hxxps://cs16download[.]com

Analysis

max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
04-09-2024 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cs16download.com

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000100000002ab2a-517.dat	acprotect

Executes dropped EXE 4 IoCs

pid	Process
3168	CS1.6_Original.exe
3108	CS1.6_Original.tmp
1400	cstrike.exe
2876	crashpad_handler.exe

Loads dropped DLL 43 IoCs

pid	Process
3108	CS1.6_Original.tmp
3108	CS1.6_Original.tmp
3108	CS1.6_Original.tmp
3108	CS1.6_Original.tmp
3108	CS1.6_Original.tmp
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe
1400	cstrike.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000100000002ab2a-517.dat	upx
behavioral1/memory/3108-519-0x0000000004800000-0x0000000004831000-memory.dmp	upx
behavioral1/memory/3108-572-0x0000000004800000-0x0000000004831000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	cstrike.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
940	GameBarPresenceWriter.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\CS1.6_Original.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CS1.6_Original.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CS1.6_Original.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cstrike.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crashpad_handler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133699462079113832"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1287768749-810021449-2672985988-1000\{6EB7916B-7064-4BD8-9042-8E282B7C38B0}	svchost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\CS1.6_Original.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3972	chrome.exe
3972	chrome.exe
3108	CS1.6_Original.tmp
3108	CS1.6_Original.tmp
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: 33	4292	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4292	AUDIODG.EXE
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe
Token: SeShutdownPrivilege	3972	chrome.exe
Token: SeCreatePagefilePrivilege	3972	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3108	CS1.6_Original.tmp
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe
3972	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3108	CS1.6_Original.tmp
1400	cstrike.exe
1400	cstrike.exe
2124	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 4804	3972	chrome.exe	80
PID 3972 wrote to memory of 4804	3972	chrome.exe	80
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 1076	3972	chrome.exe	81
PID 3972 wrote to memory of 2160	3972	chrome.exe	82
PID 3972 wrote to memory of 2160	3972	chrome.exe	82
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83
PID 3972 wrote to memory of 3888	3972	chrome.exe	83

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	27	curl/8.4.0-DEV

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cs16download.com
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcbbcecc40,0x7ffcbbcecc4c,0x7ffcbbcecc58
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1756,i,16619878496599964993,7962389149000587112,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1752 /prefetch:2
  2⤵
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2056,i,16619878496599964993,7962389149000587112,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2096 /prefetch:3
  2⤵
  PID:2160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2180,i,16619878496599964993,7962389149000587112,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2152 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3076,i,16619878496599964993,7962389149000587112,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3108 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3084,i,16619878496599964993,7962389149000587112,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4480,i,16619878496599964993,7962389149000587112,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4612 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4304,i,16619878496599964993,7962389149000587112,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=4804,i,16619878496599964993,7962389149000587112,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5476,i,16619878496599964993,7962389149000587112,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5488,i,16619878496599964993,7962389149000587112,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5788,i,16619878496599964993,7962389149000587112,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4720,i,16619878496599964993,7962389149000587112,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:5116

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:824

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004E4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4292

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1244

C:\Users\Admin\Downloads\CS1.6_Original.exe
"C:\Users\Admin\Downloads\CS1.6_Original.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3168
- C:\Users\Admin\AppData\Local\Temp\is-8R0TG.tmp\CS1.6_Original.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-8R0TG.tmp\CS1.6_Original.tmp" /SL5="$902F4,258474155,728576,C:\Users\Admin\Downloads\CS1.6_Original.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:3108
- - C:\games\CS 1.6 Original\cstrike.exe
    "C:\games\CS 1.6 Original\cstrike.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1400
  - - C:\games\CS 1.6 Original\crashpad_handler.exe
      "C:\games\CS 1.6 Original\crashpad_handler.exe" --no-rate-limit "--database=C:\games\CS 1.6 Original\crashes" "--metrics-dir=C:\games\CS 1.6 Original\crashes" --url=https://sentry.cs16nextclient.com:443/api/3/minidump/?sentry_client=sentry.native/0.6.6&sentry_key=d5683aac3be41375ad96f7e8b8032bc7 --attachment=launcher.log --attachment=platform\config\serverbrowser.dat --attachment=user_game_config.ini --attachment=setting_guard.ini --attachment=qconsole.log --attachment=debug.log --attachment=nitro_api.log "--attachment=C:\games\CS 1.6 Original\crashes\bb922853-8ab0-497f-d8c9-53beb5f8231e.run\__sentry-event" "--attachment=C:\games\CS 1.6 Original\crashes\bb922853-8ab0-497f-d8c9-53beb5f8231e.run\__sentry-breadcrumb1" "--attachment=C:\games\CS 1.6 Original\crashes\bb922853-8ab0-497f-d8c9-53beb5f8231e.run\__sentry-breadcrumb2" --initial-client-data=0x36c,0x370,0x374,0x348,0x378,0x11fb6dc,0x11fb6f4,0x11fb704
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2876
  - - C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic path win32_baseboard get serialnumber
      4⤵
      System Location Discovery: System Language Discovery
      PID:1552
  - - C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic diskdrive get name, serialnumber /format:csv
      4⤵
      System Location Discovery: System Language Discovery
      PID:4280

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:940

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
df990044e729fc3f265cf58b0cbaa56a

SHA1
99d66269add3183e40033f3ef93db6dede0282a9

SHA256
95dd632d0e3ae19f8a108928827847df817083c0d94bb3d48c2af6f3ed07558f

SHA512
17cce3dca43c7dcf350e58b727b1e221032f7e99427108441ee3a3c1b4cce0826f1ea10e6073dd792bac6d821b7285f37fb6b6e134a5e33ce4fe29afbe77f70e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
933f0a31965fe000800934089eb48990

SHA1
c43a8cac0c2fa5cc3367cebd2085609e27e66e11

SHA256
a080d4de9110aee20a8a58f7fa601e7420f34cae608d3b9db1527462328135e8

SHA512
734c8c7786ca60079108e0a899cec5785945a2747cf6d5dfd4f6a466fda466732430f6cb8d1631dc3188c6ed481cf169619302bb6c6bf405ce56451a905901cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\p\00\00000000

Filesize
4.5MB

MD5
e0163840413fe72da72d8afedd5b8e40

SHA1
1664ce922854af5f0f31f0f09539f4e7626d341f

SHA256
4d6201ffcf564cc8db02f16880b89239138421cd1b3f596cc5445d52c92ddd69

SHA512
65a0fa82fdd14fb478845d58a0566fba914a714ffa88a05c7335dc47116adb013ce87ab77aeccf1c823feab301b981aff1bab3f7e0694653b6ea8442e6c673df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\p\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\000003.log

Filesize
49KB

MD5
04624bcc8f4912ed09e01611153bf819

SHA1
a12275e08f085b5cc85320933c80016f78e967b7

SHA256
fc3a8dcd1b1d5c186f2f434e2b46318ed5998f81f9bbabe2a8a5be0fd5541ff5

SHA512
34975e9f9f984cc331734e44dcca8634ef867131ce8143048fb2072b34f67bebd7906f68e3397488585fbdb824694b62d2f89455c78c4d53a11b2f5af2cb22db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old

Filesize
376B

MD5
03ca9efedaae47a5fb87718421e6c1a6

SHA1
2cd57789f895be6d862bacf21d3624313f0f1926

SHA256
39576a7ce7971baf8225b210826935de91f0f82aada4fbc6e781d60b8af00fc9

SHA512
718430ed1c88821e09723d5abade4c824629bbe7e68ffd0ab77278fe6a439a7e6e8567d02caf97dd3e84b2e037b65a0985581be4eb57e62f2089c5186d4bb020

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old

Filesize
376B

MD5
04e77750b02d527f6fd59c4649544845

SHA1
d480e6f7f8b6c02ea5747e4e1fb5a8bb96a9e0d3

SHA256
2fb8c8b858c9d6b01c13591bbf09b4a5afb9447f47d3ea78506c25901f548ea8

SHA512
2d0366b99a300123042eb302d9c155f02691b67dfedbb2aaa87076726540b8a2958e5d4d7ee2d4ac4f7710c74dd9ee1a3170b09a163d18e72b7d3f0a81c18cbd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old

Filesize
376B

MD5
789201fc1bc44051c59c7ca0ad17c647

SHA1
3c21724c0913e9ba2d9c7d49b376dc734c9702cd

SHA256
e66f3eabc9c6a1faf6c4593128ba19b216e247c7bfa6052670d3f81bb749a2e6

SHA512
9d702c0488b472a757daef7df31f13da2215c6a68a28e33c1355e0ee0bfb8f8b3d9a476e6472b91769f98c83f74cce8d242b04d90ae5215798408142225a5ca0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old

