469955516109,262144 --field-trial-handle=2584,i,17880247048991912614,262141744544628006,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:8
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:2440
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,8108051197250741642,14390580988483271072,524288 --field-trial-handle=2584,i,17880247048991912614,262141744544628006,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
                                            2⤵
                                              PID:2828
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,4747882334697742722,1191059443017629280,524288 --field-trial-handle=2584,i,17880247048991912614,262141744544628006,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
                                              2⤵
                                                PID:912
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,5221892008492113592,9486605702439028312,524288 --field-trial-handle=2584,i,17880247048991912614,262141744544628006,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
                                                2⤵
                                                  PID:1396
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,5842603969223363024,3435100736783947511,524288 --field-trial-handle=2584,i,17880247048991912614,262141744544628006,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:8
                                                  2⤵
                                                    PID:4488
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,15224976178622813287,13919920158522483281,524288 --field-trial-handle=2584,i,17880247048991912614,262141744544628006,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
                                                    2⤵
                                                      PID:5064
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,3408067346744305731,5689398168340041067,524288 --field-trial-handle=2584,i,17880247048991912614,262141744544628006,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
                                                      2⤵
                                                        PID:4828
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,14705892474771801894,16245630848992082105,524288 --field-trial-handle=2584,i,17880247048991912614,262141744544628006,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:8
                                                        2⤵
                                                          PID:3032
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                        1⤵
                                                          PID:2248
                                                        • C:\Windows\system32\OpenWith.exe
                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                          1⤵
                                                          • Modifies registry class
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:4900
                                                        • C:\Windows\System32\rundll32.exe
                                                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                          1⤵
                                                            PID:4040
                                                          • C:\Windows\system32\OpenWith.exe
                                                            C:\Windows\system32\OpenWith.exe -Embedding
                                                            1⤵
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4192
                                                          • C:\Program Files\7-Zip\7zG.exe
                                                            "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\" -ad -an -ai#7zMap20562:148:7zEvent9985
                                                            1⤵
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:3100
                                                          • C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus.exe
                                                            "C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus.exe"
                                                            1⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Suspicious use of SetWindowsHookEx
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2448
                                                            • C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\UnityCrashHandler64.exe
                                                              "C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\UnityCrashHandler64.exe" --attach 2448 2144686706688
                                                              2⤵
                                                              • Executes dropped EXE
                                                              PID:4144
                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                              "C:\Windows\System32\Wbem\wmic" process get Description
                                                              2⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1600
                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                              "C:\Windows\System32\Wbem\wmic" process get Description
                                                              2⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4736
                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                              "C:\Windows\System32\Wbem\wmic" process get Description
                                                              2⤵
                                                                PID:368
                                                            • C:\Windows\system32\AUDIODG.EXE
                                                              C:\Windows\system32\AUDIODG.EXE 0x50c 0x514
                                                              1⤵
                                                                PID:4612

                                                              Network

                                                                    MITRE ATT&CK Enterprise v16

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    save_launcher.sav

                                                                    • Path C:\Users\Admin\AppData\LocalLow\Team Salvato\Doki Doki Literature Club Plus\save_launcher.sav
                                                                    • Size 74KB
                                                                    • SHA256 16e720d79f2be694b5af3d7b315ea8d0496991a71e38f77b1d768a1a441f1fb2
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    save_launcher.sav

                                                                    • Path C:\Users\Admin\AppData\LocalLow\Team Salvato\Doki Doki Literature Club Plus\save_launcher.sav
                                                                    • Size 74KB
                                                                    • SHA256 2f09c18f08812b4ddffe10c54379d7a786b53bbb6ff189d761119839df507a64
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    blocklist

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                    • Size 105KB
                                                                    • SHA256 9267ca39fb50d75e1644d2a3d696dd6ccb217e6bf9e7569d932cd90aa7ddc3c6
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    settings.dat

