hxxps://steamunlocked[.]net/12-the-ouroboros-king-free-download/

Analysis

max time kernel
2021s
max time network
2018s
platform
windows10-1703_x64
resource
win10-20230621-en
resource tags

arch:x64arch:x86image:win10-20230621-enlocale:en-usos:windows10-1703-x64system
submitted
01/07/2023, 10:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steamunlocked.net/12-the-ouroboros-king-free-download/

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\symbols\exe\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\DLL\kernel32.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\system32\exe\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\kernelbase.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\system32\symbols\dll\ntdll.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\system32\DLL\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\kernelbase.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\system32\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\kernelbase.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\system32\symbols\dll\ntdll.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\system32\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\mono-2.0-bdwgc.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\system32\dll\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\ntdll.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\system32\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\system32\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\mono-2.0-bdwgc.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\system32\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\mono-2.0-bdwgc.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\system32\symbols\dll\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\kernel32.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\system32\symbols\dll\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\kernelbase.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\system32\symbols\exe\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\DLL\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\kernelbase.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\system32\dll\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\DLL\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\mono-2.0-bdwgc.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\system32\symbols\DLL\kernel32.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\system32\dll\kernelbase.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\system32\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\mono-2.0-bdwgc.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\system32\dll\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\DLL\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\DLL\kernel32.pdb	The Ouroboros King.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\symbols\dll\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\kernel32.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\symbols\dll\kernelbase.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\DLL\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\kernelbase.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\symbols\dll\ntdll.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\symbols\DLL\kernel32.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\ntdll.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\symbols\dll\ntdll.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\DLL\kernel32.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\exe\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\mono-2.0-bdwgc.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\exe\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\mono-2.0-bdwgc.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\dll\ntdll.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\kernelbase.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\symbols\dll\mono-2.0-bdwgc.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\ntdll.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\symbols\dll\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\DLL\kernel32.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\DLL\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\DLL\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\kernelbase.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\dll\mono-2.0-bdwgc.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\kernelbase.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\DLL\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\kernelbase.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\kernel32.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\ntdll.pdb	The Ouroboros King.exe
File opened for modification	C:\Windows\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\combase.pdb	UnityCrashHandler64.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3240	3552	WerFault.exe	89
756	4688	WerFault.exe	97
4348	4688	WerFault.exe	97
2700	4536	WerFault.exe	102

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133326824762473560"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1032500962-593345068-3128969974-1000_Classes\Local Settings	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1216	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2512	chrome.exe
2512	chrome.exe
1740	chrome.exe
1740	chrome.exe
3552	The Ouroboros King.exe
3552	The Ouroboros King.exe
4604	UnityCrashHandler64.exe
4604	UnityCrashHandler64.exe
4604	UnityCrashHandler64.exe
4604	UnityCrashHandler64.exe
4604	UnityCrashHandler64.exe
4604	UnityCrashHandler64.exe
4536	The Ouroboros King.exe
4536	The Ouroboros King.exe
3844	UnityCrashHandler64.exe
3844	UnityCrashHandler64.exe
3844	UnityCrashHandler64.exe
3844	UnityCrashHandler64.exe
3844	UnityCrashHandler64.exe
3844	UnityCrashHandler64.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeCreatePagefilePrivilege	2512	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3552	The Ouroboros King.exe
4688	The Ouroboros King.exe
4536	The Ouroboros King.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2540	2512	chrome.exe	66
PID 2512 wrote to memory of 2540	2512	chrome.exe	66
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2948	2512	chrome.exe	69
PID 2512 wrote to memory of 2952	2512	chrome.exe	68
PID 2512 wrote to memory of 2952	2512	chrome.exe	68
PID 2512 wrote to memory of 2796	2512	chrome.exe	70
PID 2512 wrote to memory of 2796	2512	chrome.exe	70
PID 2512 wrote to memory of 2796	2512	chrome.exe	70
PID 2512 wrote to memory of 2796	2512	chrome.exe	70
PID 2512 wrote to memory of 2796	2512	chrome.exe	70
PID 2512 wrote to memory of 2796	2512	chrome.exe	70
PID 2512 wrote to memory of 2796	2512	chrome.exe	70
PID 2512 wrote to memory of 2796	2512	chrome.exe	70
PID 2512 wrote to memory of 2796	2512	chrome.exe	70
PID 2512 wrote to memory of 2796	2512	chrome.exe	70
PID 2512 wrote to memory of 2796	2512	chrome.exe	70
PID 2512 wrote to memory of 2796	2512	chrome.exe	70
PID 2512 wrote to memory of 2796	2512	chrome.exe	70
PID 2512 wrote to memory of 2796	2512	chrome.exe	70
PID 2512 wrote to memory of 2796	2512	chrome.exe	70
PID 2512 wrote to memory of 2796	2512	chrome.exe	70
PID 2512 wrote to memory of 2796	2512	chrome.exe	70
PID 2512 wrote to memory of 2796	2512	chrome.exe	70
PID 2512 wrote to memory of 2796	2512	chrome.exe	70
PID 2512 wrote to memory of 2796	2512	chrome.exe	70
PID 2512 wrote to memory of 2796	2512	chrome.exe	70
PID 2512 wrote to memory of 2796	2512	chrome.exe	70

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://steamunlocked.net/12-the-ouroboros-king-free-download/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fff98dc9758,0x7fff98dc9768,0x7fff98dc9778
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1840 --field-trial-handle=1756,i,3883800790161591973,18077724400705527459,131072 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1756,i,3883800790161591973,18077724400705527459,131072 /prefetch:2
  2⤵
  PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2092 --field-trial-handle=1756,i,3883800790161591973,18077724400705527459,131072 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1756,i,3883800790161591973,18077724400705527459,131072 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=1756,i,3883800790161591973,18077724400705527459,131072 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4608 --field-trial-handle=1756,i,3883800790161591973,18077724400705527459,131072 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 --field-trial-handle=1756,i,3883800790161591973,18077724400705527459,131072 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4876 --field-trial-handle=1756,i,3883800790161591973,18077724400705527459,131072 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5256 --field-trial-handle=1756,i,3883800790161591973,18077724400705527459,131072 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4740 --field-trial-handle=1756,i,3883800790161591973,18077724400705527459,131072 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5488 --field-trial-handle=1756,i,3883800790161591973,18077724400705527459,131072 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 --field-trial-handle=1756,i,3883800790161591973,18077724400705527459,131072 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5044 --field-trial-handle=1756,i,3883800790161591973,18077724400705527459,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 --field-trial-handle=1756,i,3883800790161591973,18077724400705527459,131072 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 --field-trial-handle=1756,i,3883800790161591973,18077724400705527459,131072 /prefetch:8
  2⤵
  PID:4724