Filesize
376B

MD5
881ff06b2519010c451f4a25e0798140

SHA1
4fb77ba466b7e0df22218211e164e6087e77901e

SHA256
36e5072be353527493af602b5630a6104ae229521c1ae35f1a3234d1578cd93e

SHA512
8703c0c004e1b6ef604c420311d4185e9ab43a157b339c1aa5a856a75e43c78f705ee60d34c814dfe44c3151b772747fa2b32fa03e5b06ece6a2b8756f6d2054

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old

Filesize
376B

MD5
7f9b7f78d5cf6e4e8dfc37023592ba81

SHA1
488529372514bbd72a4729bb0818b3522a92b1e0

SHA256
8c4145e55990d78238f88bbf281c9984da16f66f0c7e642eca97ff8c3c992c96

SHA512
920064d4e978b8d6aa7104672c6a176e57ab5a901e60554822b4745dacacefa280ff79dfb446c8ed63c529af1287fec021f52b0bcdd937e1ac3919797cecd4d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old~RFe57ff11.TMP

Filesize
335B

MD5
63cc061ad9532ecc480770bc90a8adec

SHA1
4ee7897c03660b9924f40e8c1ffe5c6db97d7aac

SHA256
e07c251fe631ae06c0ac029ccaf30642c4d2db5dbc1639dd4e10922b06db94c8

SHA512
9dbfc237c113dbea209a92102de970e739d8a9930497eb43912c677dcca3ea872c4f3e02578dc6de25210f698bd28b423cb8b69487b1fe24f2d8c8935bdde54f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
57239a81d6ebdc5a03b43bb2c2c41e7f

SHA1
93dee9e86db760afbf798c5702d9ac87a17f9a0b

SHA256
f082c8b366764bb650580598ea647a472a1af5c24a65ea4bca7f098283e791b0

SHA512
aab708af89bd60b1f845c36e8c3d7bc3542eee8489f3ae2236c1e0eec565113e64477450f93cc0247990db7414c95fa6892441b819adf784249e85c1384c5764

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
523B

MD5
cbad19bfb6201f8d942c0663c4cabe6e

SHA1
47ecb906e144272276ddb6af8ac7bb35fa5bffae

SHA256
be9ae7a8e8fba1c96bc8926c97fd9e9fa4437bbebe736f8851a1f473e608a45b

SHA512
fb4cbc039963fd5999934c4305cf032f6fd5fac287189d6caea0efbef16c2d95b80bdb27d64cc87675250726bf4603d1224881dccf1d956921dacac7374bc423

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
468d0c74ec4e6ca4afd01a0464723b1d

SHA1
ea8ea78db42ba0873f2305b61b0f73db561a0ad6

SHA256
a68b076174f83fdb9ae7ad830fcb20453a9c138f91b4097386f0786958f453ee

SHA512
12e8c5303260065a24a384705af5332380f9e67313bbe903e3583595bca58d612e9f3dd2cfcfde6c56872af534a4eec5c8ecb8c8c0a556b35bd0ddc83451a3b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ea10b14cce714326d021ac3bcc7dad7c

SHA1
3b796e8586b4f84d8439795837ee93d5194bb441

SHA256
19cc1c255364ac07ac5a8394b4f624560360d6266b81a868292bca47ec710b5f

SHA512
3e7805b3b9ed95e35538b17b5553d73d65c81429b38f54c6a7707b9e929487a93950c086b867a7292ffafc9badcce27579a4ffbd47a1a0abbf1ff4131c86fcf6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
5c993bbd5b8516d57ebda8e02f98cea6

SHA1
3147344f527d8dbf4303fe80488cd0f97e187300

SHA256
b7a8179d9dfadf98c04f49e5450416afc631fb509c7d2df16856c21de570492f

SHA512
65869732599d71c99951405ea1c753aac9dd750afc1534957db7e6b7cacd6b330729ec468c2e4227c0a76467470ba35d07f4a35f5dbd1ef105bb75fd84715967

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c28a0eaae3dcdecb8fd5d70b840905e3

SHA1
b438df7b8a33a1d7caf319f06fc671a0c6f730f4

SHA256
8ab0a9b48fae218d6371ff1176620b9f768e6c42ab7561500b67fdaebd3880a9

SHA512
02817b5033b77ead45395acefe616b4b447ce8474ec014969d1dbb7f980a666c7630c01eef237a8f6dd95ab1cf1779517b5d7e3a9a7cfd826dbf9da20f40f77d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
3661b45b3d9dc512f2b887e122897647

SHA1
3f7336708d890bd6b252db869af011c68995d5c4

SHA256
f76dde8e1198f13fd7108af9744576e096c1322eb8cb21c26e09569305d2fb42

SHA512
9805e8d4462a935cb03b726541ff9daea2a9bae86921e841587ea0f9180855f06b5a9594659ee58cb925facabc58ceaf1c91371d5945cf8a9c0881c189f12d3d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8b689f52a9e0ac80173fef4cda1f691d

SHA1
d97a00583ceb5aa39c5dc25e5f55e4329774d6fe

SHA256
b0fbc1191b121503afe4253b6ce6e1dabb0df4288a77bee721dc56a95b7e8dbc

SHA512
5fafaa7f367e05bbe5ae1d2d13b4c64ca54054a1a94cd74987dfd031b0839ee9052e30f6652ce8704ce474678fee8f07cde75ee6e06e1a212d824448f3519fe7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1d048b179d0efc54ad2825b637b9179e

SHA1
d646c9c0875226417140caef9b3e8d9942c546bb

SHA256
0d80bd87ea6c4b981c06150a36c6adc0b70b8e5a7e935a636d967a240d0a132c

SHA512
48fc99c9eae7efb93c8bd7cd5711dfc4438b902bb62b09222b544987eed2c0f6351f3546541bc8db9716abccb0c4572dcbf256038a54a93e5eab9c33d62e042e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
e507fc174e61f19b983b27824105332d

SHA1
7ea8617e5ebfdde581901e8f81698230af2e5065

SHA256
d4e1f07c0e1230501818f1a2607e8fda42e42d50cbd46eacd4d51b201753b2ad

SHA512
d523924d3df70d658c67b236741dd7bee2bfe09f1899e979a3bf7491f373b3758df7b940fc29ca6172e4f128fe2803a64f7830ddc64f9132e84a1bac13f35436

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
2b02bc93ee8ebc17f7367f8e27651ef5

SHA1
d05e7cd3b60b80ede9ac07dc29878a5a782adbeb

SHA256
760eaf8bd772b1eaf977716c8671fa7f76ce915ebb90fefc745ccc9681c9e987

SHA512
98bde5b57294bbbfdf08e276ae3fd1a3b93d5257c94dff93dfeb24b9b1aad6eaa3f4d8e14b8bd7e893703724a23a5197222267f16f70116be32acc64cd7a6239

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e5b3931fa340189d27d2e4f763f27db5

SHA1
a07e2bfc8b9e1aa34df3983b7fdd462dc1418899

SHA256
4ff164bf8b31135fd452aaaf02b0228618285fa5bb7880a6ebbe3cf8caee61b8

SHA512
6b4a2eeabb551ec66967c83ce3d4af89796e985ed543e287b2e8f006aaf43b7cb09c870befac2ef223e8967eb798c23d4a83e8b8ede1785bf3cb3a74331544c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
9cac2d4184d411483285d836c5fb949e

SHA1
7be574d077f477c1e7a46dab903a2b222f5c8516

SHA256
227cf49720e450a47ac217fa2207fadc7c8ba66d80011e9f8708aca1fbb097fd

SHA512
d9665cb6a624a47de5cb1b47792249c810cd76cae5ed1e31fcdfa5589fbf377444f31b1b9b9fef4acd0d0ce2b8eb5a09e3df9f2a8d0ebbccd3d783a22fe2085a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
195KB

MD5
54388520eac3f1b072bcb31ad7622363

SHA1
a39755c14f76c51cdd777eb25cd76c7aacfce926

SHA256
d4b6a21cccee8fc0408c63b9a9054035ef184528cbf80b92dc226d97b7d2af93

SHA512
6f1a9b884c7bb1ec8a8fe0a3fd57fc156f7cc1a61750d0bf6a27505ab5f2c6d095e82624963eb61234851e3683b981f463248c7f0884cb451c6a3ccd3da7a4a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
195KB

