Analysis

  • max time kernel
    154s
  • max time network
    170s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/09/2026, 11:45

General

  • Target
    CS_1.6_NextClient_2.5.3.exe
  • Size 252.9MB
  • Sample260912-nwtspsyvgx
  • SHA256 54f06128edbe1b031585fc0e5f428f0d58efbf1cec202165f360ae39566dfe65
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 41 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

    Inno Setup installer

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • cURL User-Agent 27 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Users\Admin\AppData\Local\Temp\CS_1.6_NextClient_2.5.3.exe
    "C:\Users\Admin\AppData\Local\Temp\CS_1.6_NextClient_2.5.3.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1372
    • C:\Users\Admin\AppData\Local\Temp\is-HYO43GLOTI.tmp\CS_1.6_NextClient_2.5.3.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-HYO43GLOTI.tmp\CS_1.6_NextClient_2.5.3.tmp" /SL5="$E0060,263582211,948224,C:\Users\Admin\AppData\Local\Temp\CS_1.6_NextClient_2.5.3.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1424
      • C:\Windows\SysWOW64\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="CS 1.6 NextClient c365c534" dir=in action=allow program="C:\games\CS 1.6 - NextClient\cstrike.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:5640
      • C:\games\CS 1.6 - NextClient\cstrike.exe
        "C:\games\CS 1.6 - NextClient\cstrike.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5532
        • C:\games\CS 1.6 - NextClient\crashpad_handler.exe
          "C:\games\CS 1.6 - NextClient\crashpad_handler.exe" --no-rate-limit "--database=C:\games\CS 1.6 - NextClient\crashes" "--metrics-dir=C:\games\CS 1.6 - NextClient\crashes" --url=https://sentry.cs16nextclient.com:443/api/3/minidump/?sentry_client=sentry.native/0.13.3&sentry_key=d5683aac3be41375ad96f7e8b8032bc7 --attachment=nitro_api.log --attachment=setting_guard.ini --attachment=user_game_config.ini --attachment=launcher.log --attachment=platform\config\backend.json "--attachment=C:\games\CS 1.6 - NextClient\crashes\f0df16e7-b3ee-4631-2b0e-3470a09779b2.run\__sentry-event" "--attachment=C:\games\CS 1.6 - NextClient\crashes\f0df16e7-b3ee-4631-2b0e-3470a09779b2.run\__sentry-breadcrumb1" "--attachment=C:\games\CS 1.6 - NextClient\crashes\f0df16e7-b3ee-4631-2b0e-3470a09779b2.run\__sentry-breadcrumb2" --report-id=016b5de9-8f53-4f3b-6e14-5df44576cfcc --initial-client-data=0x42c,0x430,0x434,0x418,0x438,0xd23cdc,0xd23cf4,0xd23d04
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5028
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:2648
    • C:\Windows\System32\GameBarPresenceWriter.exe
      "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
      1⤵
      • Network Service Discovery
      PID:3416
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:5728
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
      1⤵
      • Drops desktop.ini file(s)
      • Checks processor information in registry
      • Modifies registry class
      PID:5900
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x0000000000000500 0x00000000000004FC
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4736

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          ga.sqlite3

          • Path C:\Users\Admin\AppData\Local\GameAnalytics\809491601ba9521b942761716c6294c0\ga.sqlite3
          • Size 32KB
          • SHA256 5248ce8d3f485b6949f6a6239bfca875378d3750d82026962352b106c12cc04f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ISSkinU.dll

          • Path C:\Users\Admin\AppData\Local\Temp\is-6LCD59Y1FA.tmp\ISSkinU.dll
          • Size 385KB
          • SHA256 ff1374abd93690f5e6e591bae23b49aacc8bbe8b7b05b539ec8aee755070a0e3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cs.png

          • Path C:\Users\Admin\AppData\Local\Temp\is-6LCD59Y1FA.tmp\cs.png
          • Size 10KB
          • SHA256 8084cf13740debcea08ec69e5d396b9927844b0cbd1ebd074d7a4cdec09103bb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          isgsg.dll

          • Path C:\Users\Admin\AppData\Local\Temp\is-6LCD59Y1FA.tmp\isgsg.dll
          • Size 34KB
          • SHA256 9eeef28d82fc4db7d1269dfbc0ea282768ce5e2e4e4bdc867d80d6847468dca7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          steam.cjstyles

          • Path C:\Users\Admin\AppData\Local\Temp\is-6LCD59Y1FA.tmp\steam.cjstyles
          • Size 413KB
          • SHA256 bd371be89f5997694a224e8ff7121f0f6aa8893f31ab5bee7b6a3c32fb31d96a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          CS_1.6_NextClient_2.5.3.tmp

          • Path C:\Users\Admin\AppData\Local\Temp\is-HYO43GLOTI.tmp\CS_1.6_NextClient_2.5.3.tmp
          • Size 4.2MB
          • SHA256 43e027ea9dd9abdef2d1d66b63c5a88d9e8c8a61a98798a045ad0362241f14bc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          desktop.ini

          • Path C:\Users\Admin\Videos\Captures\desktop.ini
          • Size 190B
          • SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
          • MD5 SHA1 SHA512 TLSH

          SDL2.dll

          • Path C:\games\CS 1.6 - NextClient\SDL2.dll
          • Size 637KB
          • SHA256 f1be4b46ac46bc9a26ae017c95711e5aedc11ed602908b62eface4e8d2b28aba
          • MD5 SHA1 SHA512 SSDEEP TLSH

          crashpad_handler.exe

          • Path C:\games\CS 1.6 - NextClient\crashpad_handler.exe
          • Size 818KB
          • SHA256 2b8991cf080750686455a35e2d82d197c9efc14870e55ad3282f17cee5a91dcc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cstrike.exe

          • Path C:\games\CS 1.6 - NextClient\cstrike.exe
          • Size 3.8MB
          • SHA256 48f786c16129a4ddeef6fc4799f18cef6afb91717e1db623f528060830e338c4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          client.dll

          • Path C:\games\CS 1.6 - NextClient\cstrike\cl_dlls\client.dll
          • Size 1.0MB
          • SHA256 ef7a0f40989cb79ba95d40f528534da36866892ee871147ca82e133b7a5edc3d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          client_mini.dll

          • Path C:\games\CS 1.6 - NextClient\cstrike\cl_dlls\client_mini.dll
          • Size 295KB
          • SHA256 5c10a4c8be25bd037072832bbaa0d4393c03c81786bfbc8f88298993866e55c5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          gameui.dll

          • Path C:\games\CS 1.6 - NextClient\cstrike\cl_dlls\gameui.dll
          • Size 2.0MB
          • SHA256 4dd82aca646fd0b8137cffa8d116ab0f369e6048f569f4cbbbbbbf80f5cc88ad
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-POLRL6RV1Q.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike\events\is-POLRL6RV1Q.tmp
          • Size 9B
          • SHA256 89a0f0c5f04ea6da99b4a48fb642b968d32350aa3e6697da24d2736b7bb195d0
          • MD5 SHA1 SHA512

          is-UMX00LZRFK.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike\events\is-UMX00LZRFK.tmp
          • Size 11B
          • SHA256 2092e6c9862b42fe817a552f0ecf05a58a2609b2424402404a796c325bdf2098
          • MD5 SHA1 SHA512

          is-PRCGYJKQZL.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike\gfx\env\is-PRCGYJKQZL.tmp
          • Size 192KB
          • SHA256 cdf4b2c96b5d1366fecdfa2aa764fcfc8d084bc5a682e2a10c41a03ed3ed3661
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-1C2ARV6QZN.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike\gfx\vgui\is-1C2ARV6QZN.tmp
          • Size 128KB
          • SHA256 9d8e087dd823e63f7009907ff1761e620dc5ee64db6a527e2d0ec830d4152437
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-4A6XYL3Y58.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike\gfx\vgui\is-4A6XYL3Y58.tmp
          • Size 128KB
          • SHA256 348584b23c63388045342dc0b79bdd37a8cff904a84215c386492e33273ab725
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-8VJ88LJP14.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike\gfx\vgui\is-8VJ88LJP14.tmp
          • Size 128KB
          • SHA256 4a2460747b60d4b5843bf22a459f6c17f16a9664305b4b4bda182041a0fdebfa
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-SYDE60YWYA.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike\resource\is-SYDE60YWYA.tmp
          • Size 6KB
          • SHA256 1d87dc6e0fb1b63996afc0d7b45a80243d3dc0df63ef9c712e9666caf64e8cc5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-GJGI2S6QH9.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike\resource\schemes\is-GJGI2S6QH9.tmp
          • Size 18KB
          • SHA256 364d625f62f19cdbb0e3ea49225de030852afe3cc78766ad6342a9e0375dcdbe
          • MD5 SHA1 SHA512 SSDEEP TLSH

          grenade_hit3.wav

          • Path C:\games\CS 1.6 - NextClient\cstrike\sound\weapons\grenade_hit3.wav
          • Size 10KB
          • SHA256 ffdaf0a862ce1f47615dc1ac59af868010796eeef50de895414c40a04da3680e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-479M09XMWA.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike\sound\weapons\is-479M09XMWA.tmp
          • Size 14KB
          • SHA256 2ebbea31183105b5d305027e960bb89dc2e2582b81ba712b01b1851501b6092d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-RO4B5VAHVU.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike\sound\weapons\is-RO4B5VAHVU.tmp
          • Size 7KB
          • SHA256 616e07c58c0d3d332c3c7fe65c1b7e6ef49d5c26d09d8132d1e7c36c3899ea46
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-KK53W1GW1T.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike\sprites\is-KK53W1GW1T.tmp
          • Size 361KB
          • SHA256 aae249f31605fdf3773d0753764dd4865873dca48a58108579923af755122fe5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-W7FCEK77CM.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike_hd\gfx\vgui\buy_presets\is-W7FCEK77CM.tmp
          • Size 128KB
          • SHA256 60fe19c7f1e2929356c9d26987e2ebd9878456c0797db579e3e56d4501c0b05c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-GZG9T6SKP8.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike_hd\gfx\vgui\is-GZG9T6SKP8.tmp
          • Size 128KB
          • SHA256 664264946b90b3ec23cf5e97c7096e60170e1a1c0a9b6bc4eb8c78633699af55
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-YWLKTQLO9V.tmp

          • Path C:\games\CS 1.6 - NextClient\cstrike_hd\gfx\vgui\is-YWLKTQLO9V.tmp
          • Size 64KB
          • SHA256 c07530ca596e9a10496f5774fc6fe9253e392600c3cfe77a6567d355d3f54a0f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          filesystem_proxy.dll

          • Path C:\games\CS 1.6 - NextClient\filesystem_proxy.dll
          • Size 123KB
          • SHA256 c3549bee35b92ed1961226c78b9294a78d5e95def6d76897a12108c2bfd317a8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          filesystem_stdio.dll

          • Path C:\games\CS 1.6 - NextClient\filesystem_stdio.dll
          • Size 122KB
          • SHA256 d73c38f0a90e04aedc66a20599faea2449aa345f6a124436ab655ecb02c151a2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hw.dll

          • Path C:\games\CS 1.6 - NextClient\hw.dll
          • Size 1.6MB
          • SHA256 be45f76049a133392423679d334c69c8e1e7e82dc873eebdd229ea0341ba1b10
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libcef.dll

          • Path C:\games\CS 1.6 - NextClient\libcef.dll
          • Size 19.4MB
          • SHA256 391b7e66004d7845f5caa7d70f106dac7d0b49538954c55601ed7b5985c3d699
          • MD5 SHA1 SHA512 SSDEEP TLSH

          mss32.dll

          • Path C:\games\CS 1.6 - NextClient\mss32.dll
          • Size 436KB
          • SHA256 3231d251c8aa4003b3b23196fe849b97c5ea3ac2d3549980e83bceb9078b4cf7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          next_engine_mini.dll

          • Path C:\games\CS 1.6 - NextClient\next_engine_mini.dll
          • Size 1.7MB
          • SHA256 c50507691f121558637c43cf97aac10a6a73a7e1eb68e907ca900af0f0147666
          • MD5 SHA1 SHA512 SSDEEP TLSH

          next_lib.dll

          • Path C:\games\CS 1.6 - NextClient\next_lib.dll
          • Size 15.1MB
          • SHA256 9d2e4f6576bad5c627781e4f8affad3993ddf00acf0fd8f2dfe1bc1b4ee5e7b4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nitro_api2.dll

          • Path C:\games\CS 1.6 - NextClient\nitro_api2.dll
          • Size 3.3MB
          • SHA256 3030913fcfc29ffeac9a9530bb581d4234107b5834d52a167ad28422c4073a29
          • MD5 SHA1 SHA512 SSDEEP TLSH

          serverbrowser.dat

          • Path C:\games\CS 1.6 - NextClient\platform\config\serverbrowser.dat
          • Size 156B
          • SHA256 cb7e3752e35b413ce254b3689d490ca608c7ae5c301d1974d658150c7c85504e
          • MD5 SHA1 SHA512 TLSH

          backend.json

          • Path C:\games\CS 1.6 - NextClient\platform\defaults\backend.json
          • Size 88B
          • SHA256 11a993b68e08e5704c98c12f7f0d768afa4be048ce9adff188e33bd84a0b923f
          • MD5 SHA1 SHA512 TLSH

          steam_api.dll

          • Path C:\games\CS 1.6 - NextClient\platform\steam\steam_api.dll
          • Size 101KB
          • SHA256 8c073e0d2ca39d1e986bec348f988303357be5c495ccf6e0415802b86eae3534
          • MD5 SHA1 SHA512 SSDEEP TLSH

          setting_guard.ini

          • Path C:\games\CS 1.6 - NextClient\setting_guard.ini
          • Size 7KB
          • SHA256 5eabc72df9dd3b3f2f29cd1a5e491f410d90c443bc3a8b590bc7298cd50d2568
          • MD5 SHA1 SHA512 SSDEEP TLSH

          steam_api.dll

          • Path C:\games\CS 1.6 - NextClient\steam_api.dll
          • Size 89KB
          • SHA256 223b5cb44c555583992b6c04ae54df38fb9c38164c68ea0e18ec0f43ba4cd142
          • MD5 SHA1 SHA512 SSDEEP TLSH

          steam_appid.txt

          • Path C:\games\CS 1.6 - NextClient\steam_appid.txt
          • Size 4B
          • SHA256 4593c89b4d60161d78fef3f48312d7833649b876a0c1d762cb5b9d73acaa0a20
          • MD5 SHA1 SHA512

          tier0.dll

          • Path C:\games\CS 1.6 - NextClient\tier0.dll
          • Size 331KB
          • SHA256 55e64559ba6acc4c0efc3bef92382714a6b9b8a4bd4696e8c920e709c803b250
          • MD5 SHA1 SHA512 SSDEEP TLSH

          user_game_config.ini

          • Path C:\games\CS 1.6 - NextClient\user_game_config.ini
          • Size 93B
          • SHA256 94ad85d776fc7275cc6878a44346e9a42d074ee8102739f5b023a626536e3ff0
          • MD5 SHA1 SHA512 TLSH

          is-PRJLDSH2L9.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\events\is-PRJLDSH2L9.tmp
          • Size 1KB
          • SHA256 2c7d43b8dc6ea01a32acddb7798b9dabf0ec44c7a6dcf75160539a7fe53e029d
          • MD5 SHA1 SHA512 TLSH

          is-20TMIKVHI0.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\gfx\vgui\fonts\is-20TMIKVHI0.tmp
          • Size 24KB
          • SHA256 fad8e72511e03ea0b215e491da1ada731d7474a03d43c26a2f858c8fcee9beac
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-4X2SUFGFGD.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\gfx\vgui\fonts\is-4X2SUFGFGD.tmp
          • Size 33KB
          • SHA256 4eb392f4136f1a4b255ab26772947e62b80615ca8b1ccea93563c3f33539a8bd
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-8WZ4UPIOBU.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\gfx\vgui\fonts\is-8WZ4UPIOBU.tmp
          • Size 44KB
          • SHA256 dff807e488eee92c3f841de1f330bac00b42c36e34320e6335ed6e5d926243a8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-A8R86VKJ32.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\gfx\vgui\fonts\is-A8R86VKJ32.tmp
          • Size 24KB
          • SHA256 3988ddbea3e6fd927933a698d28d66572d51e59938ea16624f644afe2021818d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-DBQO02OQ89.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\gfx\vgui\fonts\is-DBQO02OQ89.tmp
          • Size 34KB
          • SHA256 824ad8824e4d05319556d9c08dd0d4c90fecd6150a0dbcae8c946740cb4e2c56
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-QM0X7J8SRT.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\gfx\vgui\fonts\is-QM0X7J8SRT.tmp
          • Size 45KB
          • SHA256 f472485bdddb0f7acdce7ba6dfb1520dfdab6b2e870b37f77f61714533c5fe79
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-Y4HL932BT2.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\gfx\vgui\fonts\is-Y4HL932BT2.tmp
          • Size 27KB
          • SHA256 60946960e36a56fe17b02ab7c618e3ca0d61b7412acbb9967271ff309a76b5e0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-Z16JLTUQMF.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\gfx\vgui\fonts\is-Z16JLTUQMF.tmp
          • Size 40KB
          • SHA256 93eba9e5ba94654d73d76944cb9860e4fe8db92a6c734fcbc57864cb766caf1d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-LVETEV9RMD.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\gfx\vgui\is-LVETEV9RMD.tmp
          • Size 1KB
          • SHA256 99986396ea8ebd9ab4eb1221b52db2a8a024e67c748e0b8080d8dad24e4e9cd2
          • MD5 SHA1 SHA512 TLSH

          is-Z5EKMI2H54.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\gfx\vgui\is-Z5EKMI2H54.tmp
          • Size 2KB
          • SHA256 1efacc8931f4e6558fc9f854527e25e004d8c3fd90f1f5209273236924a9241b
          • MD5 SHA1 SHA512 TLSH

          is-SP39SNTSYP.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\models\is-SP39SNTSYP.tmp
          • Size 3KB
          • SHA256 748e6fb4465843238519d56774643c2d4fb3f77131ba49ee9ca2d700c42acb70
          • MD5 SHA1 SHA512 TLSH

          is-XW8WAME9JH.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\models\is-XW8WAME9JH.tmp
          • Size 22KB
          • SHA256 47b5e88f5cc25627e8dc76b85eb6ad64d8613b00838d0cca6a85f118af81c7b0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-QCWAH1I5ML.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\sound\fvox\is-QCWAH1I5ML.tmp
          • Size 2KB
          • SHA256 0ffbcdb3466691fbc1043c69abe50434df646f997c52856a509de43cae501eee
          • MD5 SHA1 SHA512 TLSH

          is-P2NA45FG6A.tmp

          • Path C:\games\CS 1.6 - NextClient\valve\sound\plats\is-P2NA45FG6A.tmp
          • Size 1KB
          • SHA256 5271b9aa2961809f47fadecb693be2eebde2dbed62fbc4f5f4889fcd8c4a65f8
          • MD5 SHA1 SHA512 TLSH

          spotlight04.spr

          • Path C:\games\CS 1.6 - NextClient\valve\sprites\spotlight04.spr
          • Size 4KB
          • SHA256 5603d52c5f089950f372e2b00845738746abebaa2796b0b3e2f6d8d2f4111760
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vgui.dll

          • Path C:\games\CS 1.6 - NextClient\vgui.dll
          • Size 390KB
          • SHA256 f93e9f324c209118263b65644fa1f471e24a99dc3510c1763a733db9f3b01e91
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vstdlib.dll

          • Path C:\games\CS 1.6 - NextClient\vstdlib.dll
          • Size 323KB
          • SHA256 f8ce56ba4d4a0a8c1192d31736b4420efe0b8efcdb39805203e0344f290b3b04
          • MD5 SHA1 SHA512 SSDEEP TLSH

          game.tga

          • Path \??\c:\games\cs 1.6 - nextclient\cstrike\game.tga
          • Size 3KB
          • SHA256 44553a4188b7a4023aa83f2887c1c36bed8a159dcdd8f0571622c86f2599321f
          • MD5 SHA1 SHA512 TLSH

          liblist.gam

          • Path \??\c:\games\cs 1.6 - nextclient\cstrike\liblist.gam
          • Size 354B
          • SHA256 484b76def921c7be9e2150449919f3826d23208582b3b9428c1ad581bffb9b5b
          • MD5 SHA1 SHA512 TLSH

          800_1_a_loading.tga

          • Path \??\c:\games\cs 1.6 - nextclient\cstrike\resource\background\800_1_a_loading.tga
          • Size 192KB
          • SHA256 c55efedcae6fc7782889166b4727b7189bd6e9d721ffb1e1c9bfaec861f60f69
          • MD5 SHA1 SHA512 SSDEEP TLSH

          800_1_b_loading.tga

          • Path \??\c:\games\cs 1.6 - nextclient\cstrike\resource\background\800_1_b_loading.tga
          • Size 192KB
          • SHA256 7f36623408898201fa6ee836aa13c91a2d1436e0b846f2994fc7238bb255e0f0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          800_1_c_loading.tga

          • Path \??\c:\games\cs 1.6 - nextclient\cstrike\resource\background\800_1_c_loading.tga
          • Size 192KB
          • SHA256 80e9489996b9979c8565d1197a089adb12ae35592ff46fc63b960edfd109bb07
          • MD5 SHA1 SHA512 SSDEEP TLSH

          800_1_d_loading.tga

          • Path \??\c:\games\cs 1.6 - nextclient\cstrike\resource\background\800_1_d_loading.tga
          • Size 24KB
          • SHA256 c762fdd3e790069866aff6e4701707ce03dfe5f5012ffc75f8a47c897f306a3c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          800_2_a_loading.tga

          • Path \??\c:\games\cs 1.6 - nextclient\cstrike\resource\background\800_2_a_loading.tga
          • Size 192KB
          • SHA256 fe52e1f9ba55d2dcc780909af0ad800f165421c79ad3712ac64c8e1a59a783e1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          800_2_b_loading.tga

          • Path \??\c:\games\cs 1.6 - nextclient\cstrike\resource\background\800_2_b_loading.tga
          • Size 192KB
          • SHA256 5e00d24840241f8f92fe9bd6bb43095677d17294d727ab21dc16df728c1f58fb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          800_2_c_loading.tga

          • Path \??\c:\games\cs 1.6 - nextclient\cstrike\resource\background\800_2_c_loading.tga
          • Size 192KB
          • SHA256 0cf3b4414d91dc4bc61e460bb2ab99ab4bc7a2a357f0be625df3274704e799a8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          800_2_d_loading.tga

          • Path \??\c:\games\cs 1.6 - nextclient\cstrike\resource\background\800_2_d_loading.tga
          • Size 24KB
          • SHA256 6d7160deb904ef2f4ebbb6c9b1569630203c93ebce69d8ce204ffc57d05a55f7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          800_3_a_loading.tga

          • Path \??\c:\games\cs 1.6 - nextclient\cstrike\resource\background\800_3_a_loading.tga
          • Size 66KB
          • SHA256 30d02365383affb1baab87cc4be50fc20c91928bdad7a226c8740d059792c34e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          BackgroundLoadingLayout.txt

          • Path \??\c:\games\cs 1.6 - nextclient\valve\resource\BackgroundLoadingLayout.txt
          • Size 714B
          • SHA256 f1d2461e3936ab6397a852f4efb971ad807bea0c6c99ca8377886ccd88ada750
          • MD5 SHA1 SHA512 TLSH

          memory/1372-0-0x00000000004F0000-0x00000000005E6000-memory.dmp

          memory/1424-85-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/1424-164-0x0000000000400000-0x0000000000431000-memory.dmp

          memory/1424-163-0x0000000003300000-0x0000000003301000-memory.dmp

          memory/1424-27-0x0000000076D40000-0x0000000076D65000-memory.dmp

          memory/1424-28-0x00000000748D0000-0x0000000074903000-memory.dmp

          memory/1424-18-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/1424-19-0x00000000769C0000-0x0000000076A3E000-memory.dmp

          memory/1424-20-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/1424-22-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/1424-23-0x00000000769C0000-0x0000000076A3E000-memory.dmp

          memory/1424-24-0x0000000076D40000-0x0000000076D65000-memory.dmp

          memory/1424-25-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/1424-26-0x00000000769C0000-0x0000000076A3E000-memory.dmp

          memory/1424-29-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/1424-30-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/1424-31-0x0000000076D40000-0x0000000076D65000-memory.dmp

          memory/1424-32-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/1424-60-0x00000000764C0000-0x0000000076571000-memory.dmp

          memory/1424-59-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/1424-65-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/1424-71-0x0000000075530000-0x00000000755B1000-memory.dmp

          memory/1424-74-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/1424-81-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/1424-99-0x0000000075530000-0x00000000755B1000-memory.dmp

          memory/1424-105-0x0000000075530000-0x00000000755B1000-memory.dmp

          memory/1424-39-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/1424-40-0x00000000764C0000-0x0000000076571000-memory.dmp

          memory/1424-37-0x0000000075190000-0x00000000753B7000-memory.dmp

          memory/1424-45-0x0000000075530000-0x00000000755B1000-memory.dmp

          memory/1424-47-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/1424-51-0x0000000075530000-0x00000000755B1000-memory.dmp

          memory/1424-53-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/1424-54-0x00000000764C0000-0x0000000076571000-memory.dmp

          memory/1424-57-0x0000000075530000-0x00000000755B1000-memory.dmp

          memory/1424-63-0x0000000075530000-0x00000000755B1000-memory.dmp

          memory/1424-72-0x0000000074ED0000-0x0000000074EF5000-memory.dmp

          memory/1424-77-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/1424-89-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/1424-91-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/1424-92-0x0000000075530000-0x00000000755B1000-memory.dmp

          memory/1424-94-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/1424-95-0x00000000764C0000-0x0000000076571000-memory.dmp

          memory/1424-100-0x0000000074ED0000-0x0000000074EF5000-memory.dmp

          memory/1424-102-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/1424-107-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/1424-108-0x00000000764C0000-0x0000000076571000-memory.dmp

          memory/1424-114-0x0000000074ED0000-0x0000000074EF5000-memory.dmp

          memory/1424-113-0x0000000075530000-0x00000000755B1000-memory.dmp

          memory/1424-115-0x00000000748D0000-0x0000000074903000-memory.dmp

          memory/1424-36-0x0000000076D70000-0x0000000076EC5000-memory.dmp

          memory/1424-38-0x0000000074700000-0x0000000074828000-memory.dmp

          memory/1424-41-0x00000000756D0000-0x00000000757B2000-memory.dmp

          memory/1424-42-0x0000000075D40000-0x000000007631C000-memory.dmp

          memory/1424-121-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/1424-122-0x00000000764C0000-0x0000000076571000-memory.dmp

          memory/1424-43-0x0000000076D70000-0x0000000076EC5000-memory.dmp

          memory/1424-154-0x0000000000400000-0x0000000000431000-memory.dmp

          memory/1424-44-0x0000000075190000-0x00000000753B7000-memory.dmp

          memory/1424-125-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/1424-48-0x00000000764C0000-0x0000000076571000-memory.dmp

          memory/1424-117-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/1424-35-0x0000000075D40000-0x000000007631C000-memory.dmp

          memory/1424-33-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/1424-34-0x00000000764C0000-0x0000000076571000-memory.dmp

          memory/1424-17-0x00000000769C0000-0x0000000076A3E000-memory.dmp

          memory/1424-21-0x00000000769C0000-0x0000000076A3E000-memory.dmp

          memory/1424-6-0x0000000003300000-0x0000000003301000-memory.dmp