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4876

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4356

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\HOW TO RUN GAME!!.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1216

C:\Users\Admin\Downloads\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\The Ouroboros King.exe
"C:\Users\Admin\Downloads\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\The Ouroboros King.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3552
- C:\Users\Admin\Downloads\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\UnityCrashHandler64.exe
  "C:\Users\Admin\Downloads\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\UnityCrashHandler64.exe" --attach 3552 1803234054144
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4604
- - C:\Users\Admin\Downloads\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\UnityCrashHandler64.exe
    "C:\Users\Admin\Downloads\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\UnityCrashHandler64.exe" "3552" "1803234054144"
    3⤵
    PID:2272
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3552 -s 2392
  2⤵
  - Program crash
  PID:3240

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3ac
1⤵
PID:3932

C:\Users\Admin\Downloads\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\The Ouroboros King.exe
"C:\Users\Admin\Downloads\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\The Ouroboros King.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4688
- C:\Users\Admin\Downloads\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\UnityCrashHandler64.exe
  "C:\Users\Admin\Downloads\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\UnityCrashHandler64.exe" --attach 4688 1915157680128
  2⤵
  PID:4464
- - C:\Users\Admin\Downloads\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\UnityCrashHandler64.exe
    "C:\Users\Admin\Downloads\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\UnityCrashHandler64.exe" "4688" "1915157680128"
    3⤵
    PID:2724
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4688 -s 2072
  2⤵
  - Program crash
  PID:756
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4688 -s 1632
  2⤵
  - Program crash
  PID:4348

C:\Users\Admin\Downloads\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\The Ouroboros King.exe
"C:\Users\Admin\Downloads\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\The Ouroboros King.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4536
- C:\Users\Admin\Downloads\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\UnityCrashHandler64.exe
  "C:\Users\Admin\Downloads\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\UnityCrashHandler64.exe" --attach 4536 2177130565632
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:3844
- - C:\Users\Admin\Downloads\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\UnityCrashHandler64.exe
    "C:\Users\Admin\Downloads\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\The.Ouroboros.King.v2023.05.30\UnityCrashHandler64.exe" "4536" "2177130565632"
    3⤵
    PID:4028
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4536 -s 2400
  2⤵
  - Program crash
  PID:2700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\Player.log

Filesize
20KB

MD5
4b613f2feda9f61d328ab43a80960153

SHA1
690c8bcaf77a7afd5b64427e96a432d4eecfaab5

SHA256
4b2a81ceecc91ecb6b7078e180151348a4e31b1b556661e3a44b994bc3d56b0c

SHA512
a5343b57d66264f35b5d7f65d1042815c6e3016a116034b183ec88a10eb8bb7ae8beb8ca37ec1cdc1bd9588f258a166d2938a2bad2401b603ae6b25e07cd372f

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\Player.log

Filesize
20KB

MD5
b0f28955b212004c3afdfa609b2b8fe5

SHA1
4b2f4525273d9a424659f2101d363441facb859e

SHA256
0c9988fff70ddcfd08e49b80dcd58f3fe71957a144ee13de0da01d589c67ff81

SHA512
60fe9871a7615fda4c50a2e9dad4bdb4c54d5408cf90eb34670996408eb2290c56b9f8e99ef3c34cc6fd7e13a943c29c4389f491fdba87a883cf572e37f15350

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\Player.log

Filesize
3KB

MD5
36882754b8d0ef537870d538944c0c06

SHA1
6ac1e9b4eb33de1ee1f4a826483bb8b4c6d3348d

SHA256
c9f16649f94a49a74d0e3782f7275a2ae6cd8915cff998a358370a0c98365961

SHA512
028c2000b370bc04ed2f1416c45576de44cdcdafc9655615e217e5f8254c05bc2bbd4800200bbb162151da22d9f4847ff44270ad13b359adc62b92a7ae175877

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\dialog_conditions.csv

Filesize
13B

MD5
748b3c5d43b7024e23929530a40d36e9

SHA1
44c198673cf98aa2e71e892d8470ede49feb10dd

SHA256
71f404bfedb63e6652ab26e383f810f1d9d8c6ecf571971f2cce480a2f553eb5

SHA512
845453f084f48c688539c4a5d111da6f3255ab6368022ddc6aa3197cb0cbf17a92290607339122433baf64da8834818874b42e7403d2c7ea8da15f6ef5a43ed5

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\difficulty.csv

Filesize
169B

MD5
99837ca6af8fa98291bb66fc1d2cdcbe

SHA1
229ef72511a34dedd409eb572110a04ef3a4135b

SHA256
c1779427ee265dacbd9f8b42c62c6766b323d24f6419f01aa3cc231e2ee16ff3

SHA512
9676d3d8d5021fb636185086fd561394e1e462c652fe843905201db0924f1d05246bca44207c6ddc20316c3529383fca12433c2e2ab66a9e6c3e37745de7bc7c

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\edges.csv

Filesize
45B

MD5
a0c6f722324ccfdb87b2bdad04c0dccd

SHA1
2719597e881278c318904a5a10314abf009e1e73

SHA256
0e0694fe65dc5fb5c0088f9e9b5c6a772b85b7096ec580891c9f5a07bc7687ce

SHA512
4ae81fb8e72d1d3f4626893b94f989f956eb98c66e2747d2f97c097b0a1d273aa050c59f3ce59ac4e78140dd6b80ba800f36a97044d4b889b6d28d9cb76749bd

