Analysis

  • max time kernel
    153s
  • max time network
    168s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/11/2026, 06:51

General

  • Target
    CaptureGem-2.14.15-Windows-Setup.exe
  • Size 195.4MB
  • Sample261113-hmwcaagy3z
  • SHA256 850f4eddcb99414da70a7d9de279078046c1c4426d40b983ae517b9e945843a1
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 16 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Discovers running processes 1 TTPs 2 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

  • Detects Pyinstaller 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CaptureGem-2.14.15-Windows-Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\CaptureGem-2.14.15-Windows-Setup.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4104
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq CaptureGem.exe" | %SYSTEMROOT%\System32\find.exe "CaptureGem.exe"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1500
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq CaptureGem.exe"
        3⤵
        • Discovers running processes
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:988
      • C:\Windows\SysWOW64\find.exe
        C:\Windows\System32\find.exe "CaptureGem.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1844
  • C:\Users\Admin\AppData\Local\Programs\capturegem\CaptureGem.exe
    "C:\Users\Admin\AppData\Local\Programs\capturegem\CaptureGem.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3648
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq recorderd.exe" /NH"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1232
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq recorderd.exe" /NH
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:1300
    • C:\Users\Admin\AppData\Local\Programs\capturegem\CaptureGem.exe
      "C:\Users\Admin\AppData\Local\Programs\capturegem\CaptureGem.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\capturegem" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1452 --field-trial-handle=1620,i,1726241186473341780,15924648694291211736,131072 --disable-features=BlinkSchedulerMicroTaskQueuePerWindowAgent,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1400
    • C:\Users\Admin\AppData\Local\Programs\capturegem\CaptureGem.exe
      "C:\Users\Admin\AppData\Local\Programs\capturegem\CaptureGem.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --ignore-certificate-errors --ignore-certificate-errors --user-data-dir="C:\Users\Admin\AppData\Roaming\capturegem" --mojo-platform-channel-handle=1728 --field-trial-handle=1620,i,1726241186473341780,15924648694291211736,131072 --disable-features=BlinkSchedulerMicroTaskQueuePerWindowAgent,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      PID:3416
    • C:\Users\Admin\AppData\Local\Programs\capturegem\bin\recorderd.exe
      C:\Users\Admin\AppData\Local\Programs\capturegem\bin\recorderd.exe -http 28471 -ws 28472 -binDir C:\Users\Admin\AppData\Local\Programs\capturegem\bin -isChild -parentPort 28473
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of WriteProcessMemory
      PID:3184
      • C:\Users\Admin\AppData\Local\Programs\capturegem\bin\transcoder.exe
        C:\Users\Admin\AppData\Local\Programs\capturegem\bin\transcoder.exe -version
        3⤵
        • Executes dropped EXE
        PID:3988
    • C:\Users\Admin\AppData\Local\Programs\capturegem\CaptureGem.exe
      "C:\Users\Admin\AppData\Local\Programs\capturegem\CaptureGem.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\capturegem" --app-user-model-id=org.erb.CaptureGem --app-path="C:\Users\Admin\AppData\Local\Programs\capturegem\resources\app.asar" --enable-sandbox --first-renderer-process --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2864 --field-trial-handle=1620,i,1726241186473341780,15924648694291211736,131072 --disable-features=BlinkSchedulerMicroTaskQueuePerWindowAgent,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3956
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4104 -ip 4104
    1⤵
      PID:3096

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          LICENSE.electron.txt

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\LICENSE.electron.txt
          • Size 1KB
          • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
          • MD5 SHA1 SHA512 TLSH

          LICENSE.txt

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\LICENSE.txt
          • Size 2KB
          • SHA256 0f4ac0a77b43897a23edb7fdbc1b95389c94253d7938b6a1ee18403bbb89c7cd
          • MD5 SHA1 SHA512 TLSH

          README.txt

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\README.txt
          • Size 3KB
          • SHA256 618c81f84f84797c6f61beef887af8e45579f5b76a19bd136d962831acd7a884
          • MD5 SHA1 SHA512 TLSH

