Analysis

  • user interaction
    yes
  • max time kernel
    119s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 22:26

General

  • Target
    -wifi4games.com-CS16.exe
  • Size 254.8MB
  • Sample260910-2cgwpahm71
  • SHA256 a6c6c96bde72c656972306a950655c2aef62d586d38bddc17c5b4059e4de5a6e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\-wifi4games.com-CS16.exe
    "C:\Users\Admin\AppData\Local\Temp\-wifi4games.com-CS16.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3732

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Counter-Strike.exe

        • Path C:\Program Files (x86)\Counter-Strike\Counter-Strike.exe
        • Size 104KB
        • SHA256 02711a0d6eb7b925ef6a05e0a042eab4c71321375e4b0962087b185a298d27ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstal.exe

        • Path C:\Program Files (x86)\Counter-Strike\Uninstal.exe
        • Size 496KB
        • SHA256 e95e82935d7bac26925c9177d9f323d63aa6fd37517712456b34a7e26793be75
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MasterServers.vdf

        • Path C:\Program Files (x86)\Counter-Strike\config\MasterServers.vdf
        • Size 92B
        • SHA256 176b40269f53d6864a51b85bc9bf067009e45f12683b3890357969a804e066de
        • MD5 SHA1 SHA512 TLSH

        autoexec.CFG

        • Path C:\Program Files (x86)\Counter-Strike\cstrike\autoexec.CFG
        • Size 1KB
        • SHA256 e20222c65dfcf3474cb0d6b437441c1b2ba736004c16115cc6eaa55994f489be
        • MD5 SHA1 SHA512 TLSH

        createsmoke.$$A

        • Path C:\Program Files (x86)\Counter-Strike\cstrike\events\createsmoke.$$A
        • Size 9B
        • SHA256 89a0f0c5f04ea6da99b4a48fb642b968d32350aa3e6697da24d2736b7bb195d0
        • MD5 SHA1 SHA512

        elite_left.$$A

        • Path C:\Program Files (x86)\Counter-Strike\cstrike\events\elite_left.$$A
        • Size 11B
        • SHA256 2092e6c9862b42fe817a552f0ecf05a58a2609b2424402404a796c325bdf2098
        • MD5 SHA1 SHA512

        backalleyrt.$$A

        • Path C:\Program Files (x86)\Counter-Strike\cstrike\gfx\env\backalleyrt.$$A
        • Size 192KB
        • SHA256 cdf4b2c96b5d1366fecdfa2aa764fcfc8d084bc5a682e2a10c41a03ed3ed3661
        • MD5 SHA1 SHA512 SSDEEP TLSH

        p90.$$A

        • Path C:\Program Files (x86)\Counter-Strike\cstrike\gfx\vgui\p90.$$A
        • Size 128KB
        • SHA256 348584b23c63388045342dc0b79bdd37a8cff904a84215c386492e33273ab725
        • MD5 SHA1 SHA512 SSDEEP TLSH

        smokegrenade.$$A

        • Path C:\Program Files (x86)\Counter-Strike\cstrike\gfx\vgui\smokegrenade.$$A
        • Size 128KB
        • SHA256 4a2460747b60d4b5843bf22a459f6c17f16a9664305b4b4bda182041a0fdebfa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        usp45.$$A

        • Path C:\Program Files (x86)\Counter-Strike\cstrike\gfx\vgui\usp45.$$A
        • Size 128KB
        • SHA256 9d8e087dd823e63f7009907ff1761e620dc5ee64db6a527e2d0ec830d4152437
        • MD5 SHA1 SHA512 SSDEEP TLSH

        grenade_hit3.$$A

        • Path C:\Program Files (x86)\Counter-Strike\cstrike\sound\weapons\grenade_hit3.$$A
        • Size 10KB
        • SHA256 ffdaf0a862ce1f47615dc1ac59af868010796eeef50de895414c40a04da3680e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        usp_clipin.$$A

        • Path C:\Program Files (x86)\Counter-Strike\cstrike\sound\weapons\usp_clipin.$$A
        • Size 14KB
        • SHA256 2ebbea31183105b5d305027e960bb89dc2e2582b81ba712b01b1851501b6092d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        usp_clipout.$$A