MD5
a759aab78be7e397e329f6e89051961e

SHA1
5bf13b4569dad1abac1f7f9746929a1a8b007d6e

SHA256
4fa542910209c0d376ce1faeb7bced2d031e305d86a79f82dc8a93e7f8f9fc90

SHA512
845bf05af2be6500bd3ec3237471eb533b00f9632a0ef1a5083c5640e557699929e829912bf12957fa28b015cbcc69d3c83172253c5a93d0bb3584e98983f556

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-60GGM.tmp\ISSkinU.dll

Filesize
385KB

MD5
7d9087c4e2f9ab2db78a46ab52a7f360

SHA1
15624c6e5ae4b2689a6975a8faf9f0efbd940b7d

SHA256
ff1374abd93690f5e6e591bae23b49aacc8bbe8b7b05b539ec8aee755070a0e3

SHA512
70375fe15072531de481a0ff95473fa152178d2fd5f0610712cd4fd63ed9da9a40c669442021c23937465ee1e81c39e38332444f10463b5a4fda2048ec4f1d5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-60GGM.tmp\cs.png

Filesize
10KB

MD5
841ed556044bda914a5b32cd7b0f6b52

SHA1
a6a9864530abadcb70631e00613173dcd2daf1c8

SHA256
8084cf13740debcea08ec69e5d396b9927844b0cbd1ebd074d7a4cdec09103bb

SHA512
438a33d90480fdcf1cb757529927b7601f4304e5406cfb995f3ded550e784e9751eefb3069bd891aa3c28a38a8e4798054797f43a72e619cacc8cc77317496ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-60GGM.tmp\isgsg.dll

Filesize
34KB

MD5
09974eaff6defadde38b1328754dbe09

SHA1
001cfb5514444188e455b97acc369f037079ca9d

SHA256
9eeef28d82fc4db7d1269dfbc0ea282768ce5e2e4e4bdc867d80d6847468dca7

SHA512
da29b01ebebb454c004420c6b29bb8dca9fb50554a7a5db30035a5ec458d766049bf5502f708bf7eb210a4f9cbdb308cc0c8dcdad9f745b01a9e4f1455bbc846

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-60GGM.tmp\steam.cjstyles

Filesize
413KB

MD5
6f6c35b7edf1d7f6fde264a828cc17df

SHA1
6a613d881a995801ad156d0f0901c2fa617e1d70

SHA256
bd371be89f5997694a224e8ff7121f0f6aa8893f31ab5bee7b6a3c32fb31d96a

SHA512
ce42315cce4d64d1fb8d5897b722c275ab46f36af93c3ca7db898cf508096c525f70d38ac2181960818dfe8b323d6ccd4a55d47f65eb0f8955a2b133ec2e3b5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-8R0TG.tmp\CS1.6_Original.tmp

Filesize
2.9MB

MD5
e34744ade12ee14d0e746514dcafe2a2

SHA1
3363623983bee6fae63161a82fd938075a5a8cf0

SHA256
9f1eee0cc98a0a62d0fa44d525e962de85e9e6046228ae2f41210d30dfe1a879

SHA512
7e8b939acf87816ce4000e6bab07145b092a554a66b1508e3c981ca0c9fda1833aca917a16a99fb30cf1e8fa07a019fceba6a5b07a7501c4359980e7a2a00776

Download Submit
C:\Users\Admin\Downloads\CS1.6_Original.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
C:\games\CS 1.6 Original\FileSystem_Proxy.dll

Filesize
364KB

MD5
0cbc49a2789a1da481f23628ca74af61

SHA1
b107a306f16bdca7354215790f40a10bdb35f321

SHA256
0c724825eea16941d52783c291153281d01c1e4330a751539daf3e6552af8627

SHA512
3cadd12e0bc1968556498a6a76454246f1e97a055223312863c663a880d4d5f1a2112aabc02c49f43b009a72ffc500c1c6efb28b21a879035be898247c1621dc

Download Submit
C:\games\CS 1.6 Original\SDL2.dll

Filesize
637KB

MD5
3b18fa46189823696366b2a9e2e05dbe

SHA1
89284a12cfd75966a4a247debf6fbf8ba93b13e7

SHA256
f1be4b46ac46bc9a26ae017c95711e5aedc11ed602908b62eface4e8d2b28aba

SHA512
dc3fdd8087c0bfede7ca64515df586156bcd3c901ea2b683d45c39bff90c00fafa42a06818c5fc1433e5e8d2d909236b3823bc12e493722d153d0896c7910c98

Download Submit
C:\games\CS 1.6 Original\crashes\settings.dat

Filesize
40B

MD5
31840a3b3691c3ccf3c50c2c7b6af5f7

SHA1
eea72b2a3f33da99d017334e75850f42aafc7ac7

SHA256
d132a3e5126be183fa2934ca7ac348adc917280da38d9100f18589185f1d8082

SHA512
348c19e24a30545ad697790abdf7b5f5f4f621bae310b55f05da404045aa774f518e0a72a5b8ad04e9b8d535d9cf003cbd80f3aec938ed8f14155ccbb2cba567

Download Submit
C:\games\CS 1.6 Original\crashpad_handler.exe

Filesize
556KB

MD5
5cdf1093b0a9706988f9393ebabe340d

SHA1
79a42713b4cf324918c183c0761b94c66500b744

SHA256
14a88ce287c5b506a90ee989cae2cb6390b51af2f268bd0c0d58c925718993e0

SHA512
463dba2bf8e0bf274b921efe92c432680eaf6368e812c589389f8078856daead9dba42668665aba9261e9978c521eebe34945a9d6ed0098a190e143fdd3e6a81

Download Submit
C:\games\CS 1.6 Original\cstrike.exe

Filesize
3.5MB

MD5
8436ce2b6aa63057809cea7af03146e1

SHA1
3c2583a4a032cd2f3477cf03b9ab494d45ac7557

SHA256
ffc06923e73ec11708ececfc8723b6be211fd8888ea5296650a049db4ce6fdf7

SHA512
6bd3e6e07b70fa02d579a958ac7525af24a93ab810bd84c6dd7ad26dc06f990ff8b5630634de07f4a38c1eea4e8e3589c6b47a062ce369381a16d7b107047654

Download Submit
C:\games\CS 1.6 Original\cstrike\cl_dlls\GameUI.dll

Filesize
1.7MB

MD5
205473be5f454d6efadda7beb167230a

SHA1
f899a07a738e22ac59a94f7e27fc1f186e0f0cb5

SHA256
0b3fe70558686cf462a705c2722c1b6b8afbec141cb90a6c89130a0dc929718d

SHA512
6e7e15c91b6a4474a4b385bc31a5575bb6a05124e8cc5ce887d619c0a68ebb986a2b05e7fe90ff991632f2334797aba6798930f95707040122fe8d37bf326b8f

Download Submit
C:\games\CS 1.6 Original\cstrike\cl_dlls\client_mini.dll

Filesize
285KB

MD5
f5334b699d08702934001a9a44396797

SHA1
88be6756cd2edec74ec597be463ea496135608a4

SHA256
283e83ebccca6d9f28ff127acf5501caf881258ebf7059e64c0a487aafccdff8

SHA512
f37c9d631757645103d0a7f857b611451406998b73f320ff755ebeb27190921a93c845a441b1e3480a88a5472f6ade4b70ae4ecf0004b60a192ff631f2afeb77

Download Submit
C:\games\CS 1.6 Original\cstrike\dlls\mp.dll

Filesize
1.6MB

MD5
3feb01cd9637868527d3085eaa80ede1

SHA1
388d1a73bec9b07c9ed7b0372b4c3a00b41061af

SHA256
5596780734fa40dd709537b26b9a0bf4cf970c150fcc03108ed5432b65e3c331

SHA512
e6401748c00c770d2b416d69c1c93fe2fb2a96cca3194bb3c838383810f12c895836bb48f3bb8c07262e53852a224cf618d3008bd5d4e20defafe86404d53bcb

Download Submit
C:\games\CS 1.6 Original\cstrike\events\is-FHSUS.tmp

Filesize
11B

MD5
e41aa21f57500b1b71802b76fcaaecd1

SHA1
554eaebf267f8aaceb4e9b18e28dfa5131168a09

SHA256
2092e6c9862b42fe817a552f0ecf05a58a2609b2424402404a796c325bdf2098

SHA512
4c2b2e183bb68c16b383532aa03d5dbaebebde35b843ff442b84f6c9dba655868e7e7ba76b5b92d003db1ac73ebdd2aed5933595b35d073c702b1e841d94269d