          TROUBLESHOOTING.txt

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\TROUBLESHOOTING.txt
          • Size 4KB
          • SHA256 3925386f8fa3f4e2ae179e8a0b3028fb7becdb5ae333f3269ac138500d88bbda
          • MD5 SHA1 SHA512 SSDEEP TLSH

          Uninstall CaptureGem.exe

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\Uninstall CaptureGem.exe
          • Size 129KB
          • SHA256 2a7b2a2fd91a449869dd6830ae96db185e1c2cf8738fbed5ebc8fac84c943cfb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          7za.dll

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\bin\7za.dll
          • Size 406KB
          • SHA256 af80aa034718b11cbd1edd10bbeebdf5e63cdf31ca7ea3dfd33ea053e4693c45
          • MD5 SHA1 SHA512 SSDEEP TLSH

          7za.exe

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\bin\7za.exe
          • Size 1.3MB
          • SHA256 574bb90d17732f3cc4145fd4ba12d8f29b9d63400881c0e6fe3110c88b0485de
          • MD5 SHA1 SHA512 SSDEEP TLSH

          7zxa.dll

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\bin\7zxa.dll
          • Size 212KB
          • SHA256 ac5a507af6aa9bde3c7580ad2834fef9aadd0170648d04fe85d38bcf49a67093
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libcurl-x64.def

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\bin\libcurl-x64.def
          • Size 2KB
          • SHA256 db4bdf56c8961da1c321fddf6dc1b97f5b1fd15b91424a4a0eb0452b7f51968e
          • MD5 SHA1 SHA512 TLSH

          libcurl-x64.dll

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\bin\libcurl-x64.dll
          • Size 3.5MB
          • SHA256 ed9efb9e88a76ce333a334ce11ba1ce49330db3be240d84de11ef09c342acaca
          • MD5 SHA1 SHA512 SSDEEP TLSH

          recorderd.exe

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\bin\recorderd.exe
          • Size 19.4MB
          • SHA256 e90514ea98912e86d4f6fe78e1ab8248bc48de61f198e144b02ff40148e7d294
          • MD5 SHA1 SHA512 SSDEEP TLSH

          streamlink.exe

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\bin\streamlink.exe
          • Size 26.6MB
          • SHA256 6eb42ea80d8528861c6dd4109e9c9533029cdbf9c6a12fde904be950ffb87fd5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          transcoder.exe

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\bin\transcoder.exe
          • Size 7.8MB
          • SHA256 4c898795f403e32dbdc968912017e39b812d3917add329574c723ed6af1e41bd
          • MD5 SHA1 SHA512 SSDEEP TLSH

          updater.exe

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\bin\updater.exe
          • Size 5.4MB
          • SHA256 2b66a1af6d2f432ef781f2404a2398b8f16457c22115c63701fb7f0e051bc3c4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          chrome_100_percent.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\chrome_100_percent.pak
          • Size 126KB
          • SHA256 2caa1da9b6a6e87bdb673977fee5dd771591a1b6ed5d3c5f14b024130a5d1a59
          • MD5 SHA1 SHA512 SSDEEP TLSH

          chrome_200_percent.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\chrome_200_percent.pak
          • Size 175KB
          • SHA256 07bee34e189fe9a8789aed78ea59ad41414b6e611e7d74da62f8e6ca36af01ce
          • MD5 SHA1 SHA512 SSDEEP TLSH

          d3dcompiler_47.dll

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\d3dcompiler_47.dll
          • Size 4.7MB
          • SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ffmpeg.dll

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\ffmpeg.dll
          • Size 2.7MB
          • SHA256 04bd8ee92194f076686eab2a94a119629b6d61e554782a0d4520359f1ceb24a9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          icudtl.dat

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\icudtl.dat
          • Size 10.1MB
          • SHA256 17d57b17d12dc5cfbf06413d68a06f45ccf245f4abdf5429f30256977c4ed6de
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libEGL.dll

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\libEGL.dll
          • Size 468KB
          • SHA256 53a2d4c5ae582f15aad481e75e516ddabce9b756e553bed33720a66d2c5f736d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libGLESv2.dll

