Analysis

  • user interaction
    yes
  • max time kernel
    308s
  • max time network
    324s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    30/06/2026, 15:57

General

  • Target
    CS16_Setup.exe
  • Size 214.3MB
  • Sample260630-tedcaabs5q
  • SHA256 a58faf4dcb65d9b79543970a42ea6ffadda683816e76a8a0b73fd665e40374b7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10

Malware Config

Signatures

  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 42 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

    Inno Setup installer

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • cURL User-Agent 2 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Users\Admin\AppData\Local\Temp\CS16_Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\CS16_Setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2944
    • C:\Users\Admin\AppData\Local\Temp\is-TP5AG.tmp\CS16_Setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-TP5AG.tmp\CS16_Setup.tmp" /SL5="$502A6,223936079,146432,C:\Users\Admin\AppData\Local\Temp\CS16_Setup.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:928
      • C:\Games\Counter-Strike 1.6\cstrike.exe
        "C:\Games\Counter-Strike 1.6\cstrike.exe"
        3⤵
        • Enumerates connected drives
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4336
        • C:\Games\Counter-Strike 1.6\crashpad_handler.exe
          "C:\Games\Counter-Strike 1.6\crashpad_handler.exe" --no-rate-limit "--database=C:\Games\Counter-Strike 1.6\crashes" "--metrics-dir=C:\Games\Counter-Strike 1.6\crashes" --url=https://sentry.cs16nextclient.com:443/api/3/minidump/?sentry_client=sentry.native/0.7.2&sentry_key=d5683aac3be41375ad96f7e8b8032bc7 --attachment=launcher.log --attachment=platform\config\serverbrowser.dat --attachment=user_game_config.ini --attachment=setting_guard.ini --attachment=qconsole.log --attachment=debug.log --attachment=nitro_api.log "--attachment=C:\Games\Counter-Strike 1.6\crashes\97d998ac-400a-4c75-5756-6e1902f09abf.run\__sentry-event" "--attachment=C:\Games\Counter-Strike 1.6\crashes\97d998ac-400a-4c75-5756-6e1902f09abf.run\__sentry-breadcrumb1" "--attachment=C:\Games\Counter-Strike 1.6\crashes\97d998ac-400a-4c75-5756-6e1902f09abf.run\__sentry-breadcrumb2" --initial-client-data=0x33c,0x340,0x344,0x310,0x348,0x9dcc90,0x9dcca8,0x9dccb8
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4660
  • C:\Windows\System32\GameBarPresenceWriter.exe
    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
    1⤵
    • Network Service Discovery
    PID:4992
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4508
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x37c 0x3b8
    1⤵
      PID:2992
    • C:\Games\Counter-Strike 1.6\cstrike.exe
      "C:\Games\Counter-Strike 1.6\cstrike.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3936
      • C:\Games\Counter-Strike 1.6\crashpad_handler.exe
        "C:\Games\Counter-Strike 1.6\crashpad_handler.exe" --no-rate-limit "--database=C:\Games\Counter-Strike 1.6\crashes" "--metrics-dir=C:\Games\Counter-Strike 1.6\crashes" --url=https://sentry.cs16nextclient.com:443/api/3/minidump/?sentry_client=sentry.native/0.7.2&sentry_key=d5683aac3be41375ad96f7e8b8032bc7 --attachment=launcher.log --attachment=platform\config\serverbrowser.dat --attachment=user_game_config.ini --attachment=setting_guard.ini --attachment=qconsole.log --attachment=debug.log --attachment=nitro_api.log "--attachment=C:\Games\Counter-Strike 1.6\crashes\29f474a8-5b39-49dc-a67b-42a9205b0e3f.run\__sentry-event" "--attachment=C:\Games\Counter-Strike 1.6\crashes\29f474a8-5b39-49dc-a67b-42a9205b0e3f.run\__sentry-breadcrumb1" "--attachment=C:\Games\Counter-Strike 1.6\crashes\29f474a8-5b39-49dc-a67b-42a9205b0e3f.run\__sentry-breadcrumb2" --initial-client-data=0x33c,0x340,0x344,0x318,0x348,0x9dcc90,0x9dcca8,0x9dccb8
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3204
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
      1⤵
      • Drops desktop.ini file(s)
      • Checks processor information in registry
      • Modifies registry class
      PID:4488

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          FileSystem_Proxy.dll

          • Path C:\Games\Counter-Strike 1.6\FileSystem_Proxy.dll
          • Size 359KB
          • SHA256 41360fb47019f747230d59e382d169f5aacdbb5dd50befed2b342cf3db30a6f2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          SDL2.dll