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                    • Size 280B
                                                                    • SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    settings.dat

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                    • Size 280B
                                                                    • SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    LOG.old

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                    • Size 331B
                                                                    • SHA256 3cf905dddf2ee399ca8e48b92295af4d8c6f5a912d7e1243cfddc1e09b3e676b
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    LOG.old

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                    • Size 352B
                                                                    • SHA256 9817871f5b3d4b5741e46f85e4bcad6306a4b1b5a60e2270c4837e97ecab1dc9
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    LOG.old

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                    • Size 334B
                                                                    • SHA256 e0080e44bfaffcdbc69c6ad91a2cd90bb13be40dd6f51ed4655a18d99de988d7
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    MANIFEST-000001

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
                                                                    • Size 158B
                                                                    • SHA256 dcb1eb57cb9b930fbbd61112726240163af8842afad49ca3f3db20154fe91165
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    BookmarkMergedSurfaceOrdering

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                    • Size 6B
                                                                    • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                    • MD5 SHA1 SHA512

                                                                    the-real-index

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                    • Size 3KB
                                                                    • SHA256 3fa1a15b1e283ef2f5a988265099de5de26ab845bf391033ab18f2fa0f318c73
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    the-real-index~RFe591e3c.TMP

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591e3c.TMP
                                                                    • Size 3KB
                                                                    • SHA256 deee2aba74c86bcd278c79da2eb5a8e79ab4de5cf503379b708342bb64f5b0f5
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    SiteList-Enterprise.json

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                    • Size 2B
                                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                    • MD5 SHA1 SHA512

                                                                    Edge Profile.ico

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                    • Size 70KB
                                                                    • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    Network Persistent State

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                    • Size 5KB
                                                                    • SHA256 d30a5dcb50b5d4f7be30e94ca0dd72b5270163c4c0f0063ae1652395ce337fa6
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    Network Persistent State

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                    • Size 111B
                                                                    • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    Network Persistent State

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                    • Size 4KB
                                                                    • SHA256 04d13e3a8c209d7216b1cf9db8644281e1ac50e5476a13214f6714f0f11adc45
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    Network Persistent State

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                    • Size 5KB
                                                                    • SHA256 1be8e0ffe6a58b2494627e22529d5abf78132477910f120834721fd6b0b6d267
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    SCT Auditing Pending Reports

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                    • Size 2B
                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                    • MD5 SHA1 SHA512

                                                                    Preferences

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                    • Size 12KB
                                                                    • SHA256 b0cbe4b041b0498e6b6d37edd03a77c2f0b28934769b1eb8baabbbd04e68757f
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    Preferences

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                    • Size 13KB
                                                                    • SHA256 91ff3dccc7e9847ddafb33fe70822babd51ae9d635b4fbeceb49662eab0f1a7e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    Preferences

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                    • Size 13KB
                                                                    • SHA256 2885ab943321b5cdb383e4ae278e7daf0e4345ddbda93a2cdbb801618a48cf11
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    Secure Preferences

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                    • Size 30KB
                                                                    • SHA256 7d2384afeab06c92ca0126e35b826e6da731dceeddb39d2965059c632c26ac26
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    the-real-index

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index
                                                                    • Size 1KB
                                                                    • SHA256 6479e41c768ebca64cee725c7ce4da0d407f5685529f5ca3eca020f91bc3c14b
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    the-real-index~RFe5d1d00.TMP

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index~RFe5d1d00.TMP
                                                                    • Size 1KB
                                                                    • SHA256 88805b32fba2eb044599a1a05a441a2f4c57518d324dc6ecfac47d0aeef6b434
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    index.txt

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                    • Size 371B
                                                                    • SHA256 c76316a95a7225b524f214eb56a4dfce07d2672006106c97c1c9e5873dfa5af7
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    sync_diagnostic.log

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                    • Size 4KB
                                                                    • SHA256 56f71dd43aeff023b52e191d9ef339386e7e1ec755c4a1f5ff99ac8511d01053
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    Local State