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\libGLESv2.dll
          • Size 7.2MB
          • SHA256 51c9f2e9aecf5745ad343185cd39a05f581c2062d644bedcb25a5ef4b9624591
          • MD5 SHA1 SHA512 SSDEEP TLSH

          af.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\af.pak
          • Size 353KB
          • SHA256 0ad547bb1dc57907adeb02e1be3017cce78f6e60b8b39395fe0e8b62285797a1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          am.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\am.pak
          • Size 569KB
          • SHA256 fa1e44215bd5acc7342c431a3b1fddb6e8b6b02220b4599167f7d77a29f54450
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ar.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\ar.pak
          • Size 624KB
          • SHA256 00861d9fa5763cc5c3152edb4a5c956c6bc4f56311ce2ed9e6b496181624ab5e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bg.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\bg.pak
          • Size 652KB
          • SHA256 898621731ac3471a41f8b3a7bf52e7f776e8928652b37154bc7c1299f1fd92e1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bn.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\bn.pak
          • Size 838KB
          • SHA256 1ea245646a4b4386606f03c8a3916a3607e2adbbc88f000976be36db410a1e39
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ca.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\ca.pak
          • Size 400KB
          • SHA256 f7f54b55a917a0f68e4b7ed7a3e6feabb224c52d09786b939712607ebe8ab0ea
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cs.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\cs.pak
          • Size 409KB
          • SHA256 877a0a3dcb5d393365b2f775faff0d3593dd84b380a27dc72025597061a50ba7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          da.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\da.pak
          • Size 371KB
          • SHA256 40b32636ffb813574d8a063ce7e74860ab06b93a9b16dd56b5b6aa602b5e6943
          • MD5 SHA1 SHA512 SSDEEP TLSH

          de.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\de.pak
          • Size 397KB
          • SHA256 9c335a4e85b4ac58ed386d89d284be053ef288b2706a4cae433d91625ec1b31e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          el.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\el.pak
          • Size 712KB
          • SHA256 21d1d273124648a435674c7877a98110d997cf6992469c431fe502bbcc02641f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-GB.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\en-GB.pak
          • Size 324KB
          • SHA256 6b0e81b2198e025eae1e2f6d5d3a33ccce034d1f4bc59e4cade1b5f5adb99f1a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-US.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\en-US.pak
          • Size 326KB
          • SHA256 1d20e626444759c2b72aa6e998f14a032408d2b32f957c12ec3abd52831338fb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          es-419.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\es-419.pak
          • Size 395KB
          • SHA256 77114f519743741a488a9b57cdc7190f0507c37dc3b29811704a048172ba6736
          • MD5 SHA1 SHA512 SSDEEP TLSH

          es.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\es.pak
          • Size 394KB
          • SHA256 d539c88c4493cb1d9eae600611e3119fe129ec95149049f4b62fc3a97d78ca61
          • MD5 SHA1 SHA512 SSDEEP TLSH

          et.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\et.pak
          • Size 356KB
          • SHA256 c351b84558214420495bed6d882d37496483cc66b0e10400ca872e3fc4145b66
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fa.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\fa.pak
          • Size 577KB
          • SHA256 f9a8e3b9bbc809f11cc3dc32811940e033bd78a31ec154d28321473f8efa1e4d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fi.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\fi.pak
          • Size 365KB
          • SHA256 6581fca26336f66d8ba898ec1253b237db30e7cd1a25fc788290d7ace96fa6e1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fil.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\fil.pak
          • Size 410KB
          • SHA256 db4a63fa0d5b2baba71d4ba0923caed540099db6b1d024a0d48c3be10c9eed5a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fr.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\fr.pak
          • Size 426KB
          • SHA256 b62c51b85545b3f5d70ac9c684a111689044636eafaeb196f5d52760e0f96f91
          • MD5 SHA1 SHA512 SSDEEP TLSH

          gu.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\gu.pak
          • Size 812KB
          • SHA256 9c210e3143f99df59bebea6bdb6e30959f8520d59a20fffd437f7029840bb3a9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          he.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\he.pak
          • Size 507KB
          • SHA256 3cd4440501bc67d0b2e33e1346ba133fb9a09a8762f2334732f8cc349cd840b7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hi.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\hi.pak
          • Size 848KB
          • SHA256 ccf7a557d0f8353ff3d656d4c2a4fca2d462ed2cc3d18c599d98f4d57b23c615
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hr.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\hr.pak
          • Size 397KB
          • SHA256 6ea4b1a28cf567cca73ccdb7eec631fffba3b49acc41e3c88b448514578d80da
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hu.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\hu.pak
          • Size 427KB
          • SHA256 b59f932df822ab1a87e8aab4bbb7c549db15899f259f4c50ae28f8d8c7ce1e72
          • MD5 SHA1 SHA512 SSDEEP TLSH