          • Path C:\Games\Counter-Strike 1.6\SDL2.dll
          • Size 637KB
          • SHA256 f1be4b46ac46bc9a26ae017c95711e5aedc11ed602908b62eface4e8d2b28aba
          • MD5 SHA1 SHA512 SSDEEP TLSH

          settings.dat

          • Path C:\Games\Counter-Strike 1.6\crashes\settings.dat
          • Size 40B
          • SHA256 ea3df68217aa4c923e787d19b628f017957bac028cc4105cb813143e6c1e1fc4
          • MD5 SHA1 SHA512

          crashpad_handler.exe

          • Path C:\Games\Counter-Strike 1.6\crashpad_handler.exe
          • Size 556KB
          • SHA256 14a88ce287c5b506a90ee989cae2cb6390b51af2f268bd0c0d58c925718993e0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cstrike.exe

          • Path C:\Games\Counter-Strike 1.6\cstrike.exe
          • Size 3.6MB
          • SHA256 7bf794676ceae0421d875a59ccdfc3417f93970f260d6a1a7cf00e904d8fd139
          • MD5 SHA1 SHA512 SSDEEP TLSH

          GameUI.dll

          • Path C:\Games\Counter-Strike 1.6\cstrike\cl_dlls\GameUI.dll
          • Size 1.9MB
          • SHA256 507b4bb80b794ca04e226d108c2552a41f5836f1a50a41c65a47d8e890fc3ff4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          client_mini.dll

          • Path C:\Games\Counter-Strike 1.6\cstrike\cl_dlls\client_mini.dll
          • Size 294KB
          • SHA256 5cba05d3a4dcacbd2ed1c292cd78901d1bc4c2b2281895771c715ec85c899132
          • MD5 SHA1 SHA512 SSDEEP TLSH

          mp.dll

          • Path C:\Games\Counter-Strike 1.6\cstrike\dlls\mp.dll
          • Size 1.6MB
          • SHA256 5596780734fa40dd709537b26b9a0bf4cf970c150fcc03108ed5432b65e3c331
          • MD5 SHA1 SHA512 SSDEEP TLSH

          elite_left.sc

          • Path C:\Games\Counter-Strike 1.6\cstrike\events\elite_left.sc
          • Size 11B
          • SHA256 2092e6c9862b42fe817a552f0ecf05a58a2609b2424402404a796c325bdf2098
          • MD5 SHA1 SHA512

          is-KL7A6.tmp

          • Path C:\Games\Counter-Strike 1.6\cstrike\events\is-KL7A6.tmp
          • Size 9B
          • SHA256 89a0f0c5f04ea6da99b4a48fb642b968d32350aa3e6697da24d2736b7bb195d0
          • MD5 SHA1 SHA512

          is-3J5OD.tmp

          • Path C:\Games\Counter-Strike 1.6\cstrike\gfx\env\is-3J5OD.tmp
          • Size 192KB
          • SHA256 cdf4b2c96b5d1366fecdfa2aa764fcfc8d084bc5a682e2a10c41a03ed3ed3661
          • MD5 SHA1 SHA512 SSDEEP TLSH

          800corner1.tga

          • Path C:\Games\Counter-Strike 1.6\cstrike\gfx\vgui2\800corner1.tga
          • Size 300B
          • SHA256 d37309b4647ec4158edb16839dfc5ec9200176511343776ffc1dbb8d1ba0fd60
          • MD5 SHA1 SHA512 TLSH

          800cornerborder1.tga

          • Path C:\Games\Counter-Strike 1.6\cstrike\gfx\vgui2\800cornerborder1.tga
          • Size 300B
          • SHA256 74199a4cc3847a127b44e23a38688cba53174238adb008b1026b389a7b24efc4
          • MD5 SHA1 SHA512 TLSH

          800cornerborder2.tga

          • Path C:\Games\Counter-Strike 1.6\cstrike\gfx\vgui2\800cornerborder2.tga
          • Size 300B
          • SHA256 4bad83b300cb3bfcc5513d61d3f7baf63244bfac276bc30d88cb985e4c21120a
          • MD5 SHA1 SHA512 TLSH

          800cornerborder3.tga

          • Path C:\Games\Counter-Strike 1.6\cstrike\gfx\vgui2\800cornerborder3.tga
          • Size 300B
          • SHA256 3d856261e79adc4fd0fe85390a349d9601edbfc39447e816e92baab6ca82828e
          • MD5 SHA1 SHA512 TLSH

          800cornerborder4.tga

          • Path C:\Games\Counter-Strike 1.6\cstrike\gfx\vgui2\800cornerborder4.tga
          • Size 300B
          • SHA256 9563a26d056cb575c28ae922fdca747dc9e1dce8f9f1b294e500952c83eace21
          • MD5 SHA1 SHA512 TLSH

