Analysis

  • max time kernel
    150s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    12/09/2026, 11:45

General

  • Target
    CS_1.6_NextClient_2.5.3.exe
  • Size 252.9MB
  • Sample260912-nwtspsyvgx
  • SHA256 54f06128edbe1b031585fc0e5f428f0d58efbf1cec202165f360ae39566dfe65
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 41 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

    Inno Setup installer

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • cURL User-Agent 25 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Users\Admin\AppData\Local\Temp\CS_1.6_NextClient_2.5.3.exe
    "C:\Users\Admin\AppData\Local\Temp\CS_1.6_NextClient_2.5.3.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4576
    • C:\Users\Admin\AppData\Local\Temp\is-2OD94ZLJYO.tmp\CS_1.6_NextClient_2.5.3.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-2OD94ZLJYO.tmp\CS_1.6_NextClient_2.5.3.tmp" /SL5="$502EC,263582211,948224,C:\Users\Admin\AppData\Local\Temp\CS_1.6_NextClient_2.5.3.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4664
      • C:\Windows\SysWOW64\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="CS 1.6 NextClient c365c534" dir=in action=allow program="C:\games\CS 1.6 - NextClient\cstrike.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:708
      • C:\games\CS 1.6 - NextClient\cstrike.exe
        "C:\games\CS 1.6 - NextClient\cstrike.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2276
        • C:\games\CS 1.6 - NextClient\crashpad_handler.exe
          "C:\games\CS 1.6 - NextClient\crashpad_handler.exe" --no-rate-limit "--database=C:\games\CS 1.6 - NextClient\crashes" "--metrics-dir=C:\games\CS 1.6 - NextClient\crashes" --url=https://sentry.cs16nextclient.com:443/api/3/minidump/?sentry_client=sentry.native/0.13.3&sentry_key=d5683aac3be41375ad96f7e8b8032bc7 --attachment=nitro_api.log --attachment=setting_guard.ini --attachment=user_game_config.ini --attachment=launcher.log --attachment=platform\config\backend.json "--attachment=C:\games\CS 1.6 - NextClient\crashes\91d8d787-d4ed-4001-1a1c-4adf6afad47a.run\__sentry-event" "--attachment=C:\games\CS 1.6 - NextClient\crashes\91d8d787-d4ed-4001-1a1c-4adf6afad47a.run\__sentry-breadcrumb1" "--attachment=C:\games\CS 1.6 - NextClient\crashes\91d8d787-d4ed-4001-1a1c-4adf6afad47a.run\__sentry-breadcrumb2" --report-id=008b941e-30d9-4fcf-abeb-0ec8ce1f5930 --initial-client-data=0x3a4,0x3a8,0x3ac,0x390,0x3b0,0xdd3cdc,0xdd3cf4,0xdd3d04
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5372
  • C:\Windows\System32\GameBarPresenceWriter.exe
    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
    1⤵
    • Network Service Discovery
    PID:5280
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4784
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x4cc 0x314
    1⤵
      PID:5052

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          CS_1.6_NextClient_2.5.3.tmp

          • Path C:\Users\Admin\AppData\Local\Temp\is-2OD94ZLJYO.tmp\CS_1.6_NextClient_2.5.3.tmp
          • Size 4.2MB
          • SHA256 43e027ea9dd9abdef2d1d66b63c5a88d9e8c8a61a98798a045ad0362241f14bc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ISSkinU.dll

          • Path C:\Users\Admin\AppData\Local\Temp\is-ZUKJQYEN6V.tmp\ISSkinU.dll
          • Size 385KB
          • SHA256 ff1374abd93690f5e6e591bae23b49aacc8bbe8b7b05b539ec8aee755070a0e3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cs.png

          • Path C:\Users\Admin\AppData\Local\Temp\is-ZUKJQYEN6V.tmp\cs.png
          • Size 10KB
          • SHA256 8084cf13740debcea08ec69e5d396b9927844b0cbd1ebd074d7a4cdec09103bb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          isgsg.dll