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\edges.csv

Filesize
45B

MD5
a0c6f722324ccfdb87b2bdad04c0dccd

SHA1
2719597e881278c318904a5a10314abf009e1e73

SHA256
0e0694fe65dc5fb5c0088f9e9b5c6a772b85b7096ec580891c9f5a07bc7687ce

SHA512
4ae81fb8e72d1d3f4626893b94f989f956eb98c66e2747d2f97c097b0a1d273aa050c59f3ce59ac4e78140dd6b80ba800f36a97044d4b889b6d28d9cb76749bd

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\edges.csv

Filesize
78B

MD5
aa190a87e0d0dae407c7357fe0411f3d

SHA1
adfd123040d9c0fb9bda54ed7532f14e9f0709be

SHA256
ecad4b9fd5d2d1be0ceaeb03f45ebd305f33d6e3e0e4f0109a0c356e70b6b1e0

SHA512
bfac6cd36885d8d1a82a513192dcbc0bf911f8862495db5842f67f8122cbd4c00093348946a394f77dc625d71b048896676451e9a65e3a11068bbbf974b545d9

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\event_type.csv

Filesize
8B

MD5
dddf70d1b3d4bd0465074d1594cc848e

SHA1
a64373384659f4faf7c0c3937100fdf1f85521a5

SHA256
e18f983bfcee11bfdba4f7c8a271c9c174369310f3eff583f7d738dac4203090

SHA512
1352897e13654258eb461967616bc9b8051beeb70278534cf2acc1e3e6ace657fbb3a1153d196cb0f0f6bf6d2568a4271802d272c9fc1e719506b38c5402c940

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\event_type.csv

Filesize
8B

MD5
dddf70d1b3d4bd0465074d1594cc848e

SHA1
a64373384659f4faf7c0c3937100fdf1f85521a5

SHA256
e18f983bfcee11bfdba4f7c8a271c9c174369310f3eff583f7d738dac4203090

SHA512
1352897e13654258eb461967616bc9b8051beeb70278534cf2acc1e3e6ace657fbb3a1153d196cb0f0f6bf6d2568a4271802d272c9fc1e719506b38c5402c940

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\event_type.csv

Filesize
8B

MD5
dddf70d1b3d4bd0465074d1594cc848e

SHA1
a64373384659f4faf7c0c3937100fdf1f85521a5

SHA256
e18f983bfcee11bfdba4f7c8a271c9c174369310f3eff583f7d738dac4203090

SHA512
1352897e13654258eb461967616bc9b8051beeb70278534cf2acc1e3e6ace657fbb3a1153d196cb0f0f6bf6d2568a4271802d272c9fc1e719506b38c5402c940

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\game_status.csv

Filesize
7B

MD5
424cb2a01cc94d7102635bc817bd041b

SHA1
be38c948fd1f0bae27b6b78363cd34ca57e82054

SHA256
add06eb282e562c1c7c4b533730373f6dc2980b4ac1a0ab62df3c8e87d784b46

SHA512
c44a102bb0a61706bd58e7cb3dc2a5ebe60305150fdff34d3c4ff00ab926d7fdfc90107ea7c870db515f9f4ee81a87da0feba1a96786bfaa0fb669a657bbf5bd

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\game_status.csv

Filesize
7B

MD5
424cb2a01cc94d7102635bc817bd041b

SHA1
be38c948fd1f0bae27b6b78363cd34ca57e82054

SHA256
add06eb282e562c1c7c4b533730373f6dc2980b4ac1a0ab62df3c8e87d784b46

SHA512
c44a102bb0a61706bd58e7cb3dc2a5ebe60305150fdff34d3c4ff00ab926d7fdfc90107ea7c870db515f9f4ee81a87da0feba1a96786bfaa0fb669a657bbf5bd

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\game_status.csv

Filesize
7B

MD5
424cb2a01cc94d7102635bc817bd041b

SHA1
be38c948fd1f0bae27b6b78363cd34ca57e82054

SHA256
add06eb282e562c1c7c4b533730373f6dc2980b4ac1a0ab62df3c8e87d784b46

SHA512
c44a102bb0a61706bd58e7cb3dc2a5ebe60305150fdff34d3c4ff00ab926d7fdfc90107ea7c870db515f9f4ee81a87da0feba1a96786bfaa0fb669a657bbf5bd

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\items.csv

Filesize
10B

MD5
ee2a6a1089cf5d751b46a065b294dc51

SHA1
9fcd2fa210a85db2c91e48a179bb76815188f9c4

SHA256
b66c5f98f41fe52c5f5837ff9daa062ca69edd5e0cbdb8301cbd50a53a4d987c

SHA512
689c0d037ba0f43c4437a128f2f01c6a3d31cc837694818899ee8139df282857fa6ad9533c90a101cdde9455ff74713157b66961305a39a675b8e0737e48a0c1

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\language.csv

Filesize
9B

MD5
9b74420728b3d61daccfba3f1fb65e24

SHA1
6853ee6c39c9f0057937201a7d46f25cd3479697

SHA256
55cb6177a8ee7a50cab394614fccc4e02e46fbc20bda2cb0ed37ae8e1a409f4f

SHA512
a862f4a53dcee33cf1f833a1e9e6ec08993f65bfd1dc8dac86cfbdb9094d37e073e44796bce8902e40fa8e29e60c6cc80917fecb6a2d28a264d004b8df4d468c

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\language.csv

Filesize
9B

MD5
9b74420728b3d61daccfba3f1fb65e24

SHA1
6853ee6c39c9f0057937201a7d46f25cd3479697

SHA256
55cb6177a8ee7a50cab394614fccc4e02e46fbc20bda2cb0ed37ae8e1a409f4f

SHA512
a862f4a53dcee33cf1f833a1e9e6ec08993f65bfd1dc8dac86cfbdb9094d37e073e44796bce8902e40fa8e29e60c6cc80917fecb6a2d28a264d004b8df4d468c