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 11KB
                                                                    • SHA256 3730a3de5f1baca7b450fe29df752518f8c366f7b60e09f0a4ba95d6a3547951
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    Local State

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 21KB
                                                                    • SHA256 1d1d4b84b97ce7d894feb784366a9d9917c450c812f90c2075f81f44ab74b129
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    Local State

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 12KB
                                                                    • SHA256 0c640a0b796ed0df4c058b9331b0b8746bbb6fdbdfcdf489416c87c1ce2a31c5
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    Local State

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 16KB
                                                                    • SHA256 7eafdafb157a0f1b50dd59d8bf4c1f64a49075bc4ed0036a42c06990233bb921
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    Local State

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 21KB
                                                                    • SHA256 21531f294d54732156d7c9622a6676671c5de670015973ddf03014eb4a2adfb2
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    Local State

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 25KB
                                                                    • SHA256 8596d7ad8241ed21521df8cda3e2b3da39bc413f2a416082a4294bf27f7bb3b7
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    Local State

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 8KB
                                                                    • SHA256 584497a9714a444b844357b615718d103f2807869d46ed667872e5c065254274
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    Local State

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 16KB
                                                                    • SHA256 7bcaa4747ffabaab53028a9f48a39765b268a384bc40241fa496f80cd45301f3
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    Local State

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 8KB
                                                                    • SHA256 546a8de3f8649d80c00d8865368bf349c0a44f64a5453ad198ad885bbdd4f3d6
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    Local State

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 21KB
                                                                    • SHA256 2035e76b827bcc6c2face8ac584773492d287658e5d1b197a38c9b698012519d
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    abd0c3d1-4255-4d65-acf8-25cc4cd10da2.tmp

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\abd0c3d1-4255-4d65-acf8-25cc4cd10da2.tmp
                                                                    • Size 13B
                                                                    • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                    • MD5 SHA1 SHA512

                                                                    5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                    • Size 2KB
                                                                    • SHA256 e53a7c699f5eefc7e354a129448c8ac011c46bd988b20af5270dccd63be3d7db
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    Doki Doki Literature Club Plus.exe