          800cornerborder_half1.tga

          • Path C:\Games\Counter-Strike 1.6\cstrike\gfx\vgui2\800cornerborder_half1.tga
          • Size 300B
          • SHA256 0d06761a57bb60b8046bc126fdf1dc38f42aca6607044b227031208c37888c1d
          • MD5 SHA1 SHA512 TLSH

          800cornerborder_half2.tga

          • Path C:\Games\Counter-Strike 1.6\cstrike\gfx\vgui2\800cornerborder_half2.tga
          • Size 300B
          • SHA256 462daaef5a1e858a1890dc6d2f07e03f24ebbb90a8274faba6e848d8188298a0
          • MD5 SHA1 SHA512 TLSH

          800cornerborder_half3.tga

          • Path C:\Games\Counter-Strike 1.6\cstrike\gfx\vgui2\800cornerborder_half3.tga
          • Size 300B
          • SHA256 156191fef40e925a0e618bd603e4068459bce1a01e2a398a8d10e720a043a0f5
          • MD5 SHA1 SHA512 TLSH

          800cornerborder_half4.tga

          • Path C:\Games\Counter-Strike 1.6\cstrike\gfx\vgui2\800cornerborder_half4.tga
          • Size 300B
          • SHA256 8200381d6b5ccab783b7cba5fde84d6a40cbbd813e43fa5c2d7beb4588ede95e
          • MD5 SHA1 SHA512 TLSH

          is-91CPJ.tmp

          • Path C:\Games\Counter-Strike 1.6\cstrike\gfx\vgui\is-91CPJ.tmp
          • Size 128KB
          • SHA256 348584b23c63388045342dc0b79bdd37a8cff904a84215c386492e33273ab725
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-LBKIL.tmp

          • Path C:\Games\Counter-Strike 1.6\cstrike\gfx\vgui\is-LBKIL.tmp
          • Size 128KB
          • SHA256 9d8e087dd823e63f7009907ff1761e620dc5ee64db6a527e2d0ec830d4152437
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-UHB91.tmp

          • Path C:\Games\Counter-Strike 1.6\cstrike\gfx\vgui\is-UHB91.tmp
          • Size 128KB
          • SHA256 4a2460747b60d4b5843bf22a459f6c17f16a9664305b4b4bda182041a0fdebfa
          • MD5 SHA1 SHA512 SSDEEP TLSH

          CreateMultiplayerGameBotPage.res

          • Path C:\Games\Counter-Strike 1.6\cstrike\resource\CreateMultiplayerGameBotPage.res
          • Size 6KB
          • SHA256 b4ae703c3c78277d0902a6a25d2316573322bb71db16a4ec41ac52eee3dc9352
          • MD5 SHA1 SHA512 SSDEEP TLSH

          CreateMultiplayerGameServerPage.res

          • Path C:\Games\Counter-Strike 1.6\cstrike\resource\CreateMultiplayerGameServerPage.res
          • Size 4KB
          • SHA256 e6dbef55cb9ae5e04b6c262a92540842ae3a4c441ffb5d3fe3159b3ae68d08e0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          MultiplayerAdvancedDialog.res

          • Path C:\Games\Counter-Strike 1.6\cstrike\resource\MultiplayerAdvancedDialog.res
          • Size 7KB
          • SHA256 4f70026b60272a3c5e911c5d5ec8e2762639fa1914b8a331e9c5473a0ba0928f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          OptionsSubMiscellaneous.res

          • Path C:\Games\Counter-Strike 1.6\cstrike\resource\OptionsSubMiscellaneous.res
          • Size 6KB
          • SHA256 111795c66a100292bd234f4f72b10d75cb4756a53fddcc22037290bb85fe517a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          OptionsSubMultiplayer.res

          • Path C:\Games\Counter-Strike 1.6\cstrike\resource\OptionsSubMultiplayer.res
          • Size 17KB
          • SHA256 1627999048eacead252834324c3f3fc2a90541114023dc04819c536a7a9d6984
          • MD5 SHA1 SHA512 SSDEEP TLSH

          OptionsSubVideo.res

          • Path C:\Games\Counter-Strike 1.6\cstrike\resource\OptionsSubVideo.res
          • Size 9KB
          • SHA256 620c4bec315d6a33059d1fb4564a1c6519eaf44b2a6faeeb1d13f40309182cdd
          • MD5 SHA1 SHA512 SSDEEP TLSH

          TrackerScheme.res

          • Path C:\Games\Counter-Strike 1.6\cstrike\resource\TrackerScheme.res
          • Size 17KB
          • SHA256 e550f74f104e9ea71db05722f747e6e5777ffaea7edaf02d963798d3ad8a73a9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          VideoAvancedDialog.res