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\language.csv

Filesize
9B

MD5
9b74420728b3d61daccfba3f1fb65e24

SHA1
6853ee6c39c9f0057937201a7d46f25cd3479697

SHA256
55cb6177a8ee7a50cab394614fccc4e02e46fbc20bda2cb0ed37ae8e1a409f4f

SHA512
a862f4a53dcee33cf1f833a1e9e6ec08993f65bfd1dc8dac86cfbdb9094d37e073e44796bce8902e40fa8e29e60c6cc80917fecb6a2d28a264d004b8df4d468c

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\my_army.csv

Filesize
83B

MD5
7dc2a69e4af58a6f7376d17d35819815

SHA1
3bb83bd5bcea9b12611e948cc0a1599ee9b59c83

SHA256
eba8ee8f468df79151e034f99741185465a8e1a21010edf50851223fefabad21

SHA512
4a8f29e2c951f22264dedb60fa95dad9cf029955a1e7846c088924456d0f0f421331426830508a588fc7ac63f3ba79e7127cf5cedf5ca4ea711b85434b9fead2

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\my_army.csv

Filesize
83B

MD5
7dc2a69e4af58a6f7376d17d35819815

SHA1
3bb83bd5bcea9b12611e948cc0a1599ee9b59c83

SHA256
eba8ee8f468df79151e034f99741185465a8e1a21010edf50851223fefabad21

SHA512
4a8f29e2c951f22264dedb60fa95dad9cf029955a1e7846c088924456d0f0f421331426830508a588fc7ac63f3ba79e7127cf5cedf5ca4ea711b85434b9fead2

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\nodes.csv

Filesize
277B

MD5
b7fa0f1e6efaaf30584cf0f1a07a7d9a

SHA1
c0ecab5e289dcdd376e44329064b32ba6c2d2a04

SHA256
87921314a2a0e6df917c39f2049a5caec45b9f769f0aaabc37f462bb9c11bc14

SHA512
7b575da03802ef1def51977f78e3a8bf4888bd053a26a87d14d565aee5712163bbab2c74586d8797b73fc864c274d005ac94d510108a5c03b721f0acd8e87860

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\nodes.csv

Filesize
277B

MD5
b7fa0f1e6efaaf30584cf0f1a07a7d9a

SHA1
c0ecab5e289dcdd376e44329064b32ba6c2d2a04

SHA256
87921314a2a0e6df917c39f2049a5caec45b9f769f0aaabc37f462bb9c11bc14

SHA512
7b575da03802ef1def51977f78e3a8bf4888bd053a26a87d14d565aee5712163bbab2c74586d8797b73fc864c274d005ac94d510108a5c03b721f0acd8e87860

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\nodes.csv

Filesize
275B

MD5
41e02937315c767c75ac66e3a6fcbed4

SHA1
93832f849c66c9e413c2561d7472ee53dd9ba27a

SHA256
6907d3e5658ff85378a20fcff0c23262255de3099d144ab72dc2cdaed39e2ada

SHA512
a9457b4041dc90aea0c5a2d36a6e32ba60f6744e72024ff5140a1569613cfd0ac3fb138631d8b87d987a68c13c6e0378803e9faad74d8ed41b2c6c464291b7be

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\position.csv

Filesize
3B

MD5
21438ef4b9ad4fc266b6129a2f60de29

SHA1
5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd

SHA256
13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354

SHA512
37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\position.csv

Filesize
3B

MD5
21438ef4b9ad4fc266b6129a2f60de29

SHA1
5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd

SHA256
13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354

SHA512
37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\relics.csv

Filesize
55B

MD5
aaaf2eeefcfd17c947ddc1ce02bd70eb

SHA1
24aaab454389aea677056e2b5f71debdc8c642bc

SHA256
9da36abc8ba9634eaf4192bf1107be78f7c20723dd05f7483af3c978b7ef6db1

SHA512
0dde78ec98ac8443e2b64f161d92f7336eb8abc6171cdf9ef617b6af88ea675ed758e8e9c9c522160b568d0db326e9ab102d6b3252e2991d42e8c9583af72c3b

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\runId.txt

Filesize
34B

MD5
7c6cd293e763fa6e1b273f282bae7895

SHA1
a8cb1242d2e5321c4509f042645ed8b0b3a04cfa

SHA256
6e4a4f8183c6d2100b20b9f7e89b594105414da6976007397df46a0371916cb2

SHA512
9a63bb686f5b80ec688d214d65a069624fc5f5e2f33b1ebb93a664448be995089a40d92f5dece27ccf6807037cc7ef474d4afb203b15be026a446614e2145670

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\runId.txt

Filesize
34B

MD5
d823970cd395c8c113400cbd23ccb922

SHA1
677056fd4d5d252edd983e8b691cf4b2902287ab

SHA256
508e53f752a9a6942fb5a508716bf5f12fc5be43fd7fa3015c1c33cc7d1482e1

SHA512
cd26bbfd4710cb87ca021e2fba7c5bdb2066d47ac293ed08b0e3000b28bd1a05a17b4aee11e50fa469f518c656a68d6027b5ca0df8d643df88bc0e4d1b291160

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\sessionId.txt

Filesize
34B

MD5
67815fc91bef8d38e3704b1e9118da21

SHA1
4edd5c1482ba3039ea1c104c3f6a60cf3a83c2c3

SHA256
9ce3223e4ab783f02d2c82d98daabb88d64dce8fa62ae4751da5e415569c7f7f

SHA512
9c9dc7e537d09fa21915b5df7efc5e1cf008f7be1525ecc98eac4e4856d988083368bc1fa2612fd90f38bb2a809b2374f5c08de715e0ea1394a7975f023eed90

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\sessionId.txt

Filesize
34B

MD5
5f44a2bac1f9e982a1a4a73cb0c3acb1

SHA1
e185356da046af56faf19e2b348731219df41eb7

SHA256
f5a697a43dc99f11a11d54f79648a2bd55229277bb6cd5fe86bec395f7a40af1

SHA512
d8ec17614fcd5b17b451b3a61b82edc51f4b4cd6537e8731c62d00149c278567ed32778cd3763251db9d4632ae9e26f85f4d75ce9418657ae8dbefff9b7d11a2