        • Path C:\Program Files (x86)\Counter-Strike\cstrike\sound\weapons\usp_clipout.$$A
        • Size 7KB
        • SHA256 616e07c58c0d3d332c3c7fe65c1b7e6ef49d5c26d09d8132d1e7c36c3899ea46
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rifle_smoke1.$$A

        • Path C:\Program Files (x86)\Counter-Strike\cstrike\sprites\rifle_smoke1.$$A
        • Size 361KB
        • SHA256 aae249f31605fdf3773d0753764dd4865873dca48a58108579923af755122fe5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icon_online.$$A

        • Path C:\Program Files (x86)\Counter-Strike\platform\Friends\icon_online.$$A
        • Size 1KB
        • SHA256 50443605d94d7bedbb03c2200d7cb7e98b0eaa91e3489cd7d77f69a407b73e0a
        • MD5 SHA1 SHA512 TLSH

        purchasesubcreditcarddiscover.$$A

        • Path C:\Program Files (x86)\Counter-Strike\platform\Steam\cached\purchasesubcreditcarddiscover.$$A
        • Size 2KB
        • SHA256 7f00fc14809350a11d04cb655e996beb4d829ae7c2d7ca320968661961e18fd2
        • MD5 SHA1 SHA512 TLSH

        dxsupport.$$A

        • Path C:\Program Files (x86)\Counter-Strike\platform\Steam\drivercheck\260\dxsupport.$$A
        • Size 123KB
        • SHA256 9b93979bfb94347d3157cdca038d1a6addc8564a954bcc564adef6a1c86ebc22
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dxsupport_reqs.$$A

        • Path C:\Program Files (x86)\Counter-Strike\platform\Steam\drivercheck\260\dxsupport_reqs.$$A
        • Size 129B
        • SHA256 ddbef05c1fa1eb6c13538306f2d28bffb61dc57e7a9e3d9e25b98dec576ca8a6
        • MD5 SHA1 SHA512 TLSH

        counter-strike.$$A

        • Path C:\Program Files (x86)\Counter-Strike\platform\Steam\games\counter-strike.$$A
        • Size 7KB
        • SHA256 13a9046a55d6059bbf1df982569ca56a6e6d48f70917103fb71256b41e473168
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icon_lostcoast.$$A

        • Path C:\Program Files (x86)\Counter-Strike\platform\Steam\games\icon_lostcoast.$$A
        • Size 1KB
        • SHA256 e5972753625daccf5bd9b735261b60375b5f46cc5adcc8d1c18fd36cde5d7d1c
        • MD5 SHA1 SHA512 TLSH

        icon_source_ds_dull.$$A

        • Path C:\Program Files (x86)\Counter-Strike\platform\Steam\games\icon_source_ds_dull.$$A
        • Size 1KB
        • SHA256 e136089e82c2d98a7283b55dcd93c5332a332149e7119d015bb7c353435ea9c6
        • MD5 SHA1 SHA512 TLSH

        crowbar.$$A

        • Path C:\Program Files (x86)\Counter-Strike\valve\events\crowbar.$$A
        • Size 1KB
        • SHA256 2c7d43b8dc6ea01a32acddb7798b9dabf0ec44c7a6dcf75160539a7fe53e029d
        • MD5 SHA1 SHA512 TLSH

        game.$$A

        • Path C:\Program Files (x86)\Counter-Strike\valve\game.$$A
        • Size 4KB
        • SHA256 01491c012c29f4706f0cc8f1117eb0f882b54f720bfbf320a3271ffac6c929dc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        1280_timer.$$A

        • Path C:\Program Files (x86)\Counter-Strike\valve\gfx\vgui\1280_timer.$$A
        • Size 2KB
        • SHA256 1efacc8931f4e6558fc9f854527e25e004d8c3fd90f1f5209273236924a9241b
        • MD5 SHA1 SHA512 TLSH

        1024_scoreboard text.$$A

        • Path C:\Program Files (x86)\Counter-Strike\valve\gfx\vgui\fonts\1024_scoreboard text.$$A
        • Size 33KB
        • SHA256 4eb392f4136f1a4b255ab26772947e62b80615ca8b1ccea93563c3f33539a8bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        1152_commandmenu text.$$A