Download Submit
C:\games\CS 1.6 Original\cstrike\events\is-SHMLN.tmp

Filesize
9B

MD5
d14f11b47b92d829b6ec4912ca7349e8

SHA1
86b8dd77a055a3d1d154022492ed7d7e4ca371a5

SHA256
89a0f0c5f04ea6da99b4a48fb642b968d32350aa3e6697da24d2736b7bb195d0

SHA512
f19f860c86297921b972338dd0ee73241b3b822d1b9d977cee39e45891f1d57bf144cd676eb2e7e35985969613dff0896473dd8e89ad07c66e79ac94510fb5d7

Download Submit
C:\games\CS 1.6 Original\cstrike\gfx\env\is-TVNCA.tmp

Filesize
192KB

MD5
9eda1bf021904ceaf1a8c50a76741eb5

SHA1
38f004101eb47ed0dffff757488263d9a2523bbf

SHA256
cdf4b2c96b5d1366fecdfa2aa764fcfc8d084bc5a682e2a10c41a03ed3ed3661

SHA512
aead546626ef7dc5a75348760b26f8e187a61b62c7a0a49bda16cf68b280749dfbc87974d05201dcefe6b4fd89401c3537b4f179f3ac5bda161066ae3ca0efbf

Download Submit
C:\games\CS 1.6 Original\cstrike\gfx\shell\kb_act.lst

Filesize
2KB

MD5
2f86bc708e58183501517717bbe74e42

SHA1
72a796888c722d658af0de3583bc96dfe6f31133

SHA256
00e511669138c658b1e4a5eae452163a585170888e7fd8f6c52c0e1c2a657b61

SHA512
701e655ce16141d3a0622836dcf43c8539f7f2abd8b93cf8ba06b76cb937daba352be4b410b0163557e57b279efdb9b453f648e5c2cb1bf18fee9c6859485875

Download Submit
C:\games\CS 1.6 Original\cstrike\gfx\shell\kb_def.lst

Filesize
1KB

MD5
c50eab5a02deca5de85f2a2b33760d6c

SHA1
4a8bd6756c452a424759ca0ad21016e2a25e81c1

SHA256
fb6ac56e2bf7058a05b8c8ead5287849634b9aad0c666dbede94b2a970e23b0f

SHA512
ac069447a2637510c7f0e2b7a63d9f47b2400fb20a4348f3c3b08baaa51fb01429df81ebc86c7cd4c9eac961748085180dab3d036fa095b9afdbefcc2613bcbb

Download Submit
C:\games\CS 1.6 Original\cstrike\gfx\vgui2\800corner1.tga

Filesize
300B

MD5
bfbf7639948b5d31128b60a303392fe4

SHA1
130b966097cd663cf986b295916db4219cadd9c2

SHA256
d37309b4647ec4158edb16839dfc5ec9200176511343776ffc1dbb8d1ba0fd60

SHA512
91b0b4c7400c6b6fbad300ef5d96d198038312c05d05e14213d90d770d3bd0225badc28b8b8adc6974be7236ddaf36090f6aaa38d9d49c5956e2239754b93ad9

Download Submit
C:\games\CS 1.6 Original\cstrike\gfx\vgui2\800corner2.tga

Filesize
274B

MD5
548b2c3f285bc4d5d974bb7bd3972480

SHA1
d6096aaf37b4c6385e906b1dc1239aa28f7c90a0

SHA256
9f31778118ba392fa28730bd5431f8e026a082bc15dc1e2e1232baecabf8a1e6

SHA512
94da6e65ef0fa2474ba02176b5ff016843806776726e1edd9682244b4e8f36e74cef939aa84acab345754bd7cf2bbe427896472d9c166eb4e72b179f78fe40ed

Download Submit
C:\games\CS 1.6 Original\cstrike\gfx\vgui2\800corner3.tga

Filesize
274B

MD5
9c727c93f0226a08231d95b917444dbd

SHA1
ebda93b631967c38f02a737c164d3c9d9a280786

SHA256
9c2c6f5f9c9f42275bfdc50b6d9de07b55a1dc2903cdf022c221465b34dce130

SHA512
32946a6d1eb9af111a0bd585203606fc0c1c088c52675370789fd044ce9b73f399d7dadfe5e53a1d3229a7c62e6d5f73e5613710f521c90ba8b976060213d778

Download Submit
C:\games\CS 1.6 Original\cstrike\gfx\vgui2\800corner4.tga

Filesize
274B

MD5
a59468e3385c2cadf6e5e5ad69b2d8ab

SHA1
f98418f226db0c11f9ccfbf97b3f220e5e2cf449

SHA256
3e8d903cfd7101a41dca523ee3fe3507473ee22d25fb319f0feee4a1bcc56955

SHA512
13c993766a48e60296974bc411fec3f63fcfe6c4a90e410a480fa3aa71193cad5ff00d0196c9c86cf08c9248679474d06eb6325961aab5f5feb7a53ba7202f69

Download Submit
C:\games\CS 1.6 Original\cstrike\gfx\vgui2\800cornerborder1.tga

Filesize
300B

MD5
a1d152b0256dba27a1a92487c11f4048

SHA1
8338f92abe99815f667ce3f284a411b3999b39e9

SHA256
74199a4cc3847a127b44e23a38688cba53174238adb008b1026b389a7b24efc4

SHA512
e98bdeda478e6ee9c86b7728f4d54c2213201f52eaa59f7a2962195e40b92b32b1f7fb29b97532f9e10b260d0fc51e140200ebb95c5a6762826ffd821f1256cd

Download Submit
C:\games\CS 1.6 Original\cstrike\gfx\vgui2\800cornerborder2.tga

Filesize
300B

MD5
4e5848a061ffbbd58ca2612ce9201cc8

SHA1
e74eb50d8aad6605b5f355e0f37dfd82a5a9cdff

SHA256
4bad83b300cb3bfcc5513d61d3f7baf63244bfac276bc30d88cb985e4c21120a

SHA512
53b767cc12636262d6529d958aa42eaa26d739515af0f4552f07cec219bff02aa5f007d6388177a63ddb467c142a584cc20cca119a0b245ac0aec056168e8948

Download Submit
C:\games\CS 1.6 Original\cstrike\gfx\vgui2\800cornerborder3.tga

Filesize
300B

MD5
957f2bb2902e1c08a0be2ac901ba876c

SHA1
43df385cb7a2292dec6faacca0e05cee1e40201d

SHA256
3d856261e79adc4fd0fe85390a349d9601edbfc39447e816e92baab6ca82828e

SHA512
2482f1a785d374a0b5f869da05180efa04519efa1a74194fc7fc57a75439600c2603aa7ba3f9fe7fcac3cec83b93675570015f0d854b044c45198b515eb16b38

Download Submit
C:\games\CS 1.6 Original\cstrike\gfx\vgui2\800cornerborder4.tga

Filesize
300B

MD5
209ce7e0561313134d0060ec33bd1ebe

SHA1
41ab6e2ddd7963d5068fc828b8a2394483664edd

SHA256
9563a26d056cb575c28ae922fdca747dc9e1dce8f9f1b294e500952c83eace21

SHA512
33f50c781dee8bd4f34047b09ee3fdebf0abc1728a0ec41214eda31652d2fdca65b20b79943309c2f2853451a9ebfb250cb94fe6546249d68794002711bc20ce

Download Submit
C:\games\CS 1.6 Original\cstrike\gfx\vgui2\800cornerborder_half1.tga

Filesize
300B

MD5
2fe28d8dbf63db0ed04b4184d3efefb3

SHA1
c568e2e98c75db52011aac749d1ed10111b28358

SHA256
0d06761a57bb60b8046bc126fdf1dc38f42aca6607044b227031208c37888c1d

SHA512
19ab411aad1466eb8a4fa51f2ecea16abc9027caa609bb75bd5f73bb5846fab610db850510419cf34a86f8d1eb8ead17180d30a39de679c1a6e519c945b7a692

Download Submit
C:\games\CS 1.6 Original\cstrike\gfx\vgui2\800cornerborder_half2.tga

Filesize
300B

MD5
2676a726e48ff0655b388ff6f2587272

SHA1
e5729104111d8ecf7f511bdb8311568c2189f0d3

SHA256
462daaef5a1e858a1890dc6d2f07e03f24ebbb90a8274faba6e848d8188298a0

SHA512
7b8ace51c718f02d995f098e54d0123f364ebfc10016f1f81df05688cf1d03514454f998b324410902c8e89e5c2481fa6a7ec8763700ced9aa7c7c05f0cf236e

Download Submit
C:\games\CS 1.6 Original\cstrike\gfx\vgui2\800cornerborder_half3.tga