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\stage.csv

Filesize
10B

MD5
bf8f6151138570699fa97218f24a3a9f

SHA1
046a6f69f085cb35a131e36a0b88f0d3724de5a3

SHA256
c0218320ce5c2c734c9f2dd17e7b2a153f68d077c2e92d476032c9a86ec450ba

SHA512
164d63454b4266c9bdbbc821378c426cf96656be3cacbd321cfbdd90c3035bc64d100f7e55687c30d470d7d61f2ef8062763abf7e27c6b66cbc5e8355df70801

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\stage.csv

Filesize
10B

MD5
bf8f6151138570699fa97218f24a3a9f

SHA1
046a6f69f085cb35a131e36a0b88f0d3724de5a3

SHA256
c0218320ce5c2c734c9f2dd17e7b2a153f68d077c2e92d476032c9a86ec450ba

SHA512
164d63454b4266c9bdbbc821378c426cf96656be3cacbd321cfbdd90c3035bc64d100f7e55687c30d470d7d61f2ef8062763abf7e27c6b66cbc5e8355df70801

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\test.csv

Filesize
2B

MD5
81051bcc2cf1bedf378224b0a93e2877

SHA1
ba8ab5a0280b953aa97435ff8946cbcbb2755a27

SHA256
7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

SHA512
1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\test.csv

Filesize
2B

MD5
81051bcc2cf1bedf378224b0a93e2877

SHA1
ba8ab5a0280b953aa97435ff8946cbcbb2755a27

SHA256
7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

SHA512
1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\The Ouroboros King\userId.txt

Filesize
34B

MD5
d9bfdfbfd68e8549fe17ba6a5442e2ce

SHA1
ff3b708de04ce7a34093abe33f22043450e2350b

SHA256
068b22291164da573c170b3caa3f7c1a513a02b54d98f333268fdc573d7c3a2c

SHA512
17e0d6c61ac32dc04eb378c436d15926b50e529835654cb2606a6140f20dc909a64f1dbdb689e81f048a9f627d9a63186916a8f16a0eb447f8fdd15975e7eab0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
b040d3f0db1777e6f1d0aa048e216ae0

SHA1
b3211477986266ab05880e1aa56bd68f70b62793

SHA256
b163a892725aa1cbd547a825d7659c49a7e4d43586c5d9de9a1cb18e7c417b02

SHA512
d1bd982b1249bbc16b0e62c5e9eab3a31f38c92ec78e42e54f2302cfaebf49929f26b14db51491614a2f15f2abfe7779281c1f7ce8aa0e258ceaf848c1d5e1a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
09f9a9bd20f27d1814d6fdbf89cea044

SHA1
007aa491da5f78907a3e035837d414325a45185a

SHA256
3921238068cc1e1165a4a20fb02fe49d277d7c1cc5153bf54268d8de8a815e41

SHA512
ea0a83a1f4b046d478ce9a5a415e4e501ac83f7226d0d64a1eed84877266547ba9b58743001c38cba895550425ac924356a892801895e32317d3e964e6869924

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
ffe1c99be453594b98c3c2d8821ddddc

SHA1
67480da394a57003e791e502b91f0fe5e5f11015

SHA256
d84c14830b4329d5dff118ca18e19d50bd40bb0d773ba931fe9156b7ab422a89

SHA512
82ebca788c428924a0a79cfe30575d8e0f02e47439baac0785ab329d2817c43dab63fdab301d162f31393529e6618308dbda824c99abd8e2fbe451cda054b897

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
b1d74591ce2a309cc1e0ad8b9ac91d29

SHA1
0266b40de06ccbd2c5d99cf0da7bf4a9f3a73590

SHA256
5ae9928eb0876aaf01f57df6c8c5198d50fc46590988b1eebee2cb862a1702fd

SHA512
b1dc3d8c87b3fefa43dc02f60bd84a03eb9729182213109bdce029b649a25e3cdd0aa2cf3975d2a79fd965913eb235540da628578933d245aa1a066ceb61fbfa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
f5570de703d18ee0c5cc7abfc981893e

SHA1
e70b36c5cd700fc58d3226c1a1eb445cf4d72d9f

SHA256
2c56709c5cd77424cf15de6d1d7d4fabcef81c5e7d55f772501cafb38f26ce01

SHA512
071b1b44af8a3099b650ef91ee5abcd3ddcb7080af6885bcf53f25b312ba580c5c108942c3c7edfa182f2aca923c1534ef82d5417d06c6766d886c941604978a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
6d1d1bf521f6a980c04418c0fa445612

SHA1
90956491401a405df8c8c5c878fc78673583231f

SHA256
242298a9ed4a62b17cb19f858668abd9241ced1ea2df5be1aa35d215690d65a2

SHA512
dc85b89e5de218e3d811e7adeaec38b955a40f9acfe63547c1727bd07a7eb673bc4640f1a1414e9d1dd058e5bcecf1052430a95b0e9a7161759c45d0effc528c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
874B

MD5
43ebc1356e7efcce2398d6b54a585e94

SHA1
9c8f34e193181d821e96e197c5c84b849e606450

SHA256
dd1db84188a926f6c0b4564b19634106186efa229411d702f879ce7130cc46ec

SHA512
94c391ebd56cc80a5f26d070b738ba588739dd58f1fefb30c8637b0329e6be4583aefbbd1a5dd61e579ec901895cb893ffe1134a0ecf8518d7bf8dc912fe5656

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
16534f45fd20bc465ac88cb31cc581d6

SHA1
bdba6a7b33c182baa2b68d46d4255918d1838cf7

SHA256
5ca5cd82ca1a3647c9b181ddb02a81dc6f66f0b0e7b4c55b0d5e5d10f0fee5d5

SHA512
c1bd805d964fe5c47484a1a908c7460c5242ac455df17fece3c13960d4cfff5cfa1c8457e9295c487d94e09d51845ea79e3a6fe2411dcd9f15df7a2ac71baa3d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
4faf8e8ae23a0176d183798f6fba5bd6