          • Path C:\Users\Admin\AppData\Local\Temp\is-ZUKJQYEN6V.tmp\isgsg.dll
          • Size 34KB
          • SHA256 9eeef28d82fc4db7d1269dfbc0ea282768ce5e2e4e4bdc867d80d6847468dca7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          steam.cjstyles

          • Path C:\Users\Admin\AppData\Local\Temp\is-ZUKJQYEN6V.tmp\steam.cjstyles
          • Size 413KB
          • SHA256 bd371be89f5997694a224e8ff7121f0f6aa8893f31ab5bee7b6a3c32fb31d96a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          FileSystem_Proxy.dll

          • Path C:\games\CS 1.6 - NextClient\FileSystem_Proxy.dll
          • Size 123KB
          • SHA256 c3549bee35b92ed1961226c78b9294a78d5e95def6d76897a12108c2bfd317a8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          FileSystem_Stdio.dll

          • Path C:\games\CS 1.6 - NextClient\FileSystem_Stdio.dll
          • Size 122KB
          • SHA256 d73c38f0a90e04aedc66a20599faea2449aa345f6a124436ab655ecb02c151a2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          Mss32.dll

          • Path C:\games\CS 1.6 - NextClient\Mss32.dll
          • Size 436KB
          • SHA256 3231d251c8aa4003b3b23196fe849b97c5ea3ac2d3549980e83bceb9078b4cf7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          SDL2.dll

          • Path C:\games\CS 1.6 - NextClient\SDL2.dll
          • Size 637KB
          • SHA256 f1be4b46ac46bc9a26ae017c95711e5aedc11ed602908b62eface4e8d2b28aba
          • MD5 SHA1 SHA512 SSDEEP TLSH

          crashpad_handler.exe

          • Path C:\games\CS 1.6 - NextClient\crashpad_handler.exe
          • Size 818KB
          • SHA256 2b8991cf080750686455a35e2d82d197c9efc14870e55ad3282f17cee5a91dcc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cstrike.exe

          • Path C:\games\CS 1.6 - NextClient\cstrike.exe
          • Size 3.8MB
          • SHA256 48f786c16129a4ddeef6fc4799f18cef6afb91717e1db623f528060830e338c4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          GameUI.dll

          • Path C:\games\CS 1.6 - NextClient\cstrike\cl_dlls\GameUI.dll
          • Size 2.0MB
          • SHA256 4dd82aca646fd0b8137cffa8d116ab0f369e6048f569f4cbbbbbbf80f5cc88ad
          • MD5 SHA1 SHA512 SSDEEP TLSH

          client.dll

          • Path C:\games\CS 1.6 - NextClient\cstrike\cl_dlls\client.dll
          • Size 1.0MB
          • SHA256 ef7a0f40989cb79ba95d40f528534da36866892ee871147ca82e133b7a5edc3d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          client_mini.dll

          • Path C:\games\CS 1.6 - NextClient\cstrike\cl_dlls\client_mini.dll
          • Size 295KB
          • SHA256 5c10a4c8be25bd037072832bbaa0d4393c03c81786bfbc8f88298993866e55c5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-45NF150PMZ.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike\events\is-45NF150PMZ.tmp
          • Size 11B
          • SHA256 2092e6c9862b42fe817a552f0ecf05a58a2609b2424402404a796c325bdf2098
          • MD5 SHA1 SHA512

          is-N07UWX0NNY.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike\events\is-N07UWX0NNY.tmp
          • Size 9B
          • SHA256 89a0f0c5f04ea6da99b4a48fb642b968d32350aa3e6697da24d2736b7bb195d0
          • MD5 SHA1 SHA512