Filesize
300B

MD5
6d9b97ea1d050abbf0baa99aa04e20c9

SHA1
cc87a1bc20c27a2fea52eb206bcd064b3fe0b141

SHA256
156191fef40e925a0e618bd603e4068459bce1a01e2a398a8d10e720a043a0f5

SHA512
ac2f6087be6bda805b376179734ed4627a76d80094357b694c57831bb7a7d643f396b335a71c3c6156815b130c6cd6844312dfe62014487eace0bba2db50d70e

Download Submit
C:\games\CS 1.6 Original\cstrike\gfx\vgui2\800cornerborder_half4.tga

Filesize
300B

MD5
dbb5479299d0623c5fcbefb6b02ec7d0

SHA1
851a5af1cf3a1360d145c66279531063b308fc7d

SHA256
8200381d6b5ccab783b7cba5fde84d6a40cbbd813e43fa5c2d7beb4588ede95e

SHA512
d737d423f9b78bb4403bd989f363762f6e0f2d5c5425bd7f5bb556b8cb5690a3f79c6c99787cc456a3c8f2a4705ef0233937ed03abc594de6e93754ef7728fe1

Download Submit
C:\games\CS 1.6 Original\cstrike\gfx\vgui\is-0UHCN.tmp

Filesize
128KB

MD5
8c3ff438e747a73255ddb8c3ccbebbc2

SHA1
e81ddb67229feefece8cc5ff4d1b12c4b75cc103

SHA256
4a2460747b60d4b5843bf22a459f6c17f16a9664305b4b4bda182041a0fdebfa

SHA512
869270e4c6adbe4e914c07bc459a7858c50988ede0e75a02ce51a18080f9ba4bc4c483c4ee646e22fed948dafe388e7b908f58b09528b93eb1a87ef57a278b62

Download Submit
C:\games\CS 1.6 Original\cstrike\gfx\vgui\is-6VIR5.tmp

Filesize
128KB

MD5
13b3a5cf4af8f97cd8a8328ef9952b7f

SHA1
253105b008a8ce333a64f5a66e4b2da0e3a3cb52

SHA256
9d8e087dd823e63f7009907ff1761e620dc5ee64db6a527e2d0ec830d4152437

SHA512
77f76cb9bb4edadecce9bfcd05031e1def1f4b967b58d8078bb9e6c3b03e3db9917bd2a77314553fb8ee233981683e9b0bad5af30c094344350ad2a1dd034667

Download Submit
C:\games\CS 1.6 Original\cstrike\gfx\vgui\is-TL022.tmp

Filesize
128KB

MD5
1f10813901e2bd255a5ae21026de8b48

SHA1
03a1f78e07952f1876dd431ba4406b534435b920

SHA256
348584b23c63388045342dc0b79bdd37a8cff904a84215c386492e33273ab725

SHA512
b3fa7d1c675c4ae53ebc506d39234e166392bf6a0f6fa651b4c1a19240915f2423c9b150ccbe429159cebc0fa92135a9940cbfc8c79fa9fa3b353580f93342be

Download Submit
C:\games\CS 1.6 Original\cstrike\resource\MultiplayerAdvancedDialog.res

Filesize
7KB

MD5
41234b522bdd45f31cb315a87120249c

SHA1
8ef045e99baa7ff7c5d079fa10a9d1bb64451706

SHA256
4f70026b60272a3c5e911c5d5ec8e2762639fa1914b8a331e9c5473a0ba0928f

SHA512
d5d825768b8af330f4ff79e1e7c134b13b741d61bac0da2021b17b2fcc5230dc1aa111fd92f2fecde85055ab13583748d3e4aa2dc1acc76cf87dee604c2db0cb

Download Submit
C:\games\CS 1.6 Original\cstrike\resource\OptionsSubMiscellaneous.res

Filesize
4KB

MD5
c94d74834945151911831130dfafe4a1

SHA1
51ba5452da4ddc8e4d977e9105cde69eccec55c1

SHA256
af86c9afe114d269d046f3dc95817a67f94e616131a0c5eb8462dce03ed2a857

SHA512
9b062bb28f26b03f744273a7c1e7da9b873fc18a775b52aa5d312a19f5f17ea321cb622e1714455e377d2e2aec362bc87fdfeb2a9d1405e40bd9e5e69e15cb2a

Download Submit
C:\games\CS 1.6 Original\cstrike\resource\OptionsSubMultiplayer.res

Filesize
16KB

MD5
16d185363d8eca66349c32ffe0e6cd28

SHA1
b36d2e7f090631b828c0b01bab27cb7de8a49253

SHA256
f73c534c22e2a4587529789a42f8fd74e7f8e7c83f700dfaeab80a0ecec9d6cd

SHA512
53c0bfa0e2d4077f4594029f105f1d10a3c2e2f1c8613baedbf13156273cf5e24eb90d10aa321a31076bdee705b03b3d1c8ffcfb6a1113c93f8ad8b84441cecd

Download Submit
C:\games\CS 1.6 Original\cstrike\resource\OptionsSubVideo.res

Filesize
9KB

MD5
b449d044eb8ff187e73b92621a73faa6

SHA1
56b5544620c321ccb46c4f9a3cda8ffe2ad1dcb3

SHA256
1eceb72d3fce8851846404e5e10362d15361ce0fbb43d16084e560447d30668e

SHA512
d408ca55d96f79800fd1a4f8be30464ec921f375005612486748f1757bfdd1c5a950cb8b2af5681dd9b49935922b5bc56a28bc5ac5e94f73ed26714fb71d2dd1

Download Submit
C:\games\CS 1.6 Original\cstrike\resource\TrackerScheme.res

Filesize
18KB

MD5
b52d1d1a10f600c88d928ef0952e4753

SHA1
f126add4450718dd07396317d15f6b9b3622614b

SHA256
e2b420aed995b86da8ba8ec46382d0420d8f83203b95e24b7072d87ba6aab174

SHA512
2e010a61a3846a9f03311554e44afd4b1b75c4e9093b2ed6f7cc9c5de789eff3b36829cdfce33c5f41e2b44d4b7d6885351bff288c47a305f7ebd1a3f889dc3f

Download Submit
C:\games\CS 1.6 Original\cstrike\resource\VideoAvancedDialog.res

Filesize
7KB

MD5
91fcef1b04a4142c3b0d68bb53488775

SHA1
706769e46bf26ba62e7747a6532a597a123a9ca1

SHA256
615bf754838f226391e4feb77b273ee799401ffcc82648a47f394ffa0097a06d

SHA512
b5de93521610980bc82dbf1f261ba580b1853cada989cbac814c1915911aae5ab5f0c8bd770ac38cb8100d3ab869bd42c064eeba65c8f479c299a86ff655471b

Download Submit
C:\games\CS 1.6 Original\cstrike\resource\cstrike_english.txt

Filesize
175KB

MD5
3f2917785dfbf66ad7a321a51d178646

SHA1
c797882dde783bcd8cd8e68e06ab53e0313074aa

SHA256
95fff935c5e5d6f86657dada32118cbcce6603ebf42ad4d043af621197801a54

SHA512
a72065ada5706e567c38c3807c24f502a641f73e90a3adeae240e86b05048d09de779bdf4efc240de5a4bd88cb5a1c214bc878a0f7f2d964e0d83658964be3cd

Download Submit
C:\games\CS 1.6 Original\cstrike\resource\cstrike_russian.txt

Filesize
185KB

MD5
6b3764b84d4110e5c9a000a330099971

SHA1
130231a7e193cfc5e729c7b3fdc987104aa91ee5

SHA256
6297663a0fd1c0556634d65d6e6c0a3c1454d1f0cb9077a096c493f4b8728623

SHA512
59c8c9e28812bea7d6cd3d0127e39e43e76f0c2047f7dada9fc946b1ee77d4670053f6508d6d37d6f9f0e717e05d72d2b8a9aa1ac9b2ab80b00e0b2b60c76ffe

Download Submit
C:\games\CS 1.6 Original\cstrike\resource\schemes\TrackerScheme_ClassicPlus.res

Filesize
18KB

MD5
1e9a7e3c48777fee061e398b42d69b81

SHA1
43b8d3a40cde27857f48554ad6a66b496c00a856

SHA256
f0fc2a0d9bfa098bea725a1401176fd5717684b90136269878004f207a17f4da

SHA512
d6849e795ce125da7ce585d0f27052785f73fea0550bc11b135423826c91147a578bd3c5e496d0fdd2812637fe8597a6e7408672d7719e42f90838b30c18e26c

Download Submit
C:\games\CS 1.6 Original\cstrike\resource\schemes\TrackerScheme_Source.res