SHA1
96422307ad5b05a337bf755f3c702ec59c9e40f3

SHA256
46a21ced366d5f495a674a6817b767a98f6d919cce135607111f313e99af9749

SHA512
d8fd3df29b69d3089f9e33b31e922002b2d77b3f6a9c1e7b443059925a6bfe1eedd97451f251fcd32586de8da81f754e3c3ed3cee5a3943e20c8f673c56a7e6f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
f725c43e667b1bb0994c039d124fa8c1

SHA1
6c4347f5857362b517d1b9c297803c9f19f4eaf2

SHA256
ebeb3fa347650d9279b5c98a4678dbf2160ee1d6925ebf145ec1f0afc57ebdd7

SHA512
b7396231f401cfae33209ab0ca64f90af4ee39521ea2e3dc525e2fef1b538d50e9ebfc8186d1e9fb30586e017205405e9725985d33ae5d2a7e4e75edf80b51c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
4e62c3eac49f1b40a75a7fecc2ec9cec

SHA1
7b5b16227581ec06d28a9d66e166364a07ad400b

SHA256
dccd97e94549d272cd5c056f768e349d3742f303cda11499204873b4b95556a8

SHA512
324681d76d6f086a0e44cd5d81fcc08c7ef16ac050e2054beef3869a437ac7e00502e686547d114b25a4dd93d94b55ab4e39fd02b3332a47972d1c48656f9ca9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c1349e1f9a5724622407978b38df4343

SHA1
f221d8dbe04b3a8aadd911cc24d9b99e8394d511

SHA256
8231a77aef2bd024f922c98d63732cdf775342499cae7b44135584774e88f5bc

SHA512
785e5dcfbbe572022562252883e8f2c75c8a87c4b15fb691c7f0e1e7211513aed713af6eb115e65f7d4f63fe743c12388a38195f37ac0e6421b556229eb2aa01

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
1280140f746e65d9a0bc236f61e6f254

SHA1
394877233784af281fbb0e8194c36fe9bb7eeb1f

SHA256
c0c1ab35297586ad6bd5eb50cd6f330ba881ce6786774fa8a91fc316e88c0b28

SHA512
4ce6d832d067ca0e0ca0f56d9711242113cbf5c0a82bfe88e8409727a9ef5289372ace9d14688e8ded1f52a33dab96a8e04d1897b91ccf4a227f3a6c8e68b5f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
c5bc80f277cc889546193b6696e6ea9e

SHA1
8b7a206f4eaeea801f2837ca554ba7e5fc172ae4

SHA256
08bb8f489970da90000c49e0fcdfead6aaafa3efadff965c98c492694718503a

SHA512
a1b4d39a764bf47e4b8226e3c39da6ff7c9fd51c32de4edec61308fbdff1d7c5e1fac22ee4a61b2a5f1796e95d67a05dfb23cf9b7031cd09349a5728a98e8108

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
48B

MD5
223cede41cce405093448de29fb69806

SHA1
5a5a513afb5ddddefe93cf5e512d384ba619953d

SHA256
f606fa272e85f9c739fe8e700c021f6b0c8453c47e43f942913295dfa050af53

SHA512
ba2a148126cd043372b736a238ab87c83f934f372154d6ee5252ff50ba787c3e76f38194d6748edd4d3f1706a36867c3fe3b0da21c5a6858df255a1a36e69e85

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe571e07.TMP

Filesize
48B

MD5
651901c79a421557c9670fda0d71e21e

SHA1
c616ff801f7369b618db927c016bf50c3c0b4ac6

SHA256
f011e6843803bb67e92748c74acfe400f9ae55b2bd444f743afd3398635efaed

SHA512
83aa55001cc67a5ebfff21bdc1b5a89f971a8d6a8fd42022f82e0df508c61f42dc271e91b8a656dd7e3dee72bda5bc38ac5123a99d0fa81bba9cf5638a48f549

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
172KB

MD5
0b93131eceb8d20b1120c55e6439bd6f

SHA1
3b1ced4bdb4db852bf3973c7acce404bcb275f60

SHA256
eb041b5259f3d50222209dcd0c195237feca50fa47ad9727806bfaaa827bae06

SHA512
22e0696addaef4262aa5ca10933efc3fdf8862dba30113eea15e175950c4957767885d5df82abc0883df52117387144742e92f155ff982d25b4d62e68ad0639b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
172KB

MD5
91088ceede19d65d7a19b7058b557f74

SHA1
e46be2808a77cf35e89bde1a9456cda303029b47

SHA256
ab6675edceecf2f189c4f5bcaf684c4becd0bbfcd481ab271bd76144d8e47a5f

SHA512
2d1cf5430e19766936fc8baf3a701445deded4afbe94289d4cf2246e2dcb1e56a3490f6eab454da74f36974c25288b68077a7308da7f09554068bafcb7663265

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
172KB

MD5
ebd2316f5a40b1966e88fbf21fae13d0

SHA1
e9a012138429a62c0118f656f0b79db54d9fb828

SHA256
e7acea81e698bdc6c3f95409b5909e62f3dd747ebd962ee60675fd72a9c81996

SHA512
aa5cab4f83ca62bf1f2438b85b1722f3b29eaa700111cefcbdbc1a7d926fa5ba2f47b080d37a506bad5773f849248954a30a46c3a1d8b05ee69f0df091242d06

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
109KB

MD5
f87d8d88252ce97c970a76300f169b34

SHA1
6a1478a8ad3d000a2111d273eb3f6294d3984d6d

SHA256
2f4e373d919afd1997db55b9b4786932379dda3335ce9d315cb9ee1597d8c77f

SHA512
bee00e0d16bd4c5d8156ef2de394702c175793309a807243f07b126a0c2888a5dc03aff347f826a6b161437964f56be42af355661c24420348e39ea66a261ac8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
105KB

MD5
11a2fe213b349685321b6a35655a3ff8

SHA1
4175117d7b9f14e192aed7625ed5c76743f6d092

SHA256
a8d6a57684fce94210684d589aecdce1b5a2726dbd346ca1d881cd1b4703ecc3

SHA512
593ee4169fc2df77a1b32b813ba1039c8338fd76c553c08595b362917b2eb8bec023940c6e7ed3ded2a6d120c5745f222f7b2ad9562ad41118fe88efb545285d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe576198.TMP