          is-D9S6AFL6TM.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike\gfx\env\is-D9S6AFL6TM.tmp
          • Size 192KB
          • SHA256 cdf4b2c96b5d1366fecdfa2aa764fcfc8d084bc5a682e2a10c41a03ed3ed3661
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-4M2TPXZKB4.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike\gfx\vgui\is-4M2TPXZKB4.tmp
          • Size 128KB
          • SHA256 4a2460747b60d4b5843bf22a459f6c17f16a9664305b4b4bda182041a0fdebfa
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-ERKQ2T3J7W.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike\gfx\vgui\is-ERKQ2T3J7W.tmp
          • Size 128KB
          • SHA256 9d8e087dd823e63f7009907ff1761e620dc5ee64db6a527e2d0ec830d4152437
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-VLTT6JM75Q.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike\gfx\vgui\is-VLTT6JM75Q.tmp
          • Size 128KB
          • SHA256 348584b23c63388045342dc0b79bdd37a8cff904a84215c386492e33273ab725
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-1P1T5GYANV.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike\resource\is-1P1T5GYANV.tmp
          • Size 6KB
          • SHA256 1d87dc6e0fb1b63996afc0d7b45a80243d3dc0df63ef9c712e9666caf64e8cc5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-PSQ2AMG5N1.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike\resource\schemes\is-PSQ2AMG5N1.tmp
          • Size 18KB
          • SHA256 364d625f62f19cdbb0e3ea49225de030852afe3cc78766ad6342a9e0375dcdbe
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-2YQVKOC3L7.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike\sound\weapons\is-2YQVKOC3L7.tmp
          • Size 10KB
          • SHA256 ffdaf0a862ce1f47615dc1ac59af868010796eeef50de895414c40a04da3680e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-3OYWOMMJ5H.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike\sound\weapons\is-3OYWOMMJ5H.tmp
          • Size 7KB
          • SHA256 616e07c58c0d3d332c3c7fe65c1b7e6ef49d5c26d09d8132d1e7c36c3899ea46
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-YKVPL60MZQ.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike\sound\weapons\is-YKVPL60MZQ.tmp
          • Size 14KB
          • SHA256 2ebbea31183105b5d305027e960bb89dc2e2582b81ba712b01b1851501b6092d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-QKRNEEKYXC.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike\sprites\is-QKRNEEKYXC.tmp
          • Size 361KB
          • SHA256 aae249f31605fdf3773d0753764dd4865873dca48a58108579923af755122fe5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-ISBC0OB49F.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike_hd\gfx\vgui\buy_presets\is-ISBC0OB49F.tmp
          • Size 128KB
          • SHA256 60fe19c7f1e2929356c9d26987e2ebd9878456c0797db579e3e56d4501c0b05c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-3MEWYN5736.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike_hd\gfx\vgui\is-3MEWYN5736.tmp
          • Size 128KB
          • SHA256 664264946b90b3ec23cf5e97c7096e60170e1a1c0a9b6bc4eb8c78633699af55
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-KIV608LYI6.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike_hd\gfx\vgui\is-KIV608LYI6.tmp
          • Size 64KB
          • SHA256 c07530ca596e9a10496f5774fc6fe9253e392600c3cfe77a6567d355d3f54a0f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hw.dll

          • Path C:\games\CS 1.6 - NextClient\hw.dll
          • Size 1.6MB
          • SHA256 be45f76049a133392423679d334c69c8e1e7e82dc873eebdd229ea0341ba1b10
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libcef.dll

          • Path C:\games\CS 1.6 - NextClient\libcef.dll
          • Size 19.4MB
          • SHA256 391b7e66004d7845f5caa7d70f106dac7d0b49538954c55601ed7b5985c3d699
          • MD5 SHA1 SHA512 SSDEEP TLSH

          next_engine_mini.dll

          • Path C:\games\CS 1.6 - NextClient\next_engine_mini.dll
          • Size 1.7MB
          • SHA256 c50507691f121558637c43cf97aac10a6a73a7e1eb68e907ca900af0f0147666
          • MD5 SHA1 SHA512 SSDEEP TLSH

          next_lib.dll

          • Path C:\games\CS 1.6 - NextClient\next_lib.dll
          • Size 15.1MB
          • SHA256 9d2e4f6576bad5c627781e4f8affad3993ddf00acf0fd8f2dfe1bc1b4ee5e7b4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nitro_api2.dll