Filesize
18KB

MD5
8d31d7ba684b6fe0442ce8b5e5853bef

SHA1
e1efd37a3406b2a074d2bec9133586a9cb837356

SHA256
c33d9268ad5e34c06709dc68a1c81e1e6136d7b3c05d8a7f9d8bc88619bac1ca

SHA512
d36d7399456b79ba8308487176306f29f227a2d5439358154e9681c6dc97e475061fd64356c3c1eee69e8fce25151eb100b10b6e865d2f1e2dfa81d460f0e9b8

Download Submit
C:\games\CS 1.6 Original\cstrike\sound\weapons\is-1491S.tmp

Filesize
10KB

MD5
7e7c4656f8ef80a72ef0d1e41317f511

SHA1
775a6ec4f092b3e8bcb59c21787ef33e9237ae48

SHA256
ffdaf0a862ce1f47615dc1ac59af868010796eeef50de895414c40a04da3680e

SHA512
a257ce57532a8497f8df5860ae08729c78f90477f0b96264f2f98dc31ee034ec2679ace4ddf1ed4ad14ba08170354fa00e984e2dae4a17491fb5f8b7e009391b

Download Submit
C:\games\CS 1.6 Original\cstrike\sound\weapons\is-4TJV1.tmp

Filesize
7KB

MD5
3d352efef15d6f7019168991cff7cf32

SHA1
10030aa93a41d80b35d39e59dda86e4c164f1a5f

SHA256
616e07c58c0d3d332c3c7fe65c1b7e6ef49d5c26d09d8132d1e7c36c3899ea46

SHA512
bc51565450631d2954c0736c7899aa7111aa1584b0cd20ad239a765662d5935aec7fc7b33f3fcb2d43e5a69b1a9c9728a63a5a82134ee4dce7740cfa22e9480f

Download Submit
C:\games\CS 1.6 Original\cstrike\sound\weapons\is-6PRSC.tmp

Filesize
14KB

MD5
2876bbba2adae9cf3456ea95a2c0b546

SHA1
737a3eff26b380e189ada33a028f63d75b8f0e8a

SHA256
2ebbea31183105b5d305027e960bb89dc2e2582b81ba712b01b1851501b6092d

SHA512
5423d77697905521a1718b2209a7e29fc34c94f481bf093f2ea45c3c43eb9dfce38fc8c87802c221a1813c582b626fd84446540178cba918d8e021d1b4b5dcfb

Download Submit
C:\games\CS 1.6 Original\cstrike\sprites\is-J5663.tmp

Filesize
361KB

MD5
324aa00f639ff5f9cef8797a1f862ceb

SHA1
38d8564d31e700625ef0ce35cb681f5a6a34e070

SHA256
aae249f31605fdf3773d0753764dd4865873dca48a58108579923af755122fe5

SHA512
d37195b2033c064cf1396e02f9e01f63399196c4de290b0630cb252bc54f9685be98431d0df3ab3c8239b9a585373ae21c224d04d713e20e2b4d21b1720ef34b

Download Submit
C:\games\CS 1.6 Original\cstrike\sprites\kill_rarity.spr

Filesize
18KB

MD5
2eb849c27c65e187215f189700014a3d

SHA1
13eae803e06cb09fd6f5fe38705ee716a4a47763

SHA256
0f875edde646b93f6789e64dbeef95fc5f79f716e7b682f1ad10d860e9c28559

SHA512
80c276aaf38249721d6ad337caefca2d4ad7aa6ded1292c58b91aedd2f9b8dc9b10fa6844b6e2373d1513bd8658a649e01c43ea52359809a3efa4b7cb1a8b9dd

Download Submit
C:\games\CS 1.6 Original\cstrike_hd\gfx\vgui\buy_presets\is-MD8O1.tmp

Filesize
128KB

MD5
3a0ee184782f3bab5f604dd55f5b011f

SHA1
af87160bf8b136da3243b89f4c8197614d6824b1

SHA256
60fe19c7f1e2929356c9d26987e2ebd9878456c0797db579e3e56d4501c0b05c

SHA512
e183fe6279e05aa539a43ce63cb06988ea6cc647671bbefb37e4d3d7c7a5f3e438079f18a55148d450a22ebb880e80a619779ac45208d0c5e1ef6a42b2c17fdf

Download Submit
C:\games\CS 1.6 Original\cstrike_hd\gfx\vgui\is-8MAM6.tmp

Filesize
64KB

MD5
ab95d42bb5bbabc27cfdb914dd354811

SHA1
19046a370c3abf6813b7473651134983eb135143

SHA256
c07530ca596e9a10496f5774fc6fe9253e392600c3cfe77a6567d355d3f54a0f

SHA512
74eebbbb1a2e6f1d22590596f42e5ade832453f1f72d5e0aaf38bec14692b257c424fad2ffd92748e336dddea63dc63b49a04b82f1db202a12fcf88072989332

Download Submit
C:\games\CS 1.6 Original\cstrike_hd\gfx\vgui\is-ESFJS.tmp

Filesize
128KB

MD5
4f8c877590d5d625b5fa252e6cd3101c

SHA1
2048a8b614270517a82aa826b557aaf32c18817f

SHA256
664264946b90b3ec23cf5e97c7096e60170e1a1c0a9b6bc4eb8c78633699af55

SHA512
4927aeb1098fa300dfc7a7237f5a8d3731e9b4356813d8ac1fb5e6c79b39232c6b68131088074742725283a5182b3fe8f285fdc59bddc673094c9246e1f0ab57

Download Submit
C:\games\CS 1.6 Original\next_engine_mini.dll

Filesize
952KB

MD5
42291287951999d2fef2d763cf708a06

SHA1
3f5dbaab6c515d2b8b1999c5ca3cc7b036054474

SHA256
3404d9ae9cbca42b1df7b19b818a34bcb712d640f88cb840aa9ace2e7cc82fdd

SHA512
f33420e75effcefaf407a9cb3e38e45c15648cce2ac972c13ddea802b22dddf12c247cb467940f58abe7cf4f96ec2b846c3314b5e2ea1607d5d6ea3ea5cd3e75

Download Submit
C:\games\CS 1.6 Original\next_lib.dll

Filesize
9.9MB

MD5
7205c91a3ef88a85de5ca33cac03b575

SHA1
f155f7ef7f25e2a91708a735a48c211f30b64b1a

SHA256
668ca8a033dce72cd2f92023042ebd2f8e5f563c02f474bd572706a847e00342

SHA512
cd720438a7f3852340f624e863726f88f12c0215e7aa36f5a35d2d512b3dddfedf156ed8b1c71a81868da13e17dbdb0e905e01cd35dae0043d6f0bacd7991699

Download Submit
C:\games\CS 1.6 Original\nitro_api2.dll

Filesize
2.2MB

MD5
1a38c6b9569a5da87cc5bd9a1b49d359

SHA1
79a60c1f55071a4b39b0957ff9ffb7cf5f614102

SHA256
fc11dbe331d8be554a5556e35797ac6f193923cec50ca166935a5c25145b58e4

SHA512
cc173188503e027a21ab7be57fdad074564072efd052c9745cebceacd46d91acfdae087ba306161107043025006a5b309471ce74baf5fb20b69f381864875208

Download Submit
C:\games\CS 1.6 Original\partner.id

Filesize
9B

MD5
58d8f700a746d4c6874128a0a35261d1

SHA1
05a845681d30fd4df394db4c94e6e338b0320be5

SHA256
ac8aebecae4a33a77283368b901f67ab60806056f972c015f2a782a27f24a52b

SHA512
2ead7b5fae2bdc255111b90ac6ac1f68c639fa5fe10da0d930a91ab0b2cd3721028af7a945132172d8b13705e18d53f40231f4624713e59c7fd9513c66ca7f19

Download Submit
C:\games\CS 1.6 Original\platform\steam\steam_api.dll

Filesize
101KB

MD5
cc3d1ca6401e2ab106733c7bd7489cad

SHA1
8bc0e66551efe9e6116b6bd21f57c500005686c3

SHA256
8c073e0d2ca39d1e986bec348f988303357be5c495ccf6e0415802b86eae3534

SHA512
d5eb4839ecff6e3d88610c285d02fdd05bff4f3ac9d4494bcf99a24c912545baa4f957171c48b6a5ee24c508ab4b29b870f6f87e8603ea81a3a811cd8ce06ec0

Download Submit
C:\games\CS 1.6 Original\steam_api.dll

Filesize
87KB

MD5
562d1a82e7ccd5da38efb9aa6e2bb8f7

SHA1
7c3ca4fd44ffcc4b94d16c2bde08d5f1c3eca262

SHA256
5934c91f273b1bee578e75553dcdea277a0ecf565aaf5117eaf90fcaa7cf5f0d

SHA512
b3c8900a8081479755379591da5036f3a6592781498749baf849959436241e442698d312cea270410b3e9e454d710e10e539f30a7bb5d7b8043262f83d0c256c