Filesize
98KB

MD5
c9f025ef64e3f5d8dd877d4973bbb933

SHA1
c2e4fb7bb340eea608fccd1e25d76e4a87855b16

SHA256
720a9775d5ac158c1ea692de51612ac638f2aeb62e3f95e39ed06694eb86abee

SHA512
cfab98a98701b682fb7ea3a2d5d89c16608fa1412c669d67b94e488099e830627fd4fd1a72989db2a3c2008e9d6d58e639d9d410f812a17191d6d536c4434171

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b7c06bfe-bdac-4f2c-af61-590f258bb60c.tmp

Filesize
172KB

MD5
dee7971e7d0d0a4ae618d497d4a1a117

SHA1
9dd1af956c5cb9642571409bf4c34415ae183991

SHA256
4294d51cf2f74fbc3d8d3da6f60d3c232f0fb5e710021f233108b5b57cf5419c

SHA512
40a8d45265d8c6c1da5a3974bf7c2fddfb0ca8d95288ad5e5d2c384aa29f6b22399ca1d0d53f9eeaae03fc21fc7b06ee6f6e90f12e01443b4aad6f2cd0d35389

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Roaming\Goldberg SteamEmu Saves\settings\account_name.txt

Filesize
4B

MD5
654e1c2ac6312d8c6441282f155c8ce9

SHA1
b601eaa0f87fe94355f635b77a7608b971ea8825

SHA256
bc3a7860cd4f58f3e1e66a20e3cb2930477121c46b9e030636bc6c5cfd050071

SHA512
a3adcc6bef462dcea21dd995bec6b4466c68ee85c8059c27fba7bb33ec57ec00c6bed9528be92d1044100b749a68ee439f84c9b8a37d1dd13d7fccbe231ed31a

Download Submit
C:\Users\Admin\AppData\Roaming\Goldberg SteamEmu Saves\settings\language.txt

Filesize
7B

MD5
ba0a6ddd94c73698a3658f92ac222f8a

SHA1
1b669334dae8ebafa433f0175b5fd418a7bc0975

SHA256
b6234d2ea0d6022be63db80d7b80e221097fe4a469dc44febcd2a9241effdeba

SHA512
0882b702e0f4c1db1701789796ab1d12d72627811b67299bf36b9b25c29465cc24e72483d171c435368dc9f777837d2bd45ccff293de2207d32ba58a6ac01023

Download Submit
C:\Users\Admin\AppData\Roaming\Goldberg SteamEmu Saves\settings\listen_port.txt

Filesize
5B

MD5
76bf79e9a0a4c128d97dbd6900773f4b

SHA1
8abb38a924d5bf8a1ee12fe96aa2d2be942704d6

SHA256
45095e3e3f29ea73ffab2e23158b7cd2afa6532004b5a9b6f06d4e5e068a89aa

SHA512
8cd54c07d87c41103d963eb7dfd2642b07bb67ceb731b477fc9cd9b736ab03833dc2e2d0b2eb399002d76d405a20d5816d19d77ef760d7dac0c1a67d80662535

Download Submit
C:\Users\Admin\AppData\Roaming\Goldberg SteamEmu Saves\settings\user_steam_id.txt

Filesize
17B

MD5
d01e903d487e8f852534435770a659b1

SHA1
bc0e8ddcfb2e0b0d04a2fc85aae1e158fca3bc82

SHA256
4bc33de85fc70f8f38c24e39938231ef16a16a0e92990486155f97127d8b97ed

SHA512
2d48f73435d75300d9c22b1cdfc7afd856386103842066adef01afa87f26ec38762d7b4fdb2675261440835b97006f2e0ae38bad255ea9c451d82b0fb09a5e9a

Download Submit
C:\Users\Admin\Downloads\The.Ouroboros.King.v2023.05.30.zip

Filesize
168.8MB

MD5
4973704b6ff1d989295183b5e2b3360e

SHA1
c10db5d8279d9ecdf9ec378060f7664029ad6657

SHA256
46bb88bf68e28a08b4ac33008a086febb3d73039ff55de78222df7535f6ba3d7

SHA512
1000f6bb338d893bccddb2a0c38aa0dc54cb4f4248f8ad447e855969321dc3e9cc4be6b6b3ce0566e7ebc30e7c516da7b3c776e922a8e80eab721943a54ddb28