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus.exe
                                                                    • Size 635KB
                                                                    • SHA256 b17b6a1e21e7beae66b256da045c02a5bf624e0c3ed3d7590167ee4d2f3cb7c5
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.AIModule.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.AIModule.dll
                                                                    • Size 43KB
                                                                    • SHA256 084799c51cfc375e9cb18bfdebfb5736b4766927770bfe09d50a7f9ccba83eeb
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.ARModule.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.ARModule.dll
                                                                    • Size 12KB
                                                                    • SHA256 340fc8befd64bfc41f6d6bbd6baedf8adf2967aa9f57bf51241f65851629793a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.AccessibilityModule.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.AccessibilityModule.dll
                                                                    • Size 12KB
                                                                    • SHA256 0ff96c898e72ed9938dd4768b011b2e3169918c33371199b63cdb1b88437e661
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.AndroidJNIModule.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.AndroidJNIModule.dll
                                                                    • Size 56KB
                                                                    • SHA256 cde5f14d3b6d0223d4445812255fb0868d2f922b7013b031c06157d67b904dc0
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.AnimationModule.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.AnimationModule.dll
                                                                    • Size 142KB
                                                                    • SHA256 ba0d06153d840fba2812d83cbcc4eb788d06d9c85ff2840acc4215cb2a004c44
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.AssetBundleModule.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.AssetBundleModule.dll
                                                                    • Size 21KB
                                                                    • SHA256 f881591cd57e9b04bd6ed446ac15fc8e526b5536a5580cd709161e8fceb3a345
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.AudioModule.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.AudioModule.dll
                                                                    • Size 56KB
                                                                    • SHA256 84ac3c9691c2d489dbf37cda9240a48208ffcb159089bd204ca175c14f6e77dc
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.ClothModule.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.ClothModule.dll
                                                                    • Size 15KB
                                                                    • SHA256 0cbfa5d350a4a60b2aba031381ec86b2fdfc616fd6f1ae8af6cd837cefa921c3
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.ClusterInputModule.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.ClusterInputModule.dll
                                                                    • Size 10KB
                                                                    • SHA256 ef50330d5a6aab5a6070daf2e82fa42c3327ddc5b7678ac5b0ad98a31a61f4d2
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.ClusterRendererModule.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.ClusterRendererModule.dll
                                                                    • Size 9KB
                                                                    • SHA256 da8f90eb6e9bc17237f57288bd0f182062128de7c8e4da5ed47717be2eb3330e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.CoreModule.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.CoreModule.dll
                                                                    • Size 982KB
                                                                    • SHA256 a440ba1890a6587d14c75d9dc6931da732ced4000784d497925e10897a8f47a8
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.CrashReportingModule.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.CrashReportingModule.dll
                                                                    • Size 9KB
                                                                    • SHA256 6cd0fb94b7126b3362509275d78e205ca00c7d02040975e5ae23fbf120c9b80c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.DSPGraphModule.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.DSPGraphModule.dll
                                                                    • Size 17KB
                                                                    • SHA256 728d062d13f4155dea12cf214fd27909dfc31e48d75bb4e085e0b2a9dfe9258c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.DirectorModule.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.DirectorModule.dll
                                                                    • Size 13KB
                                                                    • SHA256 99533d43861743a75aaafe6ff915db08eecfb0f453a4067cb31f4c965a177382
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.GameCenterModule.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.GameCenterModule.dll
                                                                    • Size 26KB
                                                                    • SHA256 1d90544af7e66bee5518c70efd06e7b7a93d3902bf01b938eb7c77e472b50361
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.GridModule.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.GridModule.dll
                                                                    • Size 13KB
                                                                    • SHA256 5d0ba6d479a5defcefc9fec5d5eba754f9fa61d778184eb71597adbd9b205daf
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.HotReloadModule.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.HotReloadModule.dll
                                                                    • Size 8KB
                                                                    • SHA256 e96fefda4c77dd32e99d2b179bb914e70113d7f632f593b7378c64fe25175139
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.IMGUIModule.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.IMGUIModule.dll
                                                                    • Size 152KB
                                                                    • SHA256 4f17553921476062c483938c038c76f521a39fade2af4f6221086c94adad7de1
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.ImageConversionModule.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.ImageConversionModule.dll
                                                                    • Size 12KB
                                                                    • SHA256 12eca2b2813cd9cf439190ae8997eba138b87b437828a50f84f7a78b962f6b1d
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.InputLegacyModule.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.InputLegacyModule.dll
                                                                    • Size 25KB
                                                                    • SHA256 e563b1dbe9ea5cb46c4052ac5f51b191fa5f0377e9f9853967f07c54871f652f
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.InputModule.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.InputModule.dll
                                                                    • Size 12KB
                                                                    • SHA256 35d39beb7136f2a3bc56e82e4ebdddb56a37ec000315bfe8165ebf8a6cb53bcb
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.JSONSerializeModule.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.JSONSerializeModule.dll
                                                                    • Size 10KB
                                                                    • SHA256 3adb2be5d53f1d6d27bcde984ab686940bc043dbbbd96122fc75075fae4b5157
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.LocalizationModule.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.LocalizationModule.dll
                                                                    • Size 9KB
                                                                    • SHA256 41a6825d2eeff9c754087746282dbc42136d38c24b525c90dc12976ac97835b0
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.ParticleSystemModule.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.ParticleSystemModule.dll
                                                                    • Size 132KB
                                                                    • SHA256 7619b5d776a37422110011cdc00fdc162753fd684e224638b5b0ee07f07952b4
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.PerformanceReportingModule.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.PerformanceReportingModule.dll
                                                                    • Size 9KB
                                                                    • SHA256 b74e4f6d118638256b74346bd1c2e1791e0e7e338d34f1df49e66b532520212a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.Physics2DModule.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.Physics2DModule.dll
                                                                    • Size 103KB
                                                                    • SHA256 f2dc5bde43f493ec342a0dfbc319f02e425c7873abab1ad43bda85d93659ae1b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.PhysicsModule.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.PhysicsModule.dll
                                                                    • Size 85KB
                                                                    • SHA256 b9554e5b8c17d50ba942a028424674c2356668fea4f5e5f2c71238c271f236d8
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityEngine.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\UnityEngine.dll
                                                                    • Size 83KB
                                                                    • SHA256 78014c03a6dedc1ebe7f4699afc1a3662c3c05ce557910392ccec304d82497a8
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    mscorlib.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Managed\mscorlib.dll
                                                                    • Size 3.7MB
                                                                    • SHA256 184f3a9c4524db4bff81ef50b93441c6a5255397e6b78ee219f8c0b193daa2ee
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    unity default resources