          id.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\id.pak
          • Size 350KB
          • SHA256 0853a5543923b7a8db5989ebb8ebe8f9fb6271bfa59b94f5843f97de4401e2d8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          it.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\it.pak
          • Size 388KB
          • SHA256 d011fd39c3cbab740a7944a60a8dd48d6f76c563ea473cfd1f569c5e6fc9fa4e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ja.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\ja.pak
          • Size 472KB
          • SHA256 ba2acb635671a48ed0bf8cdc6e0a0318cfb33eb74b4171c6b483b95f2a167bc5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          kn.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\kn.pak
          • Size 938KB
          • SHA256 47c77fdf73267865a025a54027865a8d67e26943264a43c6e794ccbd6eec549b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ko.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\ko.pak
          • Size 398KB
          • SHA256 8d131066e2fa004e11f9128162bfc354d3254381059d6c852bf88a55859ae3e8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          lt.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\lt.pak
          • Size 429KB
          • SHA256 8a5d6e29833374e0f74fd7070c1b20856cb6b42ed30d18a5f17e6c2e4a8d783e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          lv.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\lv.pak
          • Size 427KB
          • SHA256 0ff66161377be2fb8b2b456a64dd910d8375a2b9f1f6f22333540a77111903d6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ml.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\ml.pak
          • Size 974KB
          • SHA256 27b7947e36a521403de094cc563d5eced1e46f98e4d6b872fd424352f798e84d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          mr.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\mr.pak
          • Size 797KB
          • SHA256 671c3cb2a805a63a275ad608d37d0577c6a2813dd67fb6c2b70f8232323aac04
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ms.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\ms.pak
          • Size 365KB
          • SHA256 c6471aee5f34f31477d57f593b09cb1de87f5fd0f9b5e63d8bab4986cf10d939
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nb.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\nb.pak
          • Size 358KB
          • SHA256 4f44789a2c38edc396a31aba5cc09d20fb84cd1e06f70c49f0664289c33cd261
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nl.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\nl.pak
          • Size 370KB
          • SHA256 b20178135b9f21feef0315fb2f2bc574c2876385e607a539ff0ce6ae7faf707b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pl.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\pl.pak
          • Size 412KB
          • SHA256 0948238576efb502327af4040c1d9eb1346fbf1bdcee35cd46746b170a7ea6a7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pt-BR.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\pt-BR.pak
          • Size 389KB
          • SHA256 7f41c3a58d08d98f21232e7c85839c9dec0053b447bb4dae867d2faadb278d45
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pt-PT.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\pt-PT.pak
          • Size 391KB
          • SHA256 60a5a7f03d4d54397ca04be0c89d1f67a496b72807c0bd660c076bc945b40339
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ro.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\ro.pak
          • Size 403KB
          • SHA256 3a58f2275ea6a2baa68924b1dab6b0f06abf8b6657a878dea94b0060a95e38f0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ru.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\ru.pak
          • Size 656KB
          • SHA256 e4edec80c9e29357bcf31eda5d8b046c6c9fbc6434a0b5594b6a906d5f1407d1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sk.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\sk.pak
          • Size 416KB
          • SHA256 b7ba1d08ac8498ea6a37186a51b30d6d0db17136ac734982af4dab97f4a6cd9a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sl.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\sl.pak
          • Size 401KB
          • SHA256 ab2079923e2baa27c220df2f1559af8edc785f8e9fe2e12c8ecb0e0e7e7d0a09
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sr.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\sr.pak
          • Size 616KB
          • SHA256 ab96a18177af90495e2e3c96292638a775aa75c1d210ca6a6c18fbc284cd815b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sv.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\sv.pak
          • Size 361KB
          • SHA256 e1cbce672de3ba3a01272b9b763dcfd8229fba0883df2b4117ac6b0f9916c073
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sw.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\sw.pak
          • Size 379KB
          • SHA256 41dfb772ae4c6f9e879bf7b4fa776b2877a2f8740fa747031b3d6f57f34d81dd
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ta.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\ta.pak
          • Size 964KB
          • SHA256 d5bfe0699342b8bba6c4c73c115b1c7f3f903c4ed95d77461c34369f2f60d5ee
          • MD5 SHA1 SHA512 SSDEEP TLSH