Download Submit
C:\games\CS 1.6 Original\tier0.dll

Filesize
331KB

MD5
fbfeb5dae01b4b2456cd1ebabbed4922

SHA1
1960f93db4f23c3012855e389e30005910592c61

SHA256
55e64559ba6acc4c0efc3bef92382714a6b9b8a4bd4696e8c920e709c803b250

SHA512
03148956ec8254a6d41ab970f9215e3bc3a302c8f578078b3441aa1b12ebc3b59e7dcc9c4dcb1e7335d7087acff1d8b09a824e96d07c7aa69db23b24fddae8dc

Download Submit
C:\games\CS 1.6 Original\user_game_config.ini

Filesize
94B

MD5
95b9629418e61ec15af9fec12581a82a

SHA1
3ad5726cf0265f4079a3b16b5a15c5945d308afc

SHA256
0082d931e6cdb83e711e60f94e4677d0003537d8f75c64d2f8d3a7535f58973e

SHA512
82851157941c8c396797a0b922a8d5b6b2782e1b27b8e20d8694d604f692a13a9ab38a7ae1e26832f2a18cb6c1007e55abcc995ce778f7257753b125c8ad5484

Download Submit
C:\games\CS 1.6 Original\valve\events\is-8NAGU.tmp

Filesize
1KB

MD5
8cfcc0a84d0b6b51995ce17bc9f194f2

SHA1
f86d5edad7e5a3e2d994517da5ebd7d748a8c666

SHA256
2c7d43b8dc6ea01a32acddb7798b9dabf0ec44c7a6dcf75160539a7fe53e029d

SHA512
5f75243ff3e13b557859d89593432f5e29f014f2bc527bee363be3369e884feccb15ee593094c7eb0f8e4786b6a352cdf9fc6039636782cd23712cadc114ee1b

Download Submit
C:\games\CS 1.6 Original\valve\gfx\vgui\fonts\is-0NVS9.tmp

Filesize
45KB

MD5
d3d6c70dd23590745a0f691c28f88848

SHA1
b46b4a8427c59e590f8adace2ab659da2f4f4e9d

SHA256
f472485bdddb0f7acdce7ba6dfb1520dfdab6b2e870b37f77f61714533c5fe79

SHA512
06a400b5462c9a307bb281cf725358a8bc64a27e34b5f6b95748d3006703e66c4a756ad86fc5e2de9c2a2eba534921234fc2ec422b6107ef7264f7344a258a92

Download Submit
C:\games\CS 1.6 Original\valve\gfx\vgui\fonts\is-1ORHS.tmp

Filesize
24KB

MD5
07306c3fa68e4b5bb4fd4da515adfdc1

SHA1
ae0203c50a3ef107992d61f4b135efd6fdc809ba

SHA256
fad8e72511e03ea0b215e491da1ada731d7474a03d43c26a2f858c8fcee9beac

SHA512
d6d1b8f13d9263932f8757fed790dcbcdca681ca51a7581ca552631409b8c65de212436f8e161c60463edf8589067118d15537789e8aead85eeb156af5c29a7a

Download Submit
C:\games\CS 1.6 Original\valve\gfx\vgui\fonts\is-FSS2L.tmp

Filesize
33KB

MD5
bca82506d597eed9b5507ff7ba16567b

SHA1
55ad94cc92b95ce8e2adf62df94a6a8244980e8f

SHA256
4eb392f4136f1a4b255ab26772947e62b80615ca8b1ccea93563c3f33539a8bd

SHA512
e817036968d39d3f86c2f6f241c6f80756bf139a700adf018feb870542331b230cad6369652eb2a26b26e94b14c3e27dc0112d3ccd1c512f73e8b056ddeb12fc

Download Submit
C:\games\CS 1.6 Original\valve\gfx\vgui\fonts\is-G148A.tmp

Filesize
24KB

MD5
ebc1b6a271bf99cdadc78dae5e9a29c4

SHA1
afddb10163d0cacf30f7a2e9f9e4f534c8425586

SHA256
3988ddbea3e6fd927933a698d28d66572d51e59938ea16624f644afe2021818d

SHA512
ccbc9f59f59c46187954d5e8a70513542471a40e8653f59c8d58279777c9c378f2e1891c4949d8d5b104117410e991f756d768932fd5353dfcbdca3c37d6ac1a

Download Submit
C:\games\CS 1.6 Original\valve\gfx\vgui\fonts\is-HE9O7.tmp

Filesize
44KB

MD5
ec8766ea06b999dab276c2ed85397067

SHA1
d043859519210810ab69bc4172406511b0391728

SHA256
dff807e488eee92c3f841de1f330bac00b42c36e34320e6335ed6e5d926243a8

SHA512
5b69d36450816306ba280d2690c65f7478b84a4b1d8eba37b8a4baf8631d767859599e1b20bcabb930dbb7ebbfd07d89bb3336c9999809c50e20fc0661cfb77c

Download Submit
C:\games\CS 1.6 Original\valve\gfx\vgui\fonts\is-LDNP2.tmp

Filesize
34KB

MD5
46f3cc3d5ca0f0e80d30ec38a3ed9702

SHA1
2b7902e73522c60bb4e5a6d7905f91967ec54b46

SHA256
824ad8824e4d05319556d9c08dd0d4c90fecd6150a0dbcae8c946740cb4e2c56

SHA512
9f85b11a9479af47963155fc823a9390794b3db05fb50011efaa87e1adcf772d18fdc1bd57f3ca556ded84d5fc5671236ee0705043771c83663612cd2b0f16d3

Download Submit
C:\games\CS 1.6 Original\valve\gfx\vgui\fonts\is-M750D.tmp

Filesize
27KB

MD5
8148e0f0a6679ced3ca04fd6c258d478

SHA1
9afc1daad5e004bb9481147ec5fac15693897f2c

SHA256
60946960e36a56fe17b02ab7c618e3ca0d61b7412acbb9967271ff309a76b5e0

SHA512
918c03891b46c645ff9b1a497a77bfee752befdbc2e82b882ca3d665dea21d3de1b112848ebb9b996b201c14bc14a70231838eece3df04a431becd0852417bed

Download Submit
C:\games\CS 1.6 Original\valve\gfx\vgui\fonts\is-SA3LU.tmp

Filesize
40KB

MD5
910e7f920f59348e20f787d9240fe2a7

SHA1
9f85998b0a73efbf34b2e732942a0caada57925d

SHA256
93eba9e5ba94654d73d76944cb9860e4fe8db92a6c734fcbc57864cb766caf1d

SHA512
a19fad5b08875df9f16993d48562cc2cb4bf5d918b5f102b0439c6d6d6fdb862783762d586393b0e0b6c324de3c38c27fbf09d4b48c55affd44aad2c1ee9726d

Download Submit
C:\games\CS 1.6 Original\valve\gfx\vgui\is-BKOT5.tmp

Filesize
1KB

MD5
1926ecbcf1b403f0c4a30426ea74276c

SHA1
24d8e0d5f3477f85e76985a0fc579e392482c402

SHA256
99986396ea8ebd9ab4eb1221b52db2a8a024e67c748e0b8080d8dad24e4e9cd2

SHA512
8e944a0304620fb7428acbe883049167c0bc1596d8f294b1ebcb383899e6881c5e54221ea5a60fa7c14210e5cfd91831a8481020608c22747f43c2f9d7e45060

Download Submit
C:\games\CS 1.6 Original\valve\gfx\vgui\is-VE24C.tmp

Filesize
2KB

MD5
6deae390d10e5faef07cb793138a4ea2

SHA1
0e1b89e5e5e61f5e8959d3d6e17fc874f3d14a8e

SHA256
1efacc8931f4e6558fc9f854527e25e004d8c3fd90f1f5209273236924a9241b

SHA512
70c1ab592e46440f759ffdaa2ba1bbb9206212670762fbdbeb04f85da2304120e0a052ea4164fc0e0326e82c013924d0db0ea27fc21041489fc6d6d69b69d93a

Download Submit
C:\games\CS 1.6 Original\valve\models\is-EA644.tmp

Filesize
3KB

MD5
ab9f1bf1f7d14ca0032df954e1dd5212

SHA1
d51ab73cb33e1737b86ea0bf6db28aa895bb86ab

SHA256
748e6fb4465843238519d56774643c2d4fb3f77131ba49ee9ca2d700c42acb70

SHA512
c5dcb61363551755beaa4732a21ec870c9b077a44eb0e810029f056a7c89b7be4d6e2d4e48b860a4eedc707d057ba55b2b45c238cf4a99ec167a1c07686710bb