Download Submit
memory/3552-591-0x000001A5C4070000-0x000001A5C4090000-memory.dmp

Filesize
128KB

Download
memory/3552-508-0x000001A5A3F60000-0x000001A5A3F80000-memory.dmp

Filesize
128KB

Download
memory/3552-593-0x000001A5C4140000-0x000001A5C4150000-memory.dmp

Filesize
64KB

Download
memory/3552-601-0x000001A55F5C0000-0x000001A55F5D0000-memory.dmp

Filesize
64KB

Download
memory/3552-602-0x000001A55F5D0000-0x000001A55F5E0000-memory.dmp

Filesize
64KB

Download
memory/3552-603-0x000001A55F5E0000-0x000001A55F5F0000-memory.dmp

Filesize
64KB

Download
memory/3552-594-0x000001A5C41F0000-0x000001A5C4200000-memory.dmp

Filesize
64KB

Download
memory/3552-604-0x000001A55F5F0000-0x000001A55F600000-memory.dmp

Filesize
64KB

Download
memory/3552-605-0x000001A5C4200000-0x000001A5C4210000-memory.dmp

Filesize
64KB

Download
memory/3552-606-0x000001A5C4320000-0x000001A5C4330000-memory.dmp

Filesize
64KB

Download
memory/3552-607-0x000001A5A3F40000-0x000001A5A3F50000-memory.dmp

Filesize
64KB

Download
memory/3552-608-0x000001A5A3F50000-0x000001A5A3F60000-memory.dmp

Filesize
64KB

Download
memory/3552-610-0x000001A5600D0000-0x000001A5600E0000-memory.dmp

Filesize
64KB

Download
memory/3552-611-0x000001A5CD240000-0x000001A5CD250000-memory.dmp

Filesize
64KB

Download
memory/3552-609-0x000001A5A3F60000-0x000001A5A3F80000-memory.dmp

Filesize
128KB

Download
memory/3552-613-0x000001A55F2E0000-0x000001A55F2F0000-memory.dmp

Filesize
64KB

Download
memory/3552-592-0x000001A5C4110000-0x000001A5C4120000-memory.dmp

Filesize
64KB

Download
memory/3552-618-0x000001A55F450000-0x000001A55F460000-memory.dmp

Filesize
64KB

Download
memory/3552-617-0x000001A55F2F0000-0x000001A55F300000-memory.dmp

Filesize
64KB

Download
memory/3552-619-0x000001A55F480000-0x000001A55F490000-memory.dmp

Filesize
64KB

Download
memory/3552-620-0x000001A55F5F0000-0x000001A55F600000-memory.dmp

Filesize
64KB

Download
memory/3552-621-0x000001A5CD240000-0x000001A5CD250000-memory.dmp

Filesize
64KB

Download
memory/3552-622-0x000001A3D9250000-0x000001A3D9260000-memory.dmp

Filesize
64KB

Download
memory/3552-623-0x000001A3D9240000-0x000001A3D9250000-memory.dmp

Filesize
64KB

Download
memory/3552-625-0x000001A5C4050000-0x000001A5C4060000-memory.dmp

Filesize
64KB

Download
memory/3552-624-0x000001A55C790000-0x000001A55C7B0000-memory.dmp

Filesize
128KB

Download
memory/3552-628-0x000001A55F2F0000-0x000001A55F300000-memory.dmp

Filesize
64KB

Download
memory/3552-630-0x000001A5CD240000-0x000001A5CD250000-memory.dmp

Filesize
64KB

Download
memory/3552-629-0x000001A5600D0000-0x000001A5600E0000-memory.dmp

Filesize
64KB

Download
memory/3552-627-0x000001A5A3F40000-0x000001A5A3F50000-memory.dmp

Filesize
64KB

Download
memory/3552-626-0x000001A5C4120000-0x000001A5C4130000-memory.dmp

Filesize
64KB

Download
memory/3552-489-0x000001A3D9250000-0x000001A3D9260000-memory.dmp

Filesize
64KB

Download
memory/3552-490-0x000001A3D9240000-0x000001A3D9250000-memory.dmp

Filesize
64KB

Download
memory/3552-493-0x000001A55C790000-0x000001A55C7B0000-memory.dmp

Filesize
128KB

Download
memory/3552-590-0x000001A5C4060000-0x000001A5C4070000-memory.dmp

Filesize
64KB

Download
memory/3552-589-0x000001A5C4050000-0x000001A5C4060000-memory.dmp

Filesize
64KB

Download
memory/3552-523-0x000001A5C4120000-0x000001A5C4130000-memory.dmp

Filesize
64KB

Download
memory/3552-522-0x000001A55F2D0000-0x000001A55F2E0000-memory.dmp

Filesize
64KB

Download
memory/3552-521-0x000001A55DA10000-0x000001A55DA20000-memory.dmp

Filesize
64KB

Download
memory/3552-520-0x000001A55C790000-0x000001A55C7B0000-memory.dmp

Filesize
128KB

Download
memory/3552-519-0x000001A55F480000-0x000001A55F490000-memory.dmp

Filesize
64KB

Download
memory/3552-518-0x000001A55F450000-0x000001A55F460000-memory.dmp

Filesize
64KB

Download
memory/3552-517-0x000001A55F2F0000-0x000001A55F300000-memory.dmp

Filesize
64KB

Download
memory/3552-516-0x000001A3D9240000-0x000001A3D9250000-memory.dmp

Filesize
64KB

Download
memory/3552-515-0x000001A3D9250000-0x000001A3D9260000-memory.dmp

Filesize
64KB

Download
memory/3552-510-0x000001A55F2E0000-0x000001A55F2F0000-memory.dmp

Filesize
64KB

Download
memory/3552-595-0x000001A55F460000-0x000001A55F470000-memory.dmp

Filesize
64KB

Download
memory/3552-507-0x000001A5A3F50000-0x000001A5A3F60000-memory.dmp

Filesize
64KB

Download
memory/3552-506-0x000001A5A3F40000-0x000001A5A3F50000-memory.dmp

Filesize
64KB

Download
memory/3552-505-0x000001A5C4320000-0x000001A5C4330000-memory.dmp

Filesize
64KB

Download
memory/3552-504-0x000001A5C4200000-0x000001A5C4210000-memory.dmp

Filesize
64KB

Download
memory/3552-503-0x000001A5C41F0000-0x000001A5C4200000-memory.dmp

Filesize
64KB

Download
memory/3552-502-0x000001A5C4140000-0x000001A5C4150000-memory.dmp

Filesize
64KB

Download
memory/3552-501-0x000001A5C4130000-0x000001A5C4140000-memory.dmp

Filesize
64KB

Download
memory/3552-500-0x000001A5C4120000-0x000001A5C4130000-memory.dmp

Filesize
64KB

Download
memory/3552-498-0x000001A5C4070000-0x000001A5C4090000-memory.dmp

Filesize
128KB

Download
memory/3552-499-0x000001A5C4110000-0x000001A5C4120000-memory.dmp

Filesize
64KB

Download
memory/3552-497-0x000001A5C4060000-0x000001A5C4070000-memory.dmp

Filesize
64KB

Download
memory/3552-496-0x000001A5C4050000-0x000001A5C4060000-memory.dmp

Filesize
64KB

Download
memory/3552-495-0x000001A55F2D0000-0x000001A55F2E0000-memory.dmp

Filesize
64KB

Download
memory/3552-494-0x000001A55DA10000-0x000001A55DA20000-memory.dmp

Filesize
64KB

Download
memory/4688-633-0x000001BF4CCC0000-0x000001BF4CCD0000-memory.dmp

Filesize
64KB

Download
memory/4688-632-0x000001BF4BA40000-0x000001BF4BA60000-memory.dmp

Filesize
128KB

Download
memory/4688-631-0x000001BDE8570000-0x000001BDE8580000-memory.dmp

Filesize
64KB

Download