          • Path C:\Games\Counter-Strike 1.6\cstrike\resource\VideoAvancedDialog.res
          • Size 7KB
          • SHA256 a70e8bba5b546c953ef37c8791c23e89fc0026f354d4555d9283b69265574d6d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cstrike_english.txt

          • Path C:\Games\Counter-Strike 1.6\cstrike\resource\cstrike_english.txt
          • Size 180KB
          • SHA256 e31f271d73f5ebc51e1eaf7d2b278b06b642ab8ef71ea87ef420507cab3f5b3a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cstrike_russian.txt

          • Path C:\Games\Counter-Strike 1.6\cstrike\resource\cstrike_russian.txt
          • Size 190KB
          • SHA256 d249b81161a66385a0247b6adfec7d52dc66fc803dfe08bfbb1a0a6f874451c8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cstrike_spanish.txt

          • Path C:\Games\Counter-Strike 1.6\cstrike\resource\cstrike_spanish.txt
          • Size 355KB
          • SHA256 c6d58cc12a89bd6f77cc5cc52ba83dffcd11e74386568eef4f8fed4984fa9e7e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cstrike_ukrainian.txt

          • Path C:\Games\Counter-Strike 1.6\cstrike\resource\cstrike_ukrainian.txt
          • Size 187KB
          • SHA256 1f24344d1de9417a3bab851c26836db7567cfcc97e2c3259c022b261cc96c745
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nextclient_english.txt

          • Path C:\Games\Counter-Strike 1.6\cstrike\resource\nextclient_english.txt
          • Size 6KB
          • SHA256 78a33491c8d7fae1e285ee6b2630e05a5f2333e29690f77b97a0756730379040
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nextclient_russian.txt

          • Path C:\Games\Counter-Strike 1.6\cstrike\resource\nextclient_russian.txt
          • Size 6KB
          • SHA256 be66015b56d373e7e2ef872ad86a1a54dc516ec512451dcb6c18039f65401395
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nextclient_ukrainian.txt

          • Path C:\Games\Counter-Strike 1.6\cstrike\resource\nextclient_ukrainian.txt
          • Size 6KB
          • SHA256 2a7e58115b5f5ff54ed656bdf618b45007d46cd9720e76bf2ae91cc0b0896588
          • MD5 SHA1 SHA512 SSDEEP TLSH

          TrackerScheme_ClassicPlus.res

          • Path C:\Games\Counter-Strike 1.6\cstrike\resource\schemes\TrackerScheme_ClassicPlus.res
          • Size 17KB
          • SHA256 af1135d1016d622f32fb42d48700b60c388746b360e97bac2389da5782f7d182
          • MD5 SHA1 SHA512 SSDEEP TLSH

          TrackerScheme_Source.res

          • Path C:\Games\Counter-Strike 1.6\cstrike\resource\schemes\TrackerScheme_Source.res
          • Size 17KB
          • SHA256 cf70e6093a0ad12d69522d90d70a7b790f290f6c6af2c8e4004afcdf7802f9fa
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-AVNH0.tmp

          • Path C:\Games\Counter-Strike 1.6\cstrike\sound\weapons\is-AVNH0.tmp
          • Size 10KB
          • SHA256 ffdaf0a862ce1f47615dc1ac59af868010796eeef50de895414c40a04da3680e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-E0T76.tmp

          • Path C:\Games\Counter-Strike 1.6\cstrike\sound\weapons\is-E0T76.tmp
          • Size 7KB
          • SHA256 616e07c58c0d3d332c3c7fe65c1b7e6ef49d5c26d09d8132d1e7c36c3899ea46
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-EVQHD.tmp

          • Path C:\Games\Counter-Strike 1.6\cstrike\sound\weapons\is-EVQHD.tmp
          • Size 14KB
          • SHA256 2ebbea31183105b5d305027e960bb89dc2e2582b81ba712b01b1851501b6092d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-7FHNS.tmp

          • Path C:\Games\Counter-Strike 1.6\cstrike\sprites\is-7FHNS.tmp
          • Size 361KB
          • SHA256 aae249f31605fdf3773d0753764dd4865873dca48a58108579923af755122fe5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          kill_rarity.spr

          • Path C:\Games\Counter-Strike 1.6\cstrike\sprites\kill_rarity.spr
          • Size 18KB
          • SHA256 0f875edde646b93f6789e64dbeef95fc5f79f716e7b682f1ad10d860e9c28559
          • MD5 SHA1 SHA512 SSDEEP TLSH

          v_grenade_flare1.mdl

          • Path C:\Games\Counter-Strike 1.6\cstrike_downloads\models\zombie_plague\v_grenade_flare1.mdl
          • Size 872KB
          • SHA256 bb75c18121b26caa14c3a9589528851b7a20426950e058fff277512a5ef2803b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          grenade_explode.wav

          • Path C:\Games\Counter-Strike 1.6\cstrike_downloads\sound\zombie_plague\grenade_explode.wav
          • Size 70KB
          • SHA256 b77e091ade1982812d948aa0f853d8580a91112f71e1bfe48e50faa02fe408f7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-QRFJ0.tmp

          • Path C:\Games\Counter-Strike 1.6\cstrike_hd\gfx\vgui\buy_presets\is-QRFJ0.tmp
          • Size 128KB
          • SHA256 60fe19c7f1e2929356c9d26987e2ebd9878456c0797db579e3e56d4501c0b05c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-GHHOJ.tmp

          • Path C:\Games\Counter-Strike 1.6\cstrike_hd\gfx\vgui\is-GHHOJ.tmp
          • Size 128KB
          • SHA256 664264946b90b3ec23cf5e97c7096e60170e1a1c0a9b6bc4eb8c78633699af55
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-VPT3F.tmp

          • Path C:\Games\Counter-Strike 1.6\cstrike_hd\gfx\vgui\is-VPT3F.tmp
          • Size 64KB
          • SHA256 c07530ca596e9a10496f5774fc6fe9253e392600c3cfe77a6567d355d3f54a0f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          next_engine_mini.dll

          • Path C:\Games\Counter-Strike 1.6\next_engine_mini.dll
          • Size 1.2MB
          • SHA256 33f9c1679e5535c48905b4a24c7d55bc5ca0db03d37932e920c1b77d2abe99c0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          next_lib.dll

          • Path C:\Games\Counter-Strike 1.6\next_lib.dll
          • Size 10.6MB
          • SHA256 56e242a64676eb438bf3d54c23889c30c0558d6eb1ed57b984bcbac153bca6f8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nitro_api2.dll

          • Path C:\Games\Counter-Strike 1.6\nitro_api2.dll
          • Size 2.2MB
          • SHA256 edbefdd9a66b71b0b0c2abb7472ab5ba0d0fca241653891bcb08d8ace532d3a9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          partner.id

          • Path C:\Games\Counter-Strike 1.6\partner.id
          • Size 9B
          • SHA256 2a6c4222669a0c14a9e8cbcb6ac968e1860b8c6efbd3705afe0820912a988ed8
          • MD5 SHA1 SHA512

          InternetGamesPage.res

          • Path C:\Games\Counter-Strike 1.6\platform\servers\InternetGamesPage.res
          • Size 6KB
          • SHA256 a47086d3684a884f1a4ba658d78cd5c58f69c7cf1c88dc594142760df07a4880
          • MD5 SHA1 SHA512 SSDEEP TLSH

          InternetGamesPage_Filters.res

          • Path C:\Games\Counter-Strike 1.6\platform\servers\InternetGamesPage_Filters.res
          • Size 7KB
          • SHA256 b65478e38dac8f629b52f95d5cfed113d28e9dff3b3b6bd3a0c307234c7d34a2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          steam_api.dll

          • Path C:\Games\Counter-Strike 1.6\platform\steam\steam_api.dll
          • Size 101KB
          • SHA256 8c073e0d2ca39d1e986bec348f988303357be5c495ccf6e0415802b86eae3534
          • MD5 SHA1 SHA512 SSDEEP TLSH

          steam_api.dll

          • Path C:\Games\Counter-Strike 1.6\steam_api.dll
          • Size 836KB
          • SHA256 91d6306b34bf54a3c023b8e2b3161d52ac2977ff89d6b700e42f54b48f4568f1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          tier0.dll

          • Path C:\Games\Counter-Strike 1.6\tier0.dll
          • Size 331KB
          • SHA256 55e64559ba6acc4c0efc3bef92382714a6b9b8a4bd4696e8c920e709c803b250
          • MD5 SHA1 SHA512 SSDEEP TLSH

          user_game_config.ini

          • Path C:\Games\Counter-Strike 1.6\user_game_config.ini
          • Size 94B
          • SHA256 ba25777624e2b167756c9ecb061ebac766efa3918064f2b04e50b79ce1d1ba64
          • MD5 SHA1 SHA512 TLSH

          is-8GINR.tmp

          • Path C:\Games\Counter-Strike 1.6\valve\events\is-8GINR.tmp
          • Size 1KB
          • SHA256 2c7d43b8dc6ea01a32acddb7798b9dabf0ec44c7a6dcf75160539a7fe53e029d
          • MD5 SHA1 SHA512 TLSH

          is-0BH3D.tmp

          • Path C:\Games\Counter-Strike 1.6\valve\gfx\vgui\fonts\is-0BH3D.tmp
          • Size 24KB
          • SHA256 3988ddbea3e6fd927933a698d28d66572d51e59938ea16624f644afe2021818d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-1US74.tmp

          • Path C:\Games\Counter-Strike 1.6\valve\gfx\vgui\fonts\is-1US74.tmp
          • Size 44KB
          • SHA256 dff807e488eee92c3f841de1f330bac00b42c36e34320e6335ed6e5d926243a8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-4NJSA.tmp

          • Path C:\Games\Counter-Strike 1.6\valve\gfx\vgui\fonts\is-4NJSA.tmp
          • Size 34KB
          • SHA256 824ad8824e4d05319556d9c08dd0d4c90fecd6150a0dbcae8c946740cb4e2c56
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-72B7R.tmp

          • Path C:\Games\Counter-Strike 1.6\valve\gfx\vgui\fonts\is-72B7R.tmp
          • Size 33KB
          • SHA256 4eb392f4136f1a4b255ab26772947e62b80615ca8b1ccea93563c3f33539a8bd
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-BOKMO.tmp

          • Path C:\Games\Counter-Strike 1.6\valve\gfx\vgui\fonts\is-BOKMO.tmp
          • Size 40KB
          • SHA256 93eba9e5ba94654d73d76944cb9860e4fe8db92a6c734fcbc57864cb766caf1d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-C3Q3T.tmp

          • Path C:\Games\Counter-Strike 1.6\valve\gfx\vgui\fonts\is-C3Q3T.tmp
          • Size 45KB
          • SHA256 f472485bdddb0f7acdce7ba6dfb1520dfdab6b2e870b37f77f61714533c5fe79
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-DT47L.tmp

          • Path C:\Games\Counter-Strike 1.6\valve\gfx\vgui\fonts\is-DT47L.tmp
          • Size 27KB
          • SHA256 60946960e36a56fe17b02ab7c618e3ca0d61b7412acbb9967271ff309a76b5e0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-Q79U3.tmp

          • Path C:\Games\Counter-Strike 1.6\valve\gfx\vgui\fonts\is-Q79U3.tmp
          • Size 24KB
          • SHA256 fad8e72511e03ea0b215e491da1ada731d7474a03d43c26a2f858c8fcee9beac
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-OEDIM.tmp

          • Path C:\Games\Counter-Strike 1.6\valve\gfx\vgui\is-OEDIM.tmp
          • Size 1KB
          • SHA256 99986396ea8ebd9ab4eb1221b52db2a8a024e67c748e0b8080d8dad24e4e9cd2
          • MD5 SHA1 SHA512 TLSH

          is-OU06M.tmp

          • Path C:\Games\Counter-Strike 1.6\valve\gfx\vgui\is-OU06M.tmp
          • Size 2KB
          • SHA256 1efacc8931f4e6558fc9f854527e25e004d8c3fd90f1f5209273236924a9241b
          • MD5 SHA1 SHA512 TLSH

          is-2EQUU.tmp

          • Path C:\Games\Counter-Strike 1.6\valve\models\is-2EQUU.tmp
          • Size 3KB
          • SHA256 748e6fb4465843238519d56774643c2d4fb3f77131ba49ee9ca2d700c42acb70
          • MD5 SHA1 SHA512 TLSH

          is-HH0K4.tmp

          • Path C:\Games\Counter-Strike 1.6\valve\models\is-HH0K4.tmp
          • Size 22KB
          • SHA256 47b5e88f5cc25627e8dc76b85eb6ad64d8613b00838d0cca6a85f118af81c7b0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          OptionsSubMouse.res

          • Path C:\Games\Counter-Strike 1.6\valve\resource\OptionsSubMouse.res
          • Size 5KB
          • SHA256 31540f55e2e0a6ab67bff129f54b23116d655992abb44189c4bc1c21ff8800dd
          • MD5 SHA1 SHA512 SSDEEP TLSH

          OptionsSubVideo.res

          • Path C:\Games\Counter-Strike 1.6\valve\resource\OptionsSubVideo.res
          • Size 4KB
          • SHA256 29da44a71f6743c46b731e442690c756a19fc5960680198297482823d82990f1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          OptionsSubVoice.res

          • Path C:\Games\Counter-Strike 1.6\valve\resource\OptionsSubVoice.res
          • Size 5KB
          • SHA256 6e2a62c011e25951a0b2b03b1edede28eac33f880aeaeab58800f074383a7826
          • MD5 SHA1 SHA512 SSDEEP TLSH

          gameui_english.txt

          • Path C:\Games\Counter-Strike 1.6\valve\resource\gameui_english.txt
          • Size 24KB
          • SHA256 923ea08187c082ff20b5197e061fd00c5abec28df1eeb96ffc3f4436ddd6b4e1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          gameui_russian.txt

          • Path C:\Games\Counter-Strike 1.6\valve\resource\gameui_russian.txt
          • Size 51KB
          • SHA256 26a3193a2d314bc65eb4a0612d7b3545cfd46690ac2639080d3ed68b0d35d482
          • MD5 SHA1 SHA512 SSDEEP TLSH

          gameui_spanish.txt

          • Path C:\Games\Counter-Strike 1.6\valve\resource\gameui_spanish.txt
          • Size 51KB
          • SHA256 242d09757fa84be60729c2fb9bb18c81bc160360f172406e1e532c188e2877ca
          • MD5 SHA1 SHA512 SSDEEP TLSH

          gameui_ukrainian.txt

          • Path C:\Games\Counter-Strike 1.6\valve\resource\gameui_ukrainian.txt
          • Size 27KB
          • SHA256 b54d655b27bf6e3f23e4856677682237240fc00609d19348815fc80cc48ab745
          • MD5 SHA1 SHA512 SSDEEP TLSH

          valve_english.txt

          • Path C:\Games\Counter-Strike 1.6\valve\resource\valve_english.txt
          • Size 13KB
          • SHA256 6cb8cf4c1fcbd0b0a79683434dcfd1dda77db909072effbf690453fa162febdc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          valve_russian.txt

          • Path C:\Games\Counter-Strike 1.6\valve\resource\valve_russian.txt
          • Size 27KB
          • SHA256 58b035621b81928070abdde1499472845e0ecb2dbb6f63d37ade548aecd11d58
          • MD5 SHA1 SHA512 SSDEEP TLSH

          valve_spanish.txt

          • Path C:\Games\Counter-Strike 1.6\valve\resource\valve_spanish.txt
          • Size 27KB
          • SHA256 15b3e255f2115bc5539432b426e356c7512e933efb1d227203e62ad24a80d53e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          valve_ukrainian.txt

          • Path C:\Games\Counter-Strike 1.6\valve\resource\valve_ukrainian.txt
          • Size 14KB
          • SHA256 1ed23b1e98a8943d64d40025b4193717f335995cd2d28de303a856b83e4346ab
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-4S4TS.tmp

          • Path C:\Games\Counter-Strike 1.6\valve\sound\fvox\is-4S4TS.tmp
          • Size 2KB
          • SHA256 0ffbcdb3466691fbc1043c69abe50434df646f997c52856a509de43cae501eee
          • MD5 SHA1 SHA512 TLSH

          is-I1VMJ.tmp

          • Path C:\Games\Counter-Strike 1.6\valve\sound\plats\is-I1VMJ.tmp
          • Size 1KB
          • SHA256 5271b9aa2961809f47fadecb693be2eebde2dbed62fbc4f5f4889fcd8c4a65f8
          • MD5 SHA1 SHA512 TLSH

          is-7U3UG.tmp

          • Path C:\Games\Counter-Strike 1.6\valve\sprites\is-7U3UG.tmp
          • Size 4KB
          • SHA256 5603d52c5f089950f372e2b00845738746abebaa2796b0b3e2f6d8d2f4111760
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ISSkinU.dll

          • Path C:\Users\Admin\AppData\Local\Temp\is-ND644.tmp\ISSkinU.dll
          • Size 385KB
          • SHA256 ff1374abd93690f5e6e591bae23b49aacc8bbe8b7b05b539ec8aee755070a0e3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-DVS29.tmp

          • Path C:\Users\Admin\AppData\Local\Temp\is-ND644.tmp\langs\tchinese\cstrike\is-DVS29.tmp
          • Size 22KB
          • SHA256 445a1cddf402946c16097cc0a261c16293208c5a2f9d03278a4346da3fd73389
          • MD5 SHA1 SHA512 SSDEEP TLSH

          steam.cjstyles

          • Path C:\Users\Admin\AppData\Local\Temp\is-ND644.tmp\steam.cjstyles
          • Size 413KB
          • SHA256 bd371be89f5997694a224e8ff7121f0f6aa8893f31ab5bee7b6a3c32fb31d96a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          CS16_Setup.tmp