Download Submit
C:\games\CS 1.6 Original\valve\models\is-RCPT3.tmp

Filesize
22KB

MD5
5f394d005ec12f63949d0c6a62c1b7b3

SHA1
957d1d0598c7bd0079db345db2006d8e4b755096

SHA256
47b5e88f5cc25627e8dc76b85eb6ad64d8613b00838d0cca6a85f118af81c7b0

SHA512
c51142a1e7902d720154378a7b8e01808fb4683e5a12c77516fa474b4eb05c0d2cc37aaf1b3b0a33757aecdc9ff8008333df66ed0e254b01cb5640b8646e6fb7

Download Submit
C:\games\CS 1.6 Original\valve\sound\fvox\is-DR243.tmp

Filesize
2KB

MD5
299c3e28a49757ecab2e84ca9b220e62

SHA1
850cbc182e7000b6caa8b6af9986161a2554dbce

SHA256
0ffbcdb3466691fbc1043c69abe50434df646f997c52856a509de43cae501eee

SHA512
2caa0f84686df85905b355107ce2d50c1b8b6debadc50d49327330855e3ed2cea05768c1394cec746ddf90f7087a08ff98eda51272f89d7450923a5e41a13bf8

Download Submit
C:\games\CS 1.6 Original\valve\sound\plats\is-KV05G.tmp

Filesize
1KB

MD5
811989e09124f54cb27fe6154b0f1018

SHA1
90c22fc3b248588e2d9759e6ef395303a86b7b60

SHA256
5271b9aa2961809f47fadecb693be2eebde2dbed62fbc4f5f4889fcd8c4a65f8

SHA512
560d26fdbec34ab687e40b8be6144b0f586449bd3a0eaf286ab972ad60b1eb1fe002649daacad36039a298ad24aae96e3531404ac2d0d7b0b47e194b8169e18b

Download Submit
C:\games\CS 1.6 Original\valve\sprites\is-H695I.tmp

Filesize
4KB

MD5
30c0c19f5c5226225ac3959dfe1f1428

SHA1
5c7be5173586da26dd730a790a151b8a16611106

SHA256
5603d52c5f089950f372e2b00845738746abebaa2796b0b3e2f6d8d2f4111760

SHA512
c71799d84798c2e2a82dbde7ffa5a2c8698eaac615e77d337de7dafc9239c4b59bc2794b2ccd5740d3e19957549257bcd468660d0696f09fdca37485150c233b

Download Submit
memory/3108-434-0x0000000075030000-0x0000000075057000-memory.dmp

Filesize
156KB

Download
memory/3108-572-0x0000000004800000-0x0000000004831000-memory.dmp

Filesize
196KB

Download
memory/3108-381-0x0000000075920000-0x000000007599C000-memory.dmp

Filesize
496KB

Download
memory/3108-388-0x0000000075920000-0x000000007599C000-memory.dmp

Filesize
496KB

Download
memory/3108-396-0x0000000075EE0000-0x0000000075F9F000-memory.dmp

Filesize
764KB

Download
memory/3108-379-0x0000000075920000-0x000000007599C000-memory.dmp

Filesize
496KB

Download
memory/3108-382-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/3108-383-0x0000000075920000-0x000000007599C000-memory.dmp

Filesize
496KB

Download
memory/3108-384-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/3108-385-0x0000000075920000-0x000000007599C000-memory.dmp

Filesize
496KB

Download
memory/3108-386-0x0000000077910000-0x0000000077935000-memory.dmp

Filesize
148KB

Download
memory/3108-387-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/3108-389-0x0000000077910000-0x0000000077935000-memory.dmp

Filesize
148KB

Download
memory/3108-390-0x0000000074FE0000-0x0000000075012000-memory.dmp

Filesize
200KB

Download
memory/3108-391-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/3108-393-0x0000000077910000-0x0000000077935000-memory.dmp

Filesize
148KB

Download
memory/3108-394-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/3108-392-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/3108-411-0x0000000076490000-0x0000000076A92000-memory.dmp

Filesize
6.0MB

Download
memory/3108-412-0x0000000075350000-0x0000000075573000-memory.dmp

Filesize
2.1MB

Download
memory/3108-413-0x00000000755B0000-0x0000000075632000-memory.dmp

Filesize
520KB

Download
memory/3108-398-0x00000000757D0000-0x000000007591D000-memory.dmp

Filesize
1.3MB

Download
memory/3108-414-0x0000000074E30000-0x0000000074F57000-memory.dmp

Filesize
1.2MB

Download
memory/3108-425-0x00000000755B0000-0x0000000075632000-memory.dmp

Filesize
520KB

Download
memory/3108-400-0x0000000074E30000-0x0000000074F57000-memory.dmp

Filesize
1.2MB

Download
memory/3108-401-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/3108-402-0x0000000075EE0000-0x0000000075F9F000-memory.dmp

Filesize
764KB

Download
memory/3108-403-0x00000000756E0000-0x00000000757BF000-memory.dmp

Filesize
892KB

Download
memory/3108-404-0x0000000076490000-0x0000000076A92000-memory.dmp

Filesize
6.0MB

Download
memory/3108-440-0x0000000076490000-0x0000000076A92000-memory.dmp

Filesize
6.0MB

Download
memory/3108-405-0x00000000757D0000-0x000000007591D000-memory.dmp

Filesize
1.3MB

Download
memory/3108-406-0x0000000075350000-0x0000000075573000-memory.dmp

Filesize
2.1MB

Download
memory/3108-407-0x00000000755B0000-0x0000000075632000-memory.dmp

Filesize
520KB

Download
memory/3108-408-0x0000000074E30000-0x0000000074F57000-memory.dmp

Filesize
1.2MB

Download
memory/3108-409-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/3108-410-0x0000000075EE0000-0x0000000075F9F000-memory.dmp

Filesize
764KB

Download
memory/3108-415-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/3108-416-0x0000000075EE0000-0x0000000075F9F000-memory.dmp

Filesize
764KB

Download
memory/3108-418-0x0000000075350000-0x0000000075573000-memory.dmp

Filesize
2.1MB

Download
memory/3108-419-0x00000000755B0000-0x0000000075632000-memory.dmp

Filesize
520KB

Download
memory/3108-420-0x0000000074E30000-0x0000000074F57000-memory.dmp

Filesize
1.2MB

Download
memory/3108-421-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/3108-422-0x0000000075EE0000-0x0000000075F9F000-memory.dmp

Filesize
764KB

Download
memory/3108-397-0x0000000076490000-0x0000000076A92000-memory.dmp

Filesize
6.0MB

Download
memory/3108-423-0x0000000076490000-0x0000000076A92000-memory.dmp

Filesize
6.0MB

Download
memory/3108-426-0x0000000074E30000-0x0000000074F57000-memory.dmp

Filesize
1.2MB

Download
memory/3108-427-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/3108-428-0x0000000075EE0000-0x0000000075F9F000-memory.dmp

Filesize
764KB

Download
memory/3108-429-0x00000000756E0000-0x00000000757BF000-memory.dmp

Filesize
892KB

Download
memory/3108-431-0x00000000757D0000-0x000000007591D000-memory.dmp

Filesize
1.3MB

Download
memory/3108-432-0x0000000075350000-0x0000000075573000-memory.dmp

Filesize
2.1MB

Download
memory/3108-433-0x00000000755B0000-0x0000000075632000-memory.dmp

Filesize
520KB

Download
memory/3108-436-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/3108-438-0x0000000075350000-0x0000000075573000-memory.dmp

Filesize
2.1MB

Download
memory/3108-439-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/3108-441-0x0000000075350000-0x0000000075573000-memory.dmp

Filesize
2.1MB

Download
memory/3108-519-0x0000000004800000-0x0000000004831000-memory.dmp

Filesize
196KB

Download
memory/3108-442-0x0000000074E30000-0x0000000074F57000-memory.dmp

Filesize
1.2MB

Download
memory/3108-443-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/3108-435-0x0000000074E30000-0x0000000074F57000-memory.dmp

Filesize
1.2MB

Download
memory/3108-424-0x0000000075350000-0x0000000075573000-memory.dmp

Filesize
2.1MB

Download
memory/3108-399-0x0000000075350000-0x0000000075573000-memory.dmp

Filesize
2.1MB

Download
memory/3108-395-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/3108-380-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/3168-361-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/3168-362-0x0000000000401000-0x00000000004A9000-memory.dmp

Filesize
672KB

Download