        • Path C:\Program Files (x86)\Counter-Strike\valve\gfx\vgui\fonts\1152_commandmenu text.$$A
        • Size 34KB
        • SHA256 824ad8824e4d05319556d9c08dd0d4c90fecd6150a0dbcae8c946740cb4e2c56
        • MD5 SHA1 SHA512 SSDEEP TLSH

        1280_scoreboard text.$$A

        • Path C:\Program Files (x86)\Counter-Strike\valve\gfx\vgui\fonts\1280_scoreboard text.$$A
        • Size 40KB
        • SHA256 93eba9e5ba94654d73d76944cb9860e4fe8db92a6c734fcbc57864cb766caf1d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        1600_scoreboard text.$$A

        • Path C:\Program Files (x86)\Counter-Strike\valve\gfx\vgui\fonts\1600_scoreboard text.$$A
        • Size 45KB
        • SHA256 f472485bdddb0f7acdce7ba6dfb1520dfdab6b2e870b37f77f61714533c5fe79
        • MD5 SHA1 SHA512 SSDEEP TLSH

        640_scoreboard text.$$A

        • Path C:\Program Files (x86)\Counter-Strike\valve\gfx\vgui\fonts\640_scoreboard text.$$A
        • Size 24KB
        • SHA256 fad8e72511e03ea0b215e491da1ada731d7474a03d43c26a2f858c8fcee9beac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        640_scoreboard title text.$$A

        • Path C:\Program Files (x86)\Counter-Strike\valve\gfx\vgui\fonts\640_scoreboard title text.$$A
        • Size 24KB
        • SHA256 3988ddbea3e6fd927933a698d28d66572d51e59938ea16624f644afe2021818d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        800_scoreboard small text.$$A

        • Path C:\Program Files (x86)\Counter-Strike\valve\gfx\vgui\fonts\800_scoreboard small text.$$A
        • Size 27KB
        • SHA256 60946960e36a56fe17b02ab7c618e3ca0d61b7412acbb9967271ff309a76b5e0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        800_title font.$$A

        • Path C:\Program Files (x86)\Counter-Strike\valve\gfx\vgui\fonts\800_title font.$$A
        • Size 44KB
        • SHA256 dff807e488eee92c3f841de1f330bac00b42c36e34320e6335ed6e5d926243a8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        timer.$$A

        • Path C:\Program Files (x86)\Counter-Strike\valve\gfx\vgui\timer.$$A
        • Size 1KB
        • SHA256 99986396ea8ebd9ab4eb1221b52db2a8a024e67c748e0b8080d8dad24e4e9cd2
        • MD5 SHA1 SHA512 TLSH

        fungust.$$A

        • Path C:\Program Files (x86)\Counter-Strike\valve\models\fungust.$$A
        • Size 22KB
        • SHA256 47b5e88f5cc25627e8dc76b85eb6ad64d8613b00838d0cca6a85f118af81c7b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uplant3t.$$A

        • Path C:\Program Files (x86)\Counter-Strike\valve\models\uplant3t.$$A
        • Size 3KB
        • SHA256 748e6fb4465843238519d56774643c2d4fb3f77131ba49ee9ca2d700c42acb70
        • MD5 SHA1 SHA512 TLSH

        _comma.$$A

        • Path C:\Program Files (x86)\Counter-Strike\valve\sound\fvox\_comma.$$A
        • Size 2KB
        • SHA256 0ffbcdb3466691fbc1043c69abe50434df646f997c52856a509de43cae501eee
        • MD5 SHA1 SHA512 TLSH

        train2.$$A

        • Path C:\Program Files (x86)\Counter-Strike\valve\sound\plats\train2.$$A
        • Size 1KB
        • SHA256 5271b9aa2961809f47fadecb693be2eebde2dbed62fbc4f5f4889fcd8c4a65f8
        • MD5 SHA1 SHA512 TLSH

        spotlight04.$$A

        • Path C:\Program Files (x86)\Counter-Strike\valve\sprites\spotlight04.$$A
        • Size 4KB
        • SHA256 5603d52c5f089950f372e2b00845738746abebaa2796b0b3e2f6d8d2f4111760
        • MD5 SHA1 SHA512 SSDEEP TLSH