          • Path C:\Users\Admin\AppData\Local\Temp\is-TP5AG.tmp\CS16_Setup.tmp
          • Size 1.2MB
          • SHA256 0edb48779e95a22753e3abfad5f1483ee8f4671d33c4225b91da65d599fd5808
          • MD5 SHA1 SHA512 SSDEEP TLSH

          desktop.ini

          • Path C:\Users\Admin\Videos\Captures\desktop.ini
          • Size 190B
          • SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
          • MD5 SHA1 SHA512 TLSH

          memory/928-23-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/928-28-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/928-26-0x0000000074600000-0x0000000074630000-memory.dmp

          memory/928-61-0x0000000075310000-0x0000000075520000-memory.dmp

          memory/928-44-0x0000000074440000-0x0000000074562000-memory.dmp

          memory/928-153-0x00000000022E0000-0x00000000022E1000-memory.dmp

          memory/928-56-0x0000000075290000-0x0000000075304000-memory.dmp

          memory/928-54-0x0000000075310000-0x0000000075520000-memory.dmp

          memory/928-45-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/928-16-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/928-17-0x00000000775B0000-0x000000007762D000-memory.dmp

          memory/928-55-0x0000000076570000-0x0000000076595000-memory.dmp

          memory/928-57-0x0000000074440000-0x0000000074562000-memory.dmp

          memory/928-19-0x00000000775B0000-0x000000007762D000-memory.dmp

          memory/928-58-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/928-60-0x0000000076CE0000-0x0000000076D8F000-memory.dmp

          memory/928-59-0x0000000075520000-0x0000000075AF7000-memory.dmp

          memory/928-62-0x0000000075290000-0x0000000075304000-memory.dmp

          memory/928-63-0x0000000074440000-0x0000000074562000-memory.dmp

          memory/928-64-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/928-65-0x0000000076B30000-0x0000000076C16000-memory.dmp

          memory/928-66-0x0000000075ED0000-0x0000000075FB3000-memory.dmp

          memory/928-67-0x0000000075520000-0x0000000075AF7000-memory.dmp

          memory/928-68-0x0000000076CE0000-0x0000000076D8F000-memory.dmp

          memory/928-69-0x0000000075310000-0x0000000075520000-memory.dmp

          memory/928-70-0x0000000075290000-0x0000000075304000-memory.dmp

          memory/928-20-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/928-18-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/928-22-0x0000000076570000-0x0000000076595000-memory.dmp

          memory/928-50-0x0000000074440000-0x0000000074562000-memory.dmp

          memory/928-24-0x00000000775B0000-0x000000007762D000-memory.dmp

          memory/928-25-0x0000000076570000-0x0000000076595000-memory.dmp

          memory/928-38-0x0000000076B30000-0x0000000076C16000-memory.dmp

          memory/928-39-0x0000000075ED0000-0x0000000075FB3000-memory.dmp

          memory/928-72-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/928-33-0x0000000075520000-0x0000000075AF7000-memory.dmp

          memory/928-35-0x0000000075310000-0x0000000075520000-memory.dmp

          memory/928-36-0x0000000074440000-0x0000000074562000-memory.dmp

          memory/928-37-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/928-40-0x0000000075520000-0x0000000075AF7000-memory.dmp

          memory/928-71-0x0000000074440000-0x0000000074562000-memory.dmp

          memory/928-27-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/928-74-0x0000000075310000-0x0000000075520000-memory.dmp

          memory/928-75-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/928-73-0x0000000075520000-0x0000000075AF7000-memory.dmp

          memory/928-77-0x0000000075310000-0x0000000075520000-memory.dmp

          memory/928-78-0x0000000074440000-0x0000000074562000-memory.dmp

          memory/928-53-0x0000000076CE0000-0x0000000076D8F000-memory.dmp

          memory/928-52-0x0000000075520000-0x0000000075AF7000-memory.dmp

          memory/928-29-0x0000000076570000-0x0000000076595000-memory.dmp

          memory/928-34-0x0000000076CE0000-0x0000000076D8F000-memory.dmp

          memory/928-30-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/928-32-0x0000000075ED0000-0x0000000075FB3000-memory.dmp

          memory/928-31-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/928-21-0x00000000775B0000-0x000000007762D000-memory.dmp

          memory/928-15-0x00000000775B0000-0x000000007762D000-memory.dmp

          memory/928-48-0x0000000075310000-0x0000000075520000-memory.dmp

          memory/928-41-0x0000000076CE0000-0x0000000076D8F000-memory.dmp

          memory/928-5-0x00000000022E0000-0x00000000022E1000-memory.dmp

          memory/928-42-0x0000000075310000-0x0000000075520000-memory.dmp

          memory/928-43-0x0000000075290000-0x0000000075304000-memory.dmp

          memory/928-46-0x0000000075520000-0x0000000075AF7000-memory.dmp

          memory/928-49-0x0000000075290000-0x0000000075304000-memory.dmp

          memory/928-51-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/928-47-0x0000000076CE0000-0x0000000076D8F000-memory.dmp

          memory/2944-0-0x0000000000400000-0x000000000042E000-memory.dmp