          • Path C:\games\CS 1.6 - NextClient\nitro_api2.dll
          • Size 3.3MB
          • SHA256 3030913fcfc29ffeac9a9530bb581d4234107b5834d52a167ad28422c4073a29
          • MD5 SHA1 SHA512 SSDEEP TLSH

          serverbrowser.dat

          • Path C:\games\CS 1.6 - NextClient\platform\config\serverbrowser.dat
          • Size 155B
          • SHA256 4bbbdc23acd507a814c9169e902ced96dffb19f9d1694622aae399307cdad602
          • MD5 SHA1 SHA512 TLSH

          backend.json

          • Path C:\games\CS 1.6 - NextClient\platform\defaults\backend.json
          • Size 88B
          • SHA256 11a993b68e08e5704c98c12f7f0d768afa4be048ce9adff188e33bd84a0b923f
          • MD5 SHA1 SHA512 TLSH

          steam_api.dll

          • Path C:\games\CS 1.6 - NextClient\platform\steam\steam_api.dll
          • Size 101KB
          • SHA256 8c073e0d2ca39d1e986bec348f988303357be5c495ccf6e0415802b86eae3534
          • MD5 SHA1 SHA512 SSDEEP TLSH

          setting_guard.ini

          • Path C:\games\CS 1.6 - NextClient\setting_guard.ini
          • Size 7KB
          • SHA256 5eabc72df9dd3b3f2f29cd1a5e491f410d90c443bc3a8b590bc7298cd50d2568
          • MD5 SHA1 SHA512 SSDEEP TLSH

          steam_api.dll

          • Path C:\games\CS 1.6 - NextClient\steam_api.dll
          • Size 89KB
          • SHA256 223b5cb44c555583992b6c04ae54df38fb9c38164c68ea0e18ec0f43ba4cd142
          • MD5 SHA1 SHA512 SSDEEP TLSH

          steam_appid.txt

          • Path C:\games\CS 1.6 - NextClient\steam_appid.txt
          • Size 4B
          • SHA256 4593c89b4d60161d78fef3f48312d7833649b876a0c1d762cb5b9d73acaa0a20
          • MD5 SHA1 SHA512

          tier0.dll

          • Path C:\games\CS 1.6 - NextClient\tier0.dll
          • Size 331KB
          • SHA256 55e64559ba6acc4c0efc3bef92382714a6b9b8a4bd4696e8c920e709c803b250
          • MD5 SHA1 SHA512 SSDEEP TLSH

          user_game_config.ini

          • Path C:\games\CS 1.6 - NextClient\user_game_config.ini
          • Size 93B
          • SHA256 94ad85d776fc7275cc6878a44346e9a42d074ee8102739f5b023a626536e3ff0
          • MD5 SHA1 SHA512 TLSH

          is-119ZKJVXEJ.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\events\is-119ZKJVXEJ.tmp
          • Size 1KB
          • SHA256 2c7d43b8dc6ea01a32acddb7798b9dabf0ec44c7a6dcf75160539a7fe53e029d
          • MD5 SHA1 SHA512 TLSH

          1152_CommandMenu Text.tga

          • Path C:\games\CS 1.6 - NextClient\valve\gfx\vgui\fonts\1152_CommandMenu Text.tga
          • Size 34KB
          • SHA256 824ad8824e4d05319556d9c08dd0d4c90fecd6150a0dbcae8c946740cb4e2c56
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-1UHZI3V3CB.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\gfx\vgui\fonts\is-1UHZI3V3CB.tmp
          • Size 33KB
          • SHA256 4eb392f4136f1a4b255ab26772947e62b80615ca8b1ccea93563c3f33539a8bd
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-6JXTD2JQXG.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\gfx\vgui\fonts\is-6JXTD2JQXG.tmp
          • Size 40KB
          • SHA256 93eba9e5ba94654d73d76944cb9860e4fe8db92a6c734fcbc57864cb766caf1d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-A6HR7Z7EY0.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\gfx\vgui\fonts\is-A6HR7Z7EY0.tmp
          • Size 45KB
          • SHA256 f472485bdddb0f7acdce7ba6dfb1520dfdab6b2e870b37f77f61714533c5fe79
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-BM3AC74QSZ.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\gfx\vgui\fonts\is-BM3AC74QSZ.tmp
          • Size 24KB
          • SHA256 fad8e72511e03ea0b215e491da1ada731d7474a03d43c26a2f858c8fcee9beac
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-LEAV6CJEXP.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\gfx\vgui\fonts\is-LEAV6CJEXP.tmp
          • Size 44KB
          • SHA256 dff807e488eee92c3f841de1f330bac00b42c36e34320e6335ed6e5d926243a8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-RCENVLU3W7.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\gfx\vgui\fonts\is-RCENVLU3W7.tmp
          • Size 27KB
          • SHA256 60946960e36a56fe17b02ab7c618e3ca0d61b7412acbb9967271ff309a76b5e0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-XL8A7S7XI1.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\gfx\vgui\fonts\is-XL8A7S7XI1.tmp
          • Size 24KB
          • SHA256 3988ddbea3e6fd927933a698d28d66572d51e59938ea16624f644afe2021818d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-4EJC3JEIB6.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\gfx\vgui\is-4EJC3JEIB6.tmp
          • Size 1KB
          • SHA256 99986396ea8ebd9ab4eb1221b52db2a8a024e67c748e0b8080d8dad24e4e9cd2
          • MD5 SHA1 SHA512 TLSH

          is-YE987UAMHW.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\gfx\vgui\is-YE987UAMHW.tmp
          • Size 2KB
          • SHA256 1efacc8931f4e6558fc9f854527e25e004d8c3fd90f1f5209273236924a9241b
          • MD5 SHA1 SHA512 TLSH

          is-IZQBF7FDG3.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\models\is-IZQBF7FDG3.tmp
          • Size 22KB
          • SHA256 47b5e88f5cc25627e8dc76b85eb6ad64d8613b00838d0cca6a85f118af81c7b0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-XBFJHQP5H0.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\models\is-XBFJHQP5H0.tmp
          • Size 3KB
          • SHA256 748e6fb4465843238519d56774643c2d4fb3f77131ba49ee9ca2d700c42acb70
          • MD5 SHA1 SHA512 TLSH

          is-4WGC65UQ2X.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\sound\fvox\is-4WGC65UQ2X.tmp
          • Size 2KB
          • SHA256 0ffbcdb3466691fbc1043c69abe50434df646f997c52856a509de43cae501eee
          • MD5 SHA1 SHA512 TLSH

          is-O6DOEWGHRA.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\sound\plats\is-O6DOEWGHRA.tmp
          • Size 1KB
          • SHA256 5271b9aa2961809f47fadecb693be2eebde2dbed62fbc4f5f4889fcd8c4a65f8
          • MD5 SHA1 SHA512 TLSH

          is-ZD0GFEWTCP.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\sprites\is-ZD0GFEWTCP.tmp
          • Size 4KB
          • SHA256 5603d52c5f089950f372e2b00845738746abebaa2796b0b3e2f6d8d2f4111760
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vgui.dll

          • Path C:\games\CS 1.6 - NextClient\vgui.dll
          • Size 390KB
          • SHA256 f93e9f324c209118263b65644fa1f471e24a99dc3510c1763a733db9f3b01e91
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vstdlib.dll

          • Path C:\games\CS 1.6 - NextClient\vstdlib.dll
          • Size 323KB
          • SHA256 f8ce56ba4d4a0a8c1192d31736b4420efe0b8efcdb39805203e0344f290b3b04
          • MD5 SHA1 SHA512 SSDEEP TLSH

          game.tga

          • Path \??\c:\games\cs 1.6 - nextclient\cstrike\game.tga
          • Size 3KB
          • SHA256 44553a4188b7a4023aa83f2887c1c36bed8a159dcdd8f0571622c86f2599321f
          • MD5 SHA1 SHA512 TLSH

          liblist.gam

          • Path \??\c:\games\cs 1.6 - nextclient\cstrike\liblist.gam
          • Size 354B
          • SHA256 484b76def921c7be9e2150449919f3826d23208582b3b9428c1ad581bffb9b5b
          • MD5 SHA1 SHA512 TLSH

          800_1_a_loading.tga

          • Path \??\c:\games\cs 1.6 - nextclient\cstrike\resource\background\800_1_a_loading.tga
          • Size 192KB
          • SHA256 c55efedcae6fc7782889166b4727b7189bd6e9d721ffb1e1c9bfaec861f60f69
          • MD5 SHA1 SHA512 SSDEEP TLSH

          800_1_b_loading.tga

          • Path \??\c:\games\cs 1.6 - nextclient\cstrike\resource\background\800_1_b_loading.tga
          • Size 192KB
          • SHA256 7f36623408898201fa6ee836aa13c91a2d1436e0b846f2994fc7238bb255e0f0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          800_1_c_loading.tga

          • Path \??\c:\games\cs 1.6 - nextclient\cstrike\resource\background\800_1_c_loading.tga
          • Size 192KB
          • SHA256 80e9489996b9979c8565d1197a089adb12ae35592ff46fc63b960edfd109bb07
          • MD5 SHA1 SHA512 SSDEEP TLSH

          800_1_d_loading.tga

          • Path \??\c:\games\cs 1.6 - nextclient\cstrike\resource\background\800_1_d_loading.tga
          • Size 24KB
          • SHA256 c762fdd3e790069866aff6e4701707ce03dfe5f5012ffc75f8a47c897f306a3c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          800_2_a_loading.tga

          • Path \??\c:\games\cs 1.6 - nextclient\cstrike\resource\background\800_2_a_loading.tga
          • Size 192KB
          • SHA256 fe52e1f9ba55d2dcc780909af0ad800f165421c79ad3712ac64c8e1a59a783e1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          800_2_b_loading.tga

          • Path \??\c:\games\cs 1.6 - nextclient\cstrike\resource\background\800_2_b_loading.tga
          • Size 192KB
          • SHA256 5e00d24840241f8f92fe9bd6bb43095677d17294d727ab21dc16df728c1f58fb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          800_2_c_loading.tga

          • Path \??\c:\games\cs 1.6 - nextclient\cstrike\resource\background\800_2_c_loading.tga
          • Size 192KB
          • SHA256 0cf3b4414d91dc4bc61e460bb2ab99ab4bc7a2a357f0be625df3274704e799a8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          800_2_d_loading.tga

          • Path \??\c:\games\cs 1.6 - nextclient\cstrike\resource\background\800_2_d_loading.tga
          • Size 24KB
          • SHA256 6d7160deb904ef2f4ebbb6c9b1569630203c93ebce69d8ce204ffc57d05a55f7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          800_3_a_loading.tga

          • Path \??\c:\games\cs 1.6 - nextclient\cstrike\resource\background\800_3_a_loading.tga
          • Size 66KB
          • SHA256 30d02365383affb1baab87cc4be50fc20c91928bdad7a226c8740d059792c34e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          BackgroundLoadingLayout.txt

          • Path \??\c:\games\cs 1.6 - nextclient\valve\resource\BackgroundLoadingLayout.txt
          • Size 714B
          • SHA256 f1d2461e3936ab6397a852f4efb971ad807bea0c6c99ca8377886ccd88ada750
          • MD5 SHA1 SHA512 TLSH

          memory/4576-0-0x0000000000030000-0x0000000000126000-memory.dmp

          memory/4664-58-0x0000000074CF0000-0x0000000074E12000-memory.dmp

          memory/4664-169-0x0000000000400000-0x0000000000431000-memory.dmp

          memory/4664-16-0x0000000076F70000-0x0000000076FEA000-memory.dmp

          memory/4664-17-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/4664-18-0x0000000076F70000-0x0000000076FEA000-memory.dmp

          memory/4664-20-0x0000000076F70000-0x0000000076FEA000-memory.dmp

          memory/4664-21-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/4664-23-0x0000000077660000-0x0000000077685000-memory.dmp

          memory/4664-24-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/4664-25-0x0000000076F70000-0x0000000076FEA000-memory.dmp

          memory/4664-26-0x0000000077660000-0x0000000077685000-memory.dmp

          memory/4664-27-0x0000000074EB0000-0x0000000074EE0000-memory.dmp

          memory/4664-29-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/4664-30-0x0000000077660000-0x0000000077685000-memory.dmp

          memory/4664-34-0x0000000076240000-0x00000000767F3000-memory.dmp

          memory/4664-35-0x0000000077690000-0x0000000077773000-memory.dmp

          memory/4664-37-0x0000000074CF0000-0x0000000074E12000-memory.dmp

          memory/4664-38-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/4664-39-0x00000000760D0000-0x000000007617F000-memory.dmp

          memory/4664-40-0x0000000077410000-0x00000000774EC000-memory.dmp

          memory/4664-41-0x0000000076240000-0x00000000767F3000-memory.dmp

          memory/4664-42-0x0000000077690000-0x0000000077773000-memory.dmp

          memory/4664-43-0x0000000075610000-0x0000000075820000-memory.dmp

          memory/4664-44-0x0000000075960000-0x00000000759D4000-memory.dmp

          memory/4664-45-0x0000000074CF0000-0x0000000074E12000-memory.dmp

          memory/4664-46-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/4664-47-0x00000000760D0000-0x000000007617F000-memory.dmp

          memory/4664-48-0x0000000076240000-0x00000000767F3000-memory.dmp

          memory/4664-49-0x0000000075610000-0x0000000075820000-memory.dmp

          memory/4664-50-0x0000000075960000-0x00000000759D4000-memory.dmp

          memory/4664-51-0x0000000074CF0000-0x0000000074E12000-memory.dmp

          memory/4664-52-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/4664-54-0x0000000076240000-0x00000000767F3000-memory.dmp

          memory/4664-55-0x0000000075610000-0x0000000075820000-memory.dmp

          memory/4664-56-0x0000000077660000-0x0000000077685000-memory.dmp

          memory/4664-57-0x0000000075960000-0x00000000759D4000-memory.dmp

          memory/4664-59-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/4664-60-0x00000000760D0000-0x000000007617F000-memory.dmp

          memory/4664-61-0x0000000076240000-0x00000000767F3000-memory.dmp

          memory/4664-62-0x0000000075610000-0x0000000075820000-memory.dmp

          memory/4664-63-0x0000000075960000-0x00000000759D4000-memory.dmp

          memory/4664-64-0x0000000074CF0000-0x0000000074E12000-memory.dmp

          memory/4664-10416-0x00007FFF178F0000-0x00007FFF17AE5000-memory.dmp

          memory/4664-65-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/4664-66-0x00000000760D0000-0x000000007617F000-memory.dmp

          memory/4664-68-0x0000000076240000-0x00000000767F3000-memory.dmp

          memory/4664-69-0x0000000077690000-0x0000000077773000-memory.dmp

          memory/4664-70-0x0000000075610000-0x0000000075820000-memory.dmp

          memory/4664-71-0x0000000075960000-0x00000000759D4000-memory.dmp

          memory/4664-72-0x00000000753F0000-0x0000000075416000-memory.dmp

          memory/4664-73-0x0000000074CF0000-0x0000000074E12000-memory.dmp

          memory/4664-74-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/4664-75-0x0000000076240000-0x00000000767F3000-memory.dmp

          memory/4664-164-0x0000000000400000-0x0000000000431000-memory.dmp

          memory/4664-76-0x0000000075610000-0x0000000075820000-memory.dmp

          memory/4664-77-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/4664-78-0x0000000076240000-0x00000000767F3000-memory.dmp

          memory/4664-67-0x0000000077410000-0x00000000774EC000-memory.dmp

          memory/4664-53-0x00000000760D0000-0x000000007617F000-memory.dmp

          memory/4664-36-0x0000000075610000-0x0000000075820000-memory.dmp

          memory/4664-31-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/4664-33-0x00000000760D0000-0x000000007617F000-memory.dmp

          memory/4664-32-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/4664-28-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/4664-22-0x0000000076F70000-0x0000000076FEA000-memory.dmp

          memory/4664-19-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/4664-5-0x00007FFF178F0000-0x00007FFF17AE5000-memory.dmp