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\Resources\unity default resources
                                                                    • Size 3.7MB
                                                                    • SHA256 28f34dd870e9ef576828fca791d86a90f932a3d6814b947dc191fbed2354b888
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    app.info

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\app.info
                                                                    • Size 43B
                                                                    • SHA256 f197036ab1562c276d57a52b8e52a032b10cfd0280689782ba5bf925d36519cc
                                                                    • MD5 SHA1 SHA512

                                                                    boot.config

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\boot.config
                                                                    • Size 79B
                                                                    • SHA256 938a94959c0fdbfb057faa2af06b2b535bcc9c6a8e21bf5ab4a08479537d56c2
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    globalgamemanagers

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\Doki Doki Literature Club Plus_Data\globalgamemanagers
                                                                    • Size 104KB
                                                                    • SHA256 7f7f25cd40b523d6a9465cfea64d0bd5e7877e76e17aab60e213eb61bd492526
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    mono-2.0-bdwgc.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\MonoBleedingEdge\EmbedRuntime\mono-2.0-bdwgc.dll
                                                                    • Size 4.7MB
                                                                    • SHA256 8c68b7750d748bce1c02151a56097c68210d050c6765219905e2a726e096b030
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    Compat.browser

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\MonoBleedingEdge\etc\mono\4.5\Browsers\Compat.browser
                                                                    • Size 1KB
                                                                    • SHA256 8a1082057ac5681dcd4e9c227ed7fb8eb42ac1618963b5de3b65739dd77e2741
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    DefaultWsdlHelpGenerator.aspx

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\MonoBleedingEdge\etc\mono\4.5\DefaultWsdlHelpGenerator.aspx
                                                                    • Size 59KB
                                                                    • SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    config

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\MonoBleedingEdge\etc\mono\config
                                                                    • Size 3KB
                                                                    • SHA256 60099cf91bb1a5717fc1f2d23cf36a61d3bfb70d9489fbb6f4bae98c560bf3d5
                                                                    • MD5 SHA1 SHA512 TLSH

                                                                    UnityCrashHandler64.exe

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\UnityCrashHandler64.exe
                                                                    • Size 1.0MB
                                                                    • SHA256 21d0f1c286ebc8257c18c4c9823357c89e7ff634d53728d5afd2b38e0aa17ee9
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                    UnityPlayer.dll

                                                                    • Path C:\Users\Admin\Downloads\Doki-Doki-Literature-Club-Plus-Steamrip.com\Doki Doki Literature Club Plus v15.09.2021\UnityPlayer.dll
                                                                    • Size 24.8MB
                                                                    • SHA256 42ca912eb8a9ff74945743e5de0d11f6ba4ed79a14228dc0a39c656f9cabd768
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH