Analysis

  • max time kernel
    502s
  • max time network
    1596s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    27-05-2024 20:09

General

  • Target

    The.Escapists.v1.37/setup_the_escapists_1.37_jingle_cells_update_(37718).exe

  • Size

    84.1MB

  • MD5

    ae3173c7f315bebf96c37735d0f7c51b

  • SHA1

    568c29e3011e3e538981259d471c0c06e19da2dd

  • SHA256

    d3207d353bdd99cdeac1dd8754197ac518350f393a9a681a36afcfd02b88c872

  • SHA512

    37b00159e8b1d009d955451919c763e5b3f33d84a1c7ef2ee35a59881394b72fc951582fc5185881b7ff620bbaaac6384cc9b461c63de6e59127872ee749be98

  • SSDEEP

    1572864:LN53E6PAQ3T9QZTjhhNsPuK2XxsMV24Tt14eCzNpoE1oRxdshkkw2W/g02b95CL9:J5U6VT2hBlxs22Qt14hzWihkk0/d1L0K

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 15 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\The.Escapists.v1.37\setup_the_escapists_1.37_jingle_cells_update_(37718).exe
    "C:\Users\Admin\AppData\Local\Temp\The.Escapists.v1.37\setup_the_escapists_1.37_jingle_cells_update_(37718).exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4036
    • C:\Users\Admin\AppData\Local\Temp\is-FGIAK.tmp\setup_the_escapists_1.37_jingle_cells_update_(37718).tmp
      "C:\Users\Admin\AppData\Local\Temp\is-FGIAK.tmp\setup_the_escapists_1.37_jingle_cells_update_(37718).tmp" /SL5="$6014A,87655722,192512,C:\Users\Admin\AppData\Local\Temp\The.Escapists.v1.37\setup_the_escapists_1.37_jingle_cells_update_(37718).exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3816
      • C:\GOG Games\The Escapists\__redist\ISI\scriptInterpreter.exe
        "C:\GOG Games\The Escapists\__redist\ISI\scriptInterpreter.exe" /verysilent /supportDir="C:\GOG Games\The Escapists\__support" /SUPPRESSMSGBOXES /NORESTART /DIR="C:\GOG Games\The Escapists" /productId="1423221839" /buildId="53264075400579340" /versionName="1.37 Jingle Cells Update" /Language="English" /LANG="english"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2852
        • C:\Users\Admin\AppData\Local\Temp\is-OCSV6.tmp\scriptInterpreter.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-OCSV6.tmp\scriptInterpreter.tmp" /SL5="$20240,662929,192512,C:\GOG Games\The Escapists\__redist\ISI\scriptInterpreter.exe" /verysilent /supportDir="C:\GOG Games\The Escapists\__support" /SUPPRESSMSGBOXES /NORESTART /DIR="C:\GOG Games\The Escapists" /productId="1423221839" /buildId="53264075400579340" /versionName="1.37 Jingle Cells Update" /Language="English" /LANG="english"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:376
          • C:\Windows\SysWOW64\icacls.exe
            "C:\Windows\System32\icacls.exe" "C:\GOG Games\The Escapists" /grant Everyone:(OI)(CI)F
            5⤵
            • Modifies file permissions
            PID:4604
          • C:\Windows\SysWOW64\icacls.exe
            "C:\Windows\System32\icacls.exe" "C:\GOG Games\The Escapists" /grant Everyone:(OI)(CI)F
            5⤵
            • Modifies file permissions
            PID:1128
          • C:\Windows\SysWOW64\icacls.exe
            "C:\Windows\System32\icacls.exe" "C:\GOG Games\The Escapists\Data" /grant Everyone:(OI)(CI)F
            5⤵
            • Modifies file permissions
            PID:4600
          • C:\Windows\SysWOW64\icacls.exe
            "C:\Windows\System32\icacls.exe" "C:\GOG Games\The Escapists\Data" /grant Everyone:(OI)(CI)F
            5⤵
            • Modifies file permissions
            PID:1640
          • C:\Windows\SysWOW64\icacls.exe
            "C:\Windows\System32\icacls.exe" "C:\GOG Games\The Escapists\Data\images" /grant Everyone:(OI)(CI)F
            5⤵
            • Modifies file permissions
            PID:872
          • C:\Windows\SysWOW64\icacls.exe
            "C:\Windows\System32\icacls.exe" "C:\GOG Games\The Escapists\Data\images" /grant Everyone:(OI)(CI)F
            5⤵
            • Modifies file permissions
            PID:4556
          • C:\Windows\SysWOW64\icacls.exe
            "C:\Windows\System32\icacls.exe" "C:\GOG Games\The Escapists\Data\images\ground_SS.gif" /grant Everyone:(OI)(CI)F
            5⤵
            • Modifies file permissions
            PID:3380
          • C:\Windows\SysWOW64\icacls.exe
            "C:\Windows\System32\icacls.exe" "C:\GOG Games\The Escapists\Data\images\tiles_SS.gif" /grant Everyone:(OI)(CI)F
            5⤵
            • Modifies file permissions
            PID:3652
          • C:\Windows\SysWOW64\icacls.exe
            "C:\Windows\System32\icacls.exe" "C:\GOG Games\The Escapists\Data\Maps" /grant Everyone:(OI)(CI)F
            5⤵
            • Modifies file permissions
            PID:4704
          • C:\Windows\SysWOW64\icacls.exe
            "C:\Windows\System32\icacls.exe" "C:\GOG Games\The Escapists\Data\Maps" /grant Everyone:(OI)(CI)F
            5⤵
            • Modifies file permissions
            PID:428
          • C:\Windows\SysWOW64\icacls.exe
            "C:\Windows\System32\icacls.exe" "C:\GOG Games\The Escapists\Data\Maps\SS.map" /grant Everyone:(OI)(CI)F
            5⤵
            • Modifies file permissions
            PID:2244
          • C:\Windows\SysWOW64\icacls.exe
            "C:\Windows\System32\icacls.exe" "C:\GOG Games\The Escapists\Music" /grant Everyone:(OI)(CI)F
            5⤵
            • Modifies file permissions
            PID:4880
          • C:\Windows\SysWOW64\icacls.exe
            "C:\Windows\System32\icacls.exe" "C:\GOG Games\The Escapists\Music" /grant Everyone:(OI)(CI)F
            5⤵
            • Modifies file permissions
            PID:4652
          • C:\Windows\SysWOW64\icacls.exe
            "C:\Windows\System32\icacls.exe" "C:\GOG Games\The Escapists\Music\SS_sign1.ogg" /grant Everyone:(OI)(CI)F
            5⤵
            • Modifies file permissions
            PID:2216
          • C:\Windows\SysWOW64\icacls.exe
            "C:\Windows\System32\icacls.exe" "C:\GOG Games\The Escapists\Music\SS_sign2.ogg" /grant Everyone:(OI)(CI)F
            5⤵
            • Modifies file permissions
            PID:424
      • C:\GOG Games\The Escapists\TheEscapists.exe
        "C:\GOG Games\The Escapists\TheEscapists.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3328
        • C:\GOG Games\The Escapists\TheEscapists_eur.exe
          "C:\GOG Games\The Escapists\TheEscapists_eur.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          PID:5032
  • C:\Windows\System32\GameBarPresenceWriter.exe
    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
    1⤵
      PID:1096
    • C:\Windows\System32\GamePanel.exe
      "C:\Windows\System32\GamePanel.exe" 00000000000B01FE /startuptips
      1⤵
      • Checks SCSI registry key(s)
      PID:376
    • C:\Windows\System32\bcastdvr.exe
      "C:\Windows\System32\bcastdvr.exe" -ServerName:Windows.Media.Capture.Internal.BroadcastDVRServer
      1⤵
      • Drops desktop.ini file(s)
      • Checks processor information in registry
      PID:4480
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x3b4
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:592

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\GOG Games\The Escapists\Data\Custom maps.txt

      Filesize

      99B

      MD5

      38efdbad935f21a7151ac8906b496c92

      SHA1

      87c79b6f3120966b35becaef5a2bb3706bef1dc0

      SHA256

      d916291d18862e8d206a3b8a3d59de5aa7b60c13b804e7aa0d3de31f900e49d2

      SHA512

      bb4d25c4d57c244a272e65792db7552183190211fe1e3fc87d8bf532aa9b59af55916042725cf6136b1afbfb7eac49fd1e5df7aac634608bfdb0b46480a1e296

    • C:\GOG Games\The Escapists\Data\Custom speech.txt

      Filesize

      420B

      MD5

      f6610258de06d62e372fe95e736f386a

      SHA1

      8a09de09ece6fdadc0c11e85922d80a57c3aadd3

      SHA256

      928621576964cec08ad2ec2d4b0dc3ccfa4180a5fda6ac8165fda87980b9f950

      SHA512

      bac47efe1106c84865fac148644b517253150222e186744dccd2ae8c1ef13b83b8ef3c9031ed539104a66f7cb3c6a8340fdb52ef6c836e5f1fbd2573e1d29964

    • C:\GOG Games\The Escapists\Data\data_eng.dat

      Filesize

      45KB

      MD5

      023229c7ea0a33904cdee472990c8c20

      SHA1

      a48caf2b51b612e57b049b704bb7daed762b4e4b

      SHA256

      13b8bb9e59272f012aedcb0e79d7fa165844a40c76d5a16f6dc71a15cd4b7027

      SHA512

      85bbd018af64d281297c3c94f98bd42b0184998df903261eb0f21cdf64d5febe50529ed10c23f23811c845f9770ff443493312ecb5d73912328ea7c14ed71679

    • C:\GOG Games\The Escapists\Data\data_fre.dat

      Filesize

      49KB

      MD5

      35d59239d69f0f83ece6c33f213113fb

      SHA1

      a6366789fd9912f7d7e5052a48de071a090d620f

      SHA256

      8a478621f770ccceebbc8d7c980a2261b0ec7e929285e2501c9d048aa07e2caa

      SHA512

      c3dc48584e6f90126ac882db2d1a81abe9f2c40979d2a946b21938c1557a4aa8f4ecd4a9e66f47f70d7d7e2091d1a4f9b39645978fc4d6970f69c0f2e02e5ee2

    • C:\GOG Games\The Escapists\Data\data_ger.dat

      Filesize

      52KB

      MD5

      3484de14c031cb1fe218ea42843dec3d

      SHA1

      7e6355ef819047d6ba50a787d650be9d06ce8b93

      SHA256

      799f4804ec513ab8aab963c24a3667f02e9f2bf248f2261adc99f2a0fcf72e0b

      SHA512

      a2c2facd4aca3e7cffc07dd124f726dc9992be8ca53a60f196433a8e8aadd1eaac41fe252e95548eebcb53ec3edadcdf49944f959d391f618f6ce9022e23daa7

    • C:\GOG Games\The Escapists\Data\data_ita.dat

      Filesize

      51KB

      MD5

      c79bcd364ac5c38e5b9d852cdb6dc3dc

      SHA1

      6d452fd9ab5c8954c216826630c91eae913959c1

      SHA256

      17b233b97839d72c8c05c5adb435f08f68274d5181a37ac34c7b857b05cbcafb

      SHA512

      f403a5712a266956f5818a83b92e2be7c84c108f57211b38377e503077f8070c239d60c2fb327b2fb2364d2a9b5a599ffa02e16cb75d2da533c99cb70dd1b3cf

    • C:\GOG Games\The Escapists\Data\data_pol.dat

      Filesize

      97KB

      MD5

      cb6162c6fffbcc659a5c4c0ee6c8662b

      SHA1

      30fe96b048aec14dc4d017e6c26adc47208bf0f5

      SHA256

      9e0b0e81997ee78303e4e1c30ce3f7d0e58ecb65ea7ac199fa446e1a5a01aa08

      SHA512

      c5154d5db3fad6fcc1470ffd7941056c82663e84defd9bcdd0fb8d76ba941d6811adae229a7fbe94409742b38a6aad133ccaad5a4ab83c7064b29806c08dbabd

    • C:\GOG Games\The Escapists\Data\data_rus.dat

      Filesize

      95KB

      MD5

      9ee12d9f09a53e498bc1cc0cdff1cc5e

      SHA1

      2e67a1ab633a08b0f0de2e87d39204f96e1bb109

      SHA256

      dcd396c2746de9af1367bb119c69a533245c8fd7c2b589015a77b99c421b3479

      SHA512

      6cceda1e9d8e61325ef6937b8efd7792374303b3c38105a10fff905c8e02a6a440eb2dd776fa26efa0960c3c7575b4460049dbfd19639c02b19bbc401b5ffffc

    • C:\GOG Games\The Escapists\Data\data_spa.dat

      Filesize

      48KB

      MD5

      9c46bccc83e68f87d828ff59965b0486

      SHA1

      894dd27b7abd5dbb4c4dd45bd786d586a09a5e21

      SHA256

      4904ec109e82079384f523f9264a24752b21e7263c6d49dabd977990ccd1d794

      SHA512

      fac7adcd2642b67885f4bd48f7755cf664f4ee73aaf2c14bb1f824376efa42cc8078f3bd5585f157b6958cc5c0aa4678f137ab3fb1fb4cf7aebd89dcdbdbab5d

    • C:\GOG Games\The Escapists\Data\fonts\Escapists.ttf

      Filesize

      30KB

      MD5

      9246abe57e0915d5cc80d2af1ec47d25

      SHA1

      8eb1820b230ce0c0a719aa6afd0a0c06c996a084

      SHA256

      83a3c3cb0b1414d5b57fb06288590351e79db5ad027583a8d7ac45fe73926e8f

      SHA512

      a4a8915b5b733d9c6dbe126777122021b306e2b1b2fb55ed4a25bb598337aba67bf08a7dc0cd5ce8416ad83e0095232dfc292c47112ade316923adb4a7f1547b

    • C:\GOG Games\The Escapists\Data\images\custom\ground_cus_black.gif

      Filesize

      3KB

      MD5

      03852556b15aba4035e6999406ebd178

      SHA1

      320ea57fa0f34fb7c1901b6754f46b7c40c0a18a

      SHA256

      bbe6c2ec990c944bddf6df250cd97909eac176f35c7c37e31fcd6a153e3f12dc

      SHA512

      a11c9eaee632bfcf9ebe28f333d930b7aae9bb38f1cfafebf749d2c941cb3452eeccbc4f8781c51d19c80aff8b308e7f2ff5314d1b5f7c78532a10bc1648ea6c

    • C:\GOG Games\The Escapists\Data\images\custom\ground_cus_irongate.gif

      Filesize

      153KB

      MD5

      61fbffb6fd4495bb9197de785839ba0d

      SHA1

      becddd26730ca0781bb7da5e49f70754c9c31370

      SHA256

      814c38898ebff47e2885e39988bcc6ce350c36f8199d63230a297971e0816345

      SHA512

      c32dd6be5abddc101d2b9ffdd23f7e3d642d7081bc5d682f5a278d9023d064823416f86c6cf14f8a20dc895034a37b85f0de540be76a9c54d837d550ccd087c2

    • C:\GOG Games\The Escapists\Data\images\custom\ground_cus_jungle.gif

      Filesize

      362KB

      MD5

      c928d781e3f530e3a9190d4a9620188a

      SHA1

      02bfb71105b56ecfc14a9677a207c791fa96953c

      SHA256

      f3c0adf91d29107b2aa1181271d3ce925261559ac45fd8ec41b354acf6d9325b

      SHA512

      fb4235d1eae695b9165d23edbab2c6cc0e4973009a5c1d8ab15c311d22b46ee5959f5bcd01033f4066612439a42955f538c6e03145f1404b1c27e728aaa968e4

    • C:\GOG Games\The Escapists\Data\images\custom\ground_cus_perks.gif

      Filesize

      153KB

      MD5

      89bfa33c7aad58e4a4e8008e276a10a4

      SHA1

      15000518c6faf9e82db40d16e38a28f8e00a2e9a

      SHA256

      1297688a37e13e7cd8053dd7bd3e5f1f1add789d1f606962695b8680e7b013d9

      SHA512

      4bfe915c604d29f7eebace9012a533e1aae4ce486fecb810679150321414f9304edd401c1fca4ec2929289b64e8ad7e3149ff4e3b606761e95cfb808043ade8e

    • C:\GOG Games\The Escapists\Data\images\custom\ground_cus_sanpancho.gif

      Filesize

      153KB

      MD5

      9d92a91fe4e0ec35ed3d42a407e7c006

      SHA1

      567c5ef13f8fc9d04df95f21046189c46f7a379b

      SHA256

      28b3421ac7e0fb6d6ade9b90e59359760bfff44a7ff519cae7867e93f895541e

      SHA512

      9de793106d113c64ed1e51365b56ac98dc01b15c7726febb4b5b5089c799d311f72684494291be7f9a3d9651f4a18a6d75252d42394e4837b9f37218477d7fcf

    • C:\GOG Games\The Escapists\Data\images\custom\ground_cus_shanktonstatepen.gif

      Filesize

      153KB

      MD5

      651db8c97dfa05ffd8fbf704255c464e

      SHA1

      b6fe8b652c51418755485e9c91fd2fb032ce4b05

      SHA256

      451fe2a2564f6d58ff43535abf51da4a85d09c9ef4c0ad4fa817216c467e4bce

      SHA512

      a2dc70e0cc92099650c1dd8e5099276a5b5f2233995df9c0dc39ccf7184c705b1bcfbd10f2b9668b177372a7f60d6ac2f7e97adfc430b9323cc781bb1b89d490

    • C:\GOG Games\The Escapists\Data\images\custom\ground_cus_water.gif

      Filesize

      3KB

      MD5

      714b998c786305651e37d8ab22c33fd9

      SHA1

      552d93912154949ca396374efe5fcb745ec03933

      SHA256

      1a05ef6c4153d8e22f8591f7a2a5a137af98a78cc3086bca0c4ff10505f04903

      SHA512

      420db1c4b9c00f0ab982f60170d30c21e7dc80b2af7215359bb20c87c6a429048e392509e72f86652b7e420926bdfb2d73a556895c13350d950538e6864a33b4

    • C:\GOG Games\The Escapists\Data\images\custom\tiles_cus_irongate.gif

      Filesize

      11KB

      MD5

      8f280e6d16fcbdf4b24ae3b4d8d25fd8

      SHA1

      0e2cabb779ea8cce6f42ceb01ff8ba0a20ce5e71

      SHA256

      de4c62522882072d86c9691e16b6dd61751ab985c623740ffd5b9968ba841363

      SHA512

      50785be5eba29aebbdd47c1a80cc4a7285af31645ed978fe9806d3bdc0e34c44c1ead047c430f4afc3c1c5eac92ce34d06b1f049b1f209ec6d8827adfb50b057

    • C:\GOG Games\The Escapists\Data\images\custom\tiles_cus_jungle.gif

      Filesize

      12KB

      MD5

      9e9e7f371421e35835e645c0e7c7142c

      SHA1

      e8b77ed41ba2e8d60d2cf2bcd027ca262063888e

      SHA256

      1a9f74a354d11ae66265fddb5f6c2d8e3aa0e06288c9fc107f3ab8455483d332

      SHA512

      0fbb9545dfed1ba554e3d3c604abc2fb4ae7e35ed4f4ec7ce6ec8ca6d90c5cd3304823cd09e85ef0c39d0e1a16804ce2f2ce0fe361f85dd19b0bc6f719281733

    • C:\GOG Games\The Escapists\Data\images\custom\tiles_cus_perks.gif

      Filesize

      11KB

      MD5

      6048eef6da924558a7efeac791531dd8

      SHA1

      8f7335d429a9160abf262cb54c908b179374d3ae

      SHA256

      ce0b7eb2561618264da4ca60391e6a4c2541a9d7bde5fc65656f1d8ee5bb24a5

      SHA512

      149bb26fad70b8824729e556b54b4937d31b77121b60188f212e17c797517f2f70db1b92928f2de6b5551d92acde7e8f769b63eaa809f615fb9a262753ffea5c

    • C:\GOG Games\The Escapists\Data\images\custom\tiles_cus_sanpancho.gif

      Filesize

      10KB

      MD5

      77d0f2376d90bbe0165f64fb96eac0d3

      SHA1

      34a459af37c3b64269e66d65d731a9d101cf8dd7

      SHA256

      ecda733130da71850fff24deb8517e87db44f0fbc3efc0d10786638d3b204702

      SHA512

      3122c96a2a090e4de30f70d456d4110f571c10b8670f0617a5fbdc5f9da8df70a4169882eb0af1cfcac904bba05d2fce027427e701be83f74b33fe0108e9f471

    • C:\GOG Games\The Escapists\Data\images\custom\tiles_cus_shanktonstatepen.gif

      Filesize

      11KB

      MD5

      fb39075fc1eb6cfd7f9c73d1ba866a1a

      SHA1

      1fa7545240c91882f39915f609a995e1ca821408

      SHA256

      d6fa26379b069e83cf2f440f8c1792f8f5a6bc273d17e7e1fa99f9033817bc91

      SHA512

      0ee461771e70104ff558dc223d694e8ae0c0bb4c7fc93bcf196c043195a91b58f4e09875a474f2074bf379559d86ce8803cc67f189631fed63b36d55db30040d

    • C:\GOG Games\The Escapists\Data\images\custom\tiles_cus_stalagflucht.gif

      Filesize

      11KB

      MD5

      5ae9d9094bb74c20ff62b9029a28e924

      SHA1

      ab56dbba232925030c782d39c8e4a48877eaf7ff

      SHA256

      48dae631f36a1801b750f262f463ab65869c4aba4addeeef0f70a86b3f8b914a

      SHA512

      2018f0df27bb51e075427b87b429fef6414795dee0510a751fa4f332e7deb911b89067201f86371f2de54ca2de9cc76a0ac57e7e28b01aeec933e3c2ceff5d08

    • C:\GOG Games\The Escapists\Data\images\ground_BC.gif

      Filesize

      935KB

      MD5

      9a16fa479f88c5446f8bf39be3a28b62

      SHA1

      73348a17aa173be0df1b0964566c87956591d07d

      SHA256

      8da0ac7039334e0317e7d4ad2772f566ddb5c4d5ebb63e6e17249715db5661c0

      SHA512

      a564efbb331d367123775708577b5670457ad94522ed0d4bd53a7ce1fedebd1f34e933c8b64738e80f04c38734d42a4ac022f3c8549fa2996c910c8e21448873

    • C:\GOG Games\The Escapists\Data\images\ground_CCL.gif

      Filesize

      1.7MB

      MD5

      52c1d1dc57201cc68cfe5e3a3a6c6afe

      SHA1

      325483dfc3e9c51b8caaafd941dd570ebe891e91

      SHA256

      520c4b54f78fa36b0a0eb4b4e703e27f938f80f7773000093784d638a541eacb

      SHA512

      0565b80b124a0c4b7f1452aed4c08063c6e5a7ebc04ef3dcbf186c0ddae7f84ff910082b3495d6f72c4ac184bcec771c2e613a4eb023e1648e1bfe4064148899

    • C:\GOG Games\The Escapists\Data\images\ground_EA.gif

      Filesize

      64KB

      MD5

      e6685af25590548d3c7df24a20b898cf

      SHA1

      cca116af7f36bf7df7629cea05f631dcead9270d

      SHA256

      2be31470cbab1c2f95f2778a20d143e7e9edb42b6834558d3782f3e558590e31

      SHA512

      5f8e3ab617bdec3b0b8a8aef1a37865b805efba5487a1725584231afde1900ecefd1a7a3013df97b9843732bae621e2a4a684d4b9311ce9fb8a69c0c14c98aee

    • C:\GOG Games\The Escapists\Data\images\ground_TOL.gif

      Filesize

      581KB

      MD5

      94ff005c499c99d1227e60295ffde2f9

      SHA1

      80ec7aa38961aa6126a8b27e5296273967703c2c

      SHA256

      07a91e57a1eb9ac3e079fe4f4bec9bd4cd0fc04b9c58850b6959cabb9d9163d9

      SHA512

      b3bd6bfc2f68d297897895854a74d6f55ad08d829893c781388c92727ac17a88bb118c2abe7842200820dc6c7ecdcdea3f65f6d7fe9d70008b23b5e935e781f8

    • C:\GOG Games\The Escapists\Data\images\ground_alca.gif

      Filesize

      270KB

      MD5

      e1e376b42e56546e9395aaf788fc97d0

      SHA1

      dba0d1598ff4f7e12e0073e125ae453047c57d4a

      SHA256

      af3bd1b741778416c2d9265dad24d4fdef1f51f018728afaed639760d001f22f

      SHA512

      a8229f708266f5f7658e65a75871de6d3a894e7652b5ef8188a650dc76616904ff542e24d5aa1d511ab80549ef0c4b0f89927d63fe784b0481a58b0c142346db

    • C:\GOG Games\The Escapists\Data\images\ground_campepsilon.gif

      Filesize

      64KB

      MD5

      2c8727a7dd48df317caa9f97e55a38f3

      SHA1

      11f71c6fac4c9d77ff6828d99cf4efd9e696d943

      SHA256

      cff0ee0c335856a75681ce7576eba06d89cecc7b787255ef946d437e01b41d0a

      SHA512

      d9310e770111170130655c6c875e4771463b60a66e49c06ddc42e1365477a1e7c9efcc1437fb2300da4a7dad3204ff66964cff4dca2886777d9dd62bf08253a5

    • C:\GOG Games\The Escapists\Data\images\ground_irongate.gif

      Filesize

      64KB

      MD5

      88aec14082454ef475ec5ffeec5fd036

      SHA1

      9b36af43f808c779f50438eb594d8fe0110ed7b4

      SHA256

      69cffc57c41a78eac14f0f1b15ea14203070c0f9fdf182d4e340da97b5aa32ea

      SHA512

      5cc4c0e5c273a48e13853f8fe75e0fab8004771e1a6ed2bc5a9cd9e17b4597583975c80f3f83d57a719e9a473a15d893f126cdcf33d08fb8ec24af852a21070c

    • C:\GOG Games\The Escapists\Data\images\ground_jungle.gif

      Filesize

      154KB

      MD5

      965b37d9f8025adc81ae6060cc81c132

      SHA1

      52fdcb08a0ff27d77265d5ed2aa948f28d2eb20c

      SHA256

      d4ab1b3ccff2206d712bbbb9ff1e8adefe42b5040fb0d0c03850b9de93c33c33

      SHA512

      de8e3638ec20e0e913c9b5f32adcfbaa52f3df2c1b87ae62de4980d63e2efa41c1488cd329f7ae876f131417bcb3cafd7dec193a7d6bfd60724a76d4559a82c5

    • C:\GOG Games\The Escapists\Data\images\ground_pcpen.gif

      Filesize

      260KB

      MD5

      037dd9de79301ac09d2055be2d99a20d

      SHA1

      a6f88250aaee08403e76e68b278a0abb788b3c72

      SHA256

      763ddcb7201a3822cf7160752f729a10c9b7afac47c607a3f178c1956a8991b7

      SHA512

      63327b98deb104413695e3489945f575e9d1db41b65cdffa3139a79fd3aa77c8ec7a10a3cad97c3192c5f1d4c53c2575a456de5133017df4487bb28627fca348

    • C:\GOG Games\The Escapists\Data\images\ground_sanpancho.gif

      Filesize

      64KB

      MD5

      85e9b173983c498480b531c619ad4468

      SHA1

      c0b5d3139cfdd6bbca5f64b3650ddc814de0a0dd

      SHA256

      cad106b638367fe68a4606d015772536bae99ec3d217075a82f3b5f62061b7ea

      SHA512

      5a94daece27240c2e92726b1c081ec6299b4c1b702ce556c95465886a02d0247ed1f81e14bbdbe8c2145d242e51384afc775250b63673d838bef15dc5ed007a9

    • C:\GOG Games\The Escapists\Data\images\ground_stalagflucht.gif

      Filesize

      27KB

      MD5

      375dab4d82f4dbd244911dd8ab93f177

      SHA1

      db8df5655f1c65452ba80b453569ee6d1109eb3c

      SHA256

      f1ce294588020fd11b3e239c90c823d735a63cc9fb8cfb6d99e0a8fb707f1d96

      SHA512

      8a389ddec9836f7d1a88ba0a9360e36e142e42d02b21ae619d8fc01aada458c9ccc2832a051f9eb0a95a8b57b00f6b212d7b0fd7e0ee6ca0cbc3c8a2d78e5805

    • C:\GOG Games\The Escapists\Data\images\ground_tutorial.gif

      Filesize

      64KB

      MD5

      34d7be5506274be19ea6c2f3a7b89918

      SHA1

      58b0a3f1e75a907ff187344769a6cd3db131893e

      SHA256

      ecf5af0a2e17edbf72f3dff6b1d13ee014450c9c6c87a40790403da46b3f193f

      SHA512

      4e88df48d6e3d66c9e7f30a5a14b334cbbbd37f4f9c90f18b90e17a635da30d5b6ea96dfa197da6a776b06178be5d1b22c9e684589a1d357411b4e65485cd25f

    • C:\GOG Games\The Escapists\Data\images\soil.gif

      Filesize

      434KB

      MD5

      fb2d2d05ba554ef1c1d445aa2c59fbf8

      SHA1

      05dc57ccf2b1b47709350e590c2211a2ead6c2d8

      SHA256

      ac4ffd421ef56b70aaa1c83bd412a4312873d3b0090a506b9969e6d07cfb016f

      SHA512

      69a01804163b46addcd93eeb438ac698a982a7935007c65e8ca621abf98a0157110ea22456e83b880ef8d9fbbda9e70bbd37ccc3aee37c6c62fda9be022353a0

    • C:\GOG Games\The Escapists\Data\images\tiles_BC.gif

      Filesize

      12KB

      MD5

      c27853c370af1f1dc2af4c64b0304030

      SHA1

      b988e74c7e07370e2b80ea9d82a08de7ba8b716b

      SHA256

      59b978e715042f00ecf356d2e69f53d9ca4a191bc7ce9ff7919d8d52523b0c98

      SHA512

      905750afac91b82c829a2c30064d75e2d2f74cee98e727d971b7b89279f786b748f3a9112961af404a0b1c17b449d2127cfa8db41c11a207f84bcb386379ca24

    • C:\GOG Games\The Escapists\Data\images\tiles_alca.gif

      Filesize

      13KB

      MD5

      4950de4ea58951c914a9893a116cccca

      SHA1

      afe8d881a455415c850222cc9bd11cedc1e914a4

      SHA256

      61bf195f827176c0afd2a36dcd8d5652c36fbfab3475c007a010d14a6c877b51

      SHA512

      6b560f0fb43ae69a4db0f59740547cce88555b98007b04d534f4e2c40087b36782dbd4bae853402a7d6ee57d4efe249bbf0a4f8b0642f842d07501415051c6c0

    • C:\GOG Games\The Escapists\Data\images\tiles_tutorial.gif

      Filesize

      10KB

      MD5

      9628d73f9b0421c687e6760171cc7f32

      SHA1

      f30503b7b34e99612db8f928a12fe7f7ba4b6689

      SHA256

      45efbacef82a95879d4cc557f589d0249a1f014b155db7d5fd7b6e372390565d

      SHA512

      77f688d91291236faa3f55207dc002a90efc31141126daf8cc90aa6548a27c798e90bf3745bdc473f1067c78a27dc2ca69573c4c57c0b9438b49a7e4e94c690a

    • C:\GOG Games\The Escapists\Editor\editor_eur.exe

      Filesize

      3.1MB

      MD5

      db5af363733dc56396ddbac66876d335

      SHA1

      3b0cb20eab16022ff75b333dd98a174b181efc78

      SHA256

      e02b216666e14871815d4b881f01dc1646397fb36706e32e2216d578e3f78ade

      SHA512

      75ea574b1e70c49de7765c18b9c77af76831c2deee34c8f2e398e7af176f464e0d40624e57cbf7daf62375c1db705968e3069c614bbbc2fa862ca05152aa637e

    • C:\GOG Games\The Escapists\__redist\ISI\scriptinterpreter.exe

      Filesize

      1.2MB

      MD5

      c8aaca5f97815ab662436e5449aed17e

      SHA1

      4e47cbf558a813d102aee87284c404a02274eb0a

      SHA256

      d8667e94d5a9fe2d81e04df7e38f792bcf37aa727c24787014a51bd77fb19c65

      SHA512

      50e16042834a7ee6bd30b471142d17e526419b325c45b1f945323a01d773833a7011d9a820594515114043c06b6cfbebd7948778a6f6f6883b44680c13535f97

    • C:\GOG Games\The Escapists\__support\app\Data\images\ground_SS.gif

      Filesize

      65KB

      MD5

      ada42080bd7b46afcb8b0456ba8bf146

      SHA1

      307686901e6b373079bec6a1c56a89fe04cf8999

      SHA256

      7100dc7a094739ab8a443735414363030732181744042d90ef5f07422df5fd24

      SHA512

      e3d92859c65b07e745dc63a930bfbeff21fcc7ced0bdf7de1495ef2bb6315cf8008b5e5d735fd3ce0104e16fa27a7b85cabf73421eb0e3bd48c530bee21144c8

    • C:\GOG Games\The Escapists\__support\app\Data\images\tiles_SS.gif

      Filesize

      13KB

      MD5

      beb1af7216108b4f45a4587bd11e9c9e

      SHA1

      8a864286832cf0e7bbadc0b061bd597079f75c9e

      SHA256

      009bdf52f4eddde71a168888d4fe2589fe09af3eb1f18ae87a83c61064bcf44c

      SHA512

      56dd7eba12dd63345707b61bcc9697b34c0144fadddc3cfd3633fbeb9b4cd4098da586473447092f55041591410eed8ef6059d247bfceba35d4badb711da2044

    • C:\GOG Games\The Escapists\goggame-1423221839.info

      Filesize

      1011B

      MD5

      062ddfe5a7fbaf0114d1015447c34968

      SHA1

      7f4d82ad2ae38f7ef50cd6868c15705e77e48d8d

      SHA256

      a4f8bdb0927928893defaddaf885399f94041c0b03f9485014ceb5fc4fe28117

      SHA512

      29d5698c944e2ccd8e1164cdede997f0b60f47702c5a1d33cb8353c22bc1799dad08140ace301b15ac6742b0ceb7240cde8347625b8a82df8fc91c7b78578ebd

    • C:\GOG Games\The Escapists\goglog.ini

      Filesize

      547B

      MD5

      c2317ca26c5c9385fac4320cdadf6adc

      SHA1

      548fa4af62265e27668e1dee0fbf09c96756b19e

      SHA256

      f2d6c01c7e92aaf56fdab676a896ccfd76088a2ddbd9467c65d089effde45a57

      SHA512

      93b29b4e5aa8a8e00eb9eb301394cc44ef302cd4f55b49ff45d3771b5536f2248cb143837d7eee6c8c78c30b7018999d8fffab5fae3fe2eef2cb35459397f4f1

    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The Escapists [GOG.com]\Documents\Support.url

      Filesize

      131B

      MD5

      132cdc668a771d2536168f20ab8ba747

      SHA1

      a993df0973727fb934a15c982acad4c097c521ee

      SHA256

      3b2edde01132f084cb577edfadfefd0155696d60718fd37e6d9acc03e504c1b2

      SHA512

      e236217fbed54d731dd947dd0fc7421a2e536e1032664c21b534977a7c2b654f8b157566403dda0c117f6f3f95fb2b40e88b41f13be5f7d09a93877250908a84

    • C:\Users\Admin\AppData\Local\Temp\is-FGIAK.tmp\setup_the_escapists_1.37_jingle_cells_update_(37718).tmp

      Filesize

      1.3MB

      MD5

      f2e4dcb079a9aa8a00828b4fea52a7a5

      SHA1

      875c03c9655975a4e71e1b3f4e7c2a213aac363b

      SHA256

      ab71ca95b47486fdc7290e0e6fcfbbc88fd68e091b55658c53dcccf6656c92f4

      SHA512

      1acbbb812e032ea743239bc0cdedf36c1495f3d8172b17599e6b363bb6af7e55297a9643a9c20e70233948178082a9377bdf6489ee79cb16470217062bcbe5d0

    • C:\Users\Admin\AppData\Local\Temp\is-OCSV6.tmp\scriptInterpreter.tmp

      Filesize

      1.3MB

      MD5

      01190d8b6805fd4d2a68750fbd041966

      SHA1

      c5c967d47cc57112eec5fe7db0229b36e22ec661

      SHA256

      5761e7789d813626cd68ee1e62429cfeb92bdd814cd29ef12fc4ae9ec1dbaff3

      SHA512

      c079f1674f800bbcfe97d95e596314ba9f74bc7f87433dede4da91978c9ba9b1f0b22a4b690a07171983c46ac35e523a52df143072f700279914279de133957d

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\1455194518_english.jpg

      Filesize

      133KB

      MD5

      29edf0df2d161e5f80c97a83659a390e

      SHA1

      6fabcf7ff60e295d2acadd72789fab09ba0d1d7e

      SHA256

      a187c711d11ce3d53bc5d88d60a91a74ed3611cdc0579e2483357ee4bf76baf7

      SHA512

      5dfa9610d3038e3f9dbfb1aeaa99598454817f15e4dd6ded88b4c17d512de446f7e7fa14d2119c449fbe7ab3eb8b7324f2e4a0846ecfa25693421a1a78f4ec95

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\1459856152_english.jpg

      Filesize

      167KB

      MD5

      9939f7607d3ac47b5da5bc1323663efb

      SHA1

      9849afc48cb3d2dee0c18f2a9f04b3517b305788

      SHA256

      e8d8004a7d47507b41c5b06205f65d0d819a60485e673b3b22c034898bb8bcd3

      SHA512

      66e70a5b3badc1c85565a2c47cddec64172c5bb0268130f9f0df2d5b68450753404236297e1a994a8e524975a82d02295f0f1d4a82efd0bab76a8169112f02c3

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\1e\f2\1ef22d9e18698e40ccab3fbfde0b67db

      Filesize

      6.2MB

      MD5

      1ef22d9e18698e40ccab3fbfde0b67db

      SHA1

      34616e367e33c68004add02d0fe1377c91bf2d91

      SHA256

      b324a3f6b2d8f933dfd509d4758cdb9cc38cfd90b6ae4469517ae4841b65f247

      SHA512

      dbadb556019d68e8edbcbb9f51f7870b0df93c85c611cead5d3996decd9ed38cc6b1b6058b23221f06e33422bad21379e61561fd2494487e7a155acb23ecc668

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\2a\d2\2ad2e15e5afc5ee9bc216f84b97cf698

      Filesize

      6.3MB

      MD5

      2ad2e15e5afc5ee9bc216f84b97cf698

      SHA1

      da5bcfff5a7e81c046eedbca2bc20e6186e6cfb4

      SHA256

      5d6c964bc53e033d9408be4d6ebaede62f1456f1a4bafacb3d285e5e2b3d0b26

      SHA512

      cc860231ff29105fbd78f9b613358866a4315233d1b6543e7d20e99bb4a54cf62c6226a77ef84cf5e9eb15fdb8885664558daaf9694154b6b7b8d46f2a9c9ff8

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\42\31\42318a2781f3f653e4a21082597eceb2

      Filesize

      10KB

      MD5

      42318a2781f3f653e4a21082597eceb2

      SHA1

      c90bc1d269869a2a70381e46526d9a4983e7de7c

      SHA256

      a688d29650f4900af3162123b938fa0bf5bb6723cb9fdfb6bb938c2c9bb192e6

      SHA512

      c599f9dfd52d38444df997be4cd4940eac453fc27f78d15a1cb783054aef106db09a1608eea3b4d7da3f8bc349c8848c6ca15d60da907434c583130d7ed3ba8d

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\4d\da\4ddaa64b4be3891db6140185ce032834

      Filesize

      2.1MB

      MD5

      4ddaa64b4be3891db6140185ce032834

      SHA1

      cfe17851df5da499c1de6807b629502850502551

      SHA256

      d4777ee9d196ad05ac0fe9c0a48349dd37904e442cd8fb8bea3b989a581940bf

      SHA512

      0f91eadb2b35324f8aeabe6463fa5693354f6b16a523620aba063bfa886e2a80893e78afb6f5df89526ab8d79a688a6efef60bcd3352b277ad8e3f539ff857ce

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\5e\44\5e4402d5711b0fe54b06376e2935569f

      Filesize

      152KB

      MD5

      5e4402d5711b0fe54b06376e2935569f

      SHA1

      fa530e304a19b24c40905af1ff732092107a7f5b

      SHA256

      d9e86f5abe35b48765a09f6a0d03135d223b1149fcf50edd032656d1b6d6ef85

      SHA512

      4fbfcd46de87c8e5f8b422668b62f5f16fc8b5559e30b632bd477706ae3dd482e7397a73aeab96ee3086425472a6ae9f2b075e7bb076f145939e67afa4d30aa1

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\90\ff\90fffcdf27ea8e6147c6195edc773bb9

      Filesize

      432KB

      MD5

      90fffcdf27ea8e6147c6195edc773bb9

      SHA1

      be8a0952b2af611abe88cbeea516bce808f3d904

      SHA256

      c9ab51c87e7ff9261e221c9a4466465d36a7152702f5b138bffc1c0c4e62e4f2

      SHA512

      d80defb238328e2318c198f8b25b3a57d26208bd02631d2ea30e037910f8e2cf0c02daf1967ec7bc006f0b630ceda26e974a118e2338c2a88ff7fbb43f9e95e2

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\BigOK.png

      Filesize

      3KB

      MD5

      5b43a5d975a53f4fc1da67ce9f7784c1

      SHA1

      8543fa1e471030049942252b23cb22e0880c3af5

      SHA256

      59d8bb3e87a89ef523c0495addce38d69560af42aaa82f56dd41b12e6612c13a

      SHA512

      5dd5c4e9859a555a4a32da76f5231b44f7556274c6501da530b2cdd570bcb4675f710bee708322a40ed3ef9280c0d652b4e7ef0e9eaf128c08534f59291917f5

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\EULAAccepted.png

      Filesize

      2KB

      MD5

      461dfeb75927bdb39f9db5348612a611

      SHA1

      b7893b1fff6801e37ee7337d876962a09184941e

      SHA256

      0de278f5ca6d8570d9bda592268a14a28b87d3631fea2d25721947397aaab79c

      SHA512

      68528cf45c81c2c024a672f42c2cd6d4f72c015b443f103ca21deb8ee2bec4f4027490e7f33b5338a87537b5bf7f255f2828aed149f622155ec89cc81687651b

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\EULAShow.png

      Filesize

      1KB

      MD5

      c596bc9111edc702bbbb29b70984254f

      SHA1

      d4712c7b91ff4f8994e7907d31357c42eb47c738

      SHA256

      6112851daea2aaa7174e8cfac4a0f61c968bc090342503804c476eff47cc2462

      SHA512

      db50d0a39ec644873a03d64552fff1776cc94f016e8dfc8918e65aee94f7529a6de4637567b5e65c4ea988f3775785c4b52c2d96fe8dbc52b1e21ff59c737c2a

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\GOG_new.png

      Filesize

      3KB

      MD5

      d5b63bdfa47ef5954917c148bacf7b13

      SHA1

      5302c6715d9e9b5d2768b130f3e516e175684cc9

      SHA256

      0804b385c1736e009fe8c3b1b14085b9b9abb40ce487360002ab4a8f3505f4e0

      SHA512

      b5cde681be9ad1c1211559dc4b363003bf547e8dc965dbb9560fdddfc28ee1d8f27cc534dd00864d800fd351c48694d7dc8df55fc3d8d69acf8b702c7b421aa9

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\OpenSans-Regular.ttf

      Filesize

      212KB

      MD5

      629a55a7e793da068dc580d184cc0e31

      SHA1

      3564ed0b5363df5cf277c16e0c6bedc5a682217f

      SHA256

      e64e508b2aa2880f907e470c4550980ec4c0694d103a43f36150ac3f93189bee

      SHA512

      6c24c71bee7370939df8085fa70f1298cfa9be6d1b9567e2a12b9bb92872a45547cbabcf14a5d93a6d86cd77165eb262ba8530b988bf2c989fadb255c943df9b

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\a2\91\a29165c8b0579b1f27ad097c7dccd203

      Filesize

      61KB

      MD5

      a29165c8b0579b1f27ad097c7dccd203

      SHA1

      499489789b3abaa9df12419cf5bd7cff00c7c45e

      SHA256

      711f1457a4d36316d25b21a29e62934d20ad1ba1667414b9915d1f172c714c47

      SHA512

      136d5ce6d6ab2bf54b40aae7f7bf0fbd5c19b6ddccb7122dc837bfa820910bb00bdbed7546c131326d5e6df50506b0ba866a266a1bcb6d3e5c018f3f2c610e37

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\background.jpg

      Filesize

      356KB

      MD5

      050cdd8d35e9c9e3663e49af566aef47

      SHA1

      2f6ac2b2ad7f1d82d2317fec9b44ac6751d2d7cc

      SHA256

      529338d3cc15efe5a270ace9a266cab9e57dbf5a2975241742a346b19551b394

      SHA512

      d8c1ee4a0d3550e1687906b4ef1fb002880ef406c95c3c5ec7d843e6365114d8ef8850ae438226bc2067ac00d35c7da82640f5f39fcc08b8691b61653d534a81

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\btn_md5.png

      Filesize

      8KB

      MD5

      3befe9739354ee24a0b1ea8df05ce274

      SHA1

      ab0bda986a8c46aa19f57b75a2b7b22445a3c625

      SHA256

      b0193ab375f604fa4a25cabdea8f713babde1c07ab562ffc5679352c8e01db47

      SHA512

      ac016a59e0bfc9b22c376ae5d498c5660893a983d932b2bd502dabe032883c69e79ea8d93c2db49f95415c3cdb068e9f7d1d85527a4f9e68e065a989852d09dd

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\c1\eb\c1ebad9ef8f732c5cbc6bacd8686f0cb

      Filesize

      27KB

      MD5

      c1ebad9ef8f732c5cbc6bacd8686f0cb

      SHA1

      62d7e5cf6109b4c255a22949027f0b86fe199252

      SHA256

      d3f6317280dbcd39b5005457a62e5c82a00fe7a46ca9ed07a03f4d4ae30d74ac

      SHA512

      bfcc699cff13cab3f6bfca27f9b9b53129c098e080a8cd39989325525af34b8097443e7f587b1f6be07674f735f7eba8338afdb1d5a39c14ad7c80d55ffa306b

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\error.png

      Filesize

      726B

      MD5

      df10adc25b673e74e19971c17bee5a98

      SHA1

      ee16fb1cf9491f5e611282f0574b27d76fede412

      SHA256

      142b16dc6239421691fa6e619d1a61e61176d89fa018a88b46893c29a57aad8b

      SHA512

      dc3de10e0321966cbbfb2e57b3b41da6f26dff0c7233a47469da58775b5c471e6b5181e4d4ffc81ef8b83dbcad74ccc1aad7678518f99c9185a441d2a23e010f

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\error_icon.png

      Filesize

      1KB

      MD5

      263720c4b8bb111567a2a49989b8f467

      SHA1

      cf346fa3c70164648e0eaf72a37c6f4920ab4792

      SHA256

      acdf96ee4261fae138e6350a0ad50b367022ed5b908fa168baad92644f566ee8

      SHA512

      94f06a81dc735cf264abde86e6169e5fd78d873d2e926fd48287d2ac5208fc930c3c432186e3510add002bd1b4ae32ad8d35270b17c3ce5f18c43764a8e9de43

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\fc\a5\fca5d4668272666e18825f9168abf95f

      Filesize

      65KB

      MD5

      fca5d4668272666e18825f9168abf95f

      SHA1

      9db5defdeb95f9e3be2ec2e964cef9d94fe9f87c

      SHA256

      3e7999c54ef3ec6b09614e1456e3cb347ed4018fe74007f1582992cdf28758de

      SHA512

      45b865cf4923d1cb9fa1ca9f92868ee88bfc1ec511145f70d21245f19853c3b671216bf46ff8465221d58dc0f2e4f677cb8e27b250461ec0d1680250c8987ba2

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\ok.png

      Filesize

      1KB

      MD5

      103c1368e60806b1b7995a0894eacf87

      SHA1

      971392527f6e4b655044773132505c901a6b5469

      SHA256

      0d37d4421a39ca8852eb6760b8e914302bdc6cfcc7b170dc1b6c9bb9be148b7e

      SHA512

      652177e94438aff102f2ed873b26f0985ebed134763852b49b1ca2698463c1dbeb85152f19c8e18d397229ec5cb2cd1d17c61d454ab7c425a2cab540adc8228a

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\progress_center.png

      Filesize

      1KB

      MD5

      ad7fc1e37e40da38dd57adc446cc6c0e

      SHA1

      08033265deb9b45243cfa0065d98ffe13a039e26

      SHA256

      2b9dae87340e66b67ab1d8247d4a137628e324969f92fe1098f95a7c5bab2f43

      SHA512

      dd715d74f8e1ed6ab75b7b6530b383ac47040d8baa7728be160f6d230bf485a9cc54f15f7dc85b122ce56e54d63fa4890e510dfc89d9c9344e31f789ebac8756

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\progress_left.png

      Filesize

      1KB

      MD5

      290c7612ad7a077028cd3dc78ce99673

      SHA1

      18995fbe39d05e4a1cafc7cc2e0f6fb745442f77

      SHA256

      85e39d909a7300fa2043ec42818582867b981401264b14fc5408e477ae0b4668

      SHA512

      799841f5b8a1056e78a49c823009750e4b93af130a6c4ff9dc6d386c06b88614e53b46a6df62f5a217d5c99da01cf4e2fe8392c73d39e81000045291cf24205a

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\progress_right.png

      Filesize

      1KB

      MD5

      c25a41f022a74308d944d1e807d72f44

      SHA1

      83c6bbec3fb373fcc78ce0e737742100994cd6d4

      SHA256

      396a3351fe409328782ab138282cf9cec061a5a9540a3506700a620db1f54e7d

      SHA512

      d2f4449195f3e60c826cfabb52a083d829eb9d0509272977d8fdb33bc5214678949cd27d0594684594e0a3eda2351c39cec8d91923cb716ad144ccf2b966c8e6

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\slideshow.ini

      Filesize

      293B

      MD5

      f9148688e723add406b65ea6f9274180

      SHA1

      628909c523c8ca3f5e72d45b47bc46a89ac2d29b

      SHA256

      70ccd552cd44bee9074addb31eb8f688ac73f6539b55688c377a7bc7250de29f

      SHA512

      f27234e71028c1d5f0c20b6668f881ab3552170b28dc8402af606ecc4b8de0ba2c0e529b6a1cf35b851ccf3283c54ad4437ead3f72b9889cc17f5ffdbb431fc8

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\track_center.png

      Filesize

      1KB

      MD5

      3f2b0c22f8ea28dcbb82b39a16a039aa

      SHA1

      b3f4dfc2ea86fbdad05877b4c356b7fa8016731d

      SHA256

      794f9eeca7fd99846968376b76a296c927532cef1271325cbf555caa0d0d5860

      SHA512

      b4bf65d751717e85418947662d315ae3bcb177f60914832fefeeb95da9eddb75eb5531c62e5a5a70ff03c8a025b5a03e61ffbdecc9f483bea9684454ca9362d3

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\track_left.png

      Filesize

      1KB

      MD5

      55dacb00cbe2825a8540236c5777a205

      SHA1

      18a52ac6c741b558500fbc1716d46b4fe4471982

      SHA256

      a8340fb5380c922b60ea40043590dba067dcfed6e22636851691df38156a3aa8

      SHA512

      2ea444cc1080f20761c8d71d96fcd04ef48254cdc1dc41d1d139f459ea5613fe12f6e4bd026bf33a5c01ff038e72e05dae2f8fba33ff517dd395e1911f10ff10

    • C:\Users\Admin\AppData\Local\Temp\is-R04R8.tmp\track_right.png

      Filesize

      1KB

      MD5

      ddec70b6c49be3e8c3a7d01c2f6ff1c5

      SHA1

      5383271999f787c36b1dc8f3cc13c8407b195439

      SHA256

      f54cd6e42f2b2bc5cb8a15f6a28f1499abf094a519ebdf39f4c4e167312c9c16

      SHA512

      f43f94b194b5a7eafcec9e831f61042859c30e1af2e2447195bdd06b12c90982181161a1c1be5aa5223ff664f88e4891bd71cfffb7ef672d6fe4f614030e0e01

    • C:\Users\Admin\Documents\The Escapists\settings.cfg

      Filesize

      54B

      MD5

      3c6099cac96e538efce0497156cb22e0

      SHA1

      e1a97c7741ced5277b47f524afc6011d6f866f8c

      SHA256

      1ca0409edda92b1bde90449235007c3a93c3bdb0e8b6615d9774e9767f1a0320

      SHA512

      89c37869b16cdbb078392ff74a54e31030a10b5d97a640aa0308240a4b7b854d217d74c1b4a811539f336869ca68d5638f6cd171d472f4ace93f7ecb9e6e9cff

    • C:\Users\Admin\Videos\Captures\desktop.ini

      Filesize

      190B

      MD5

      b0d27eaec71f1cd73b015f5ceeb15f9d

      SHA1

      62264f8b5c2f5034a1e4143df6e8c787165fbc2f

      SHA256

      86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

      SHA512

      7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

    • \Users\Admin\AppData\Local\Temp\is-10QPH.tmp\idp.dll

      Filesize

      232KB

      MD5

      55c310c0319260d798757557ab3bf636

      SHA1

      0892eb7ed31d8bb20a56c6835990749011a2d8de

      SHA256

      54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

      SHA512

      e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

    • \Users\Admin\AppData\Local\Temp\is-10QPH.tmp\uninstall.dll

      Filesize

      712KB

      MD5

      f3a88277fc7e0c057c40e47a7e43f9ad

      SHA1

      78ae0052b323139a4de7a5361a40503a39339f4c

      SHA256

      d88bcf910e7a5ce4d76ca48b263ef226911b455d3a8db80c9fa69aeb2b3898a1

      SHA512

      3c40377600fbb814fe19423404d2fb29f6342ab2a3a6d5dc50f42086fc0f59174184a0870d7f04fb6ee5f84828e1ed282396bfcb70842084af25f5af15cc8a1f

    • \Users\Admin\AppData\Local\Temp\is-R04R8.tmp\botva2.dll

      Filesize

      35KB

      MD5

      0177746573eed407f8dca8a9e441aa49

      SHA1

      6b462adf78059d26cbc56b3311e3b97fcb8d05f7

      SHA256

      a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008

      SHA512

      d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a

    • \Users\Admin\AppData\Local\Temp\is-R04R8.tmp\crcdll.dll

      Filesize

      69KB

      MD5

      1d51fac9e2384eeb674199cfd5281d7d

      SHA1

      861dfdc121357d605d0cc3793266713788109eb2

      SHA256

      23e90ce5a1f2d634a7bf5d5d0522fafeea6df9e536e16f5ce91035d5197128ec

      SHA512

      921b00adfe43b883200960e8d0958d4e6b97f6d5cfc096ee277766a3e44cc7805a20877a4edf8bd4d9102bb71a20ac218a9a512f4f76bd751d3ef14f4e0a6eda

    • \Users\Admin\AppData\Local\Temp\is-R04R8.tmp\innocallback.dll

      Filesize

      63KB

      MD5

      1c55ae5ef9980e3b1028447da6105c75

      SHA1

      f85218e10e6aa23b2f5a3ed512895b437e41b45c

      SHA256

      6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

      SHA512

      1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

    • \Users\Admin\AppData\Local\Temp\is-R04R8.tmp\uninstall.dll

      Filesize

      691KB

      MD5

      7db706c324cc9b6fda497d081eed6e26

      SHA1

      ca97392e573af0cf61bfa3301801a85f2beea44c

      SHA256

      cc685dbcf798549ad1a51c1dde45462e2a451ec59f48ee91219182a3871cd5b0

      SHA512

      8edf1494d57d5e708faaff4170f21f435658be897a6fe0acf243ced0701a7fd574b3c973c5bc5e8d92815e966c98977e69ac1e3083ab00c11b072115527ffa19

    • memory/376-997-0x00000000010F0000-0x0000000001242000-memory.dmp

      Filesize

      1.3MB

    • memory/376-873-0x0000000002DD0000-0x0000000002E8B000-memory.dmp

      Filesize

      748KB

    • memory/2852-998-0x0000000000860000-0x0000000000899000-memory.dmp

      Filesize

      228KB

    • memory/2852-858-0x0000000000860000-0x0000000000899000-memory.dmp

      Filesize

      228KB

    • memory/3816-846-0x0000000000970000-0x0000000000AC2000-memory.dmp

      Filesize

      1.3MB

    • memory/3816-709-0x0000000004BD0000-0x0000000004CD0000-memory.dmp

      Filesize

      1024KB

    • memory/3816-143-0x0000000004E10000-0x0000000004EC7000-memory.dmp

      Filesize

      732KB

    • memory/3816-150-0x0000000000720000-0x0000000000721000-memory.dmp

      Filesize

      4KB

    • memory/3816-155-0x0000000002CC0000-0x0000000002CCE000-memory.dmp

      Filesize

      56KB

    • memory/3816-63-0x0000000002CC0000-0x0000000002CCE000-memory.dmp

      Filesize

      56KB

    • memory/3816-153-0x0000000002D60000-0x0000000002D75000-memory.dmp

      Filesize

      84KB

    • memory/3816-436-0x0000000004BD0000-0x0000000004CD0000-memory.dmp

      Filesize

      1024KB

    • memory/3816-848-0x0000000004E10000-0x0000000004EC7000-memory.dmp

      Filesize

      732KB

    • memory/3816-850-0x0000000004BD0000-0x0000000004CD0000-memory.dmp

      Filesize

      1024KB

    • memory/3816-12-0x0000000002D60000-0x0000000002D75000-memory.dmp

      Filesize

      84KB

    • memory/3816-885-0x0000000004BD0000-0x0000000004CD0000-memory.dmp

      Filesize

      1024KB

    • memory/3816-6-0x0000000000720000-0x0000000000721000-memory.dmp

      Filesize

      4KB

    • memory/3816-142-0x0000000002D60000-0x0000000002D75000-memory.dmp

      Filesize

      84KB

    • memory/3816-144-0x0000000002CC0000-0x0000000002CCE000-memory.dmp

      Filesize

      56KB

    • memory/3816-847-0x0000000002D60000-0x0000000002D75000-memory.dmp

      Filesize

      84KB

    • memory/3816-849-0x0000000002CC0000-0x0000000002CCE000-memory.dmp

      Filesize

      56KB

    • memory/3816-139-0x0000000002D80000-0x0000000002D81000-memory.dmp

      Filesize

      4KB

    • memory/3816-18-0x0000000004E10000-0x0000000004EC7000-memory.dmp

      Filesize

      732KB

    • memory/3816-141-0x0000000000970000-0x0000000000AC2000-memory.dmp

      Filesize

      1.3MB

    • memory/3816-1122-0x0000000000970000-0x0000000000AC2000-memory.dmp

      Filesize

      1.3MB

    • memory/4036-2-0x0000000000FA1000-0x0000000000FB2000-memory.dmp

      Filesize

      68KB

    • memory/4036-0-0x0000000000FA0000-0x0000000000FD9000-memory.dmp

      Filesize

      228KB

    • memory/4036-140-0x0000000000FA0000-0x0000000000FD9000-memory.dmp

      Filesize

      228KB

    • memory/4036-1123-0x0000000000FA0000-0x0000000000FD9000-memory.dmp

      Filesize

      228KB

    • memory/5032-1188-0x0000000000980000-0x0000000000994000-memory.dmp

      Filesize

      80KB

    • memory/5032-1215-0x0000000002880000-0x00000000028DD000-memory.dmp

      Filesize

      372KB

    • memory/5032-1220-0x00000000028E0000-0x00000000028EB000-memory.dmp

      Filesize

      44KB

    • memory/5032-1206-0x0000000002840000-0x0000000002851000-memory.dmp

      Filesize

      68KB

    • memory/5032-1201-0x0000000001010000-0x0000000001027000-memory.dmp

      Filesize

      92KB

    • memory/5032-1192-0x0000000000FC0000-0x0000000001003000-memory.dmp

      Filesize

      268KB

    • memory/5032-1265-0x0000000003820000-0x0000000003837000-memory.dmp

      Filesize

      92KB

    • memory/5032-1270-0x0000000003850000-0x0000000003864000-memory.dmp

      Filesize

      80KB

    • memory/5032-1277-0x0000000003890000-0x00000000038E3000-memory.dmp

      Filesize

      332KB

    • memory/5032-1282-0x0000000003900000-0x0000000003924000-memory.dmp

      Filesize

      144KB

    • memory/5032-1237-0x0000000002970000-0x0000000002988000-memory.dmp

      Filesize

      96KB

    • memory/5032-1234-0x0000000002960000-0x000000000296B000-memory.dmp

      Filesize

      44KB

    • memory/5032-1226-0x00000000028F0000-0x0000000002941000-memory.dmp

      Filesize

      324KB