          te.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\te.pak
          • Size 894KB
          • SHA256 aa2b9d1ad8591e91872c3fee62b111b74d6e7e890a47d0bcc388947ae5245290
          • MD5 SHA1 SHA512 SSDEEP TLSH

          th.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\th.pak
          • Size 753KB
          • SHA256 3d4556bc0f26b89d090a8a779a8fda8f6fbe157a23181cbfb1d6c67a6212b864
          • MD5 SHA1 SHA512 SSDEEP TLSH

          tr.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\tr.pak
          • Size 385KB
          • SHA256 5a7e1c8b572f67ed40e9d5107ddd6f8791b03138bb9933cfb26f1678b2c4a9cd
          • MD5 SHA1 SHA512 SSDEEP TLSH

          uk.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\uk.pak
          • Size 657KB
          • SHA256 e914b8956745a14d9d64f12698805e0910f9d3581dd380468949b54576fad2a6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ur.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\ur.pak
          • Size 571KB
          • SHA256 3941364d0278e2c4d686faa4a135d16a457b4bc98c5a08e62aa12f3adc09aa7f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vi.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\vi.pak
          • Size 455KB
          • SHA256 ef3ddadb90dc73b73e25e9608626ce68d6778445812b8bd2f6c81e1f1e4bff16
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zh-CN.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\zh-CN.pak
          • Size 332KB
          • SHA256 539f0bfdb461bf777aab14a4baaf47c8c32ae1856cc4ac93b23ce73dc50ba02a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zh-TW.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\locales\zh-TW.pak
          • Size 330KB
          • SHA256 9689ba3f2dc7248a3ab5db3b97d473e29464afbc7f2d1c7035f7e8e9a1c05aa4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          resources.pak

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources.pak
          • Size 5.2MB
          • SHA256 d0e884b68e2b79162e88b5d4a593c3bb4a7c60c5c62f4e3cc69a346727e6f7eb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          app.asar

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\app.asar
          • Size 48.5MB
          • SHA256 137cb4c486acd40c2a3a8ca632ff25a7162507cd46800219d4de070dfb564e82
          • MD5 SHA1 SHA512 SSDEEP TLSH

          assets.d.ts

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\assets.d.ts
          • Size 623B
          • SHA256 d1688c0a786e3d9c4dd1a71178fcd06230eb5eba9cd64421015b98c170cdeec6
          • MD5 SHA1 SHA512 TLSH

          entitlements.mac.plist

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\entitlements.mac.plist
          • Size 409B
          • SHA256 c7b7130f408c529016104df93b48252d3bdc787083ae745a6d388ae3b7f7807f
          • MD5 SHA1 SHA512 TLSH

          icon.ico

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\icon.ico
          • Size 6KB
          • SHA256 7320dfcb689f5295500aa6d37b20e9f2a75e9dbe2ae815fd2b2f86b1cd6563b3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          icon.svg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\icon.svg
          • Size 387B
          • SHA256 0bd3d659595950dffca15ca0ebcb07937f8874192a59765e062dda6c299d8caf
          • MD5 SHA1 SHA512 TLSH

          1024x1024.png

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\icons\1024x1024.png
          • Size 27KB
          • SHA256 9cefe9e58e5546a3b377c56e5e918bea43cde0c8d984bf35c50acd9d89d330d9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          128x128.png

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\icons\128x128.png
          • Size 5KB
          • SHA256 e69a3c70ab5a05ca8f0cd0169f81acde38523fd30cac7792e43cdccdb0a98124
          • MD5 SHA1 SHA512 SSDEEP TLSH

          16x16.png

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\icons\16x16.png
          • Size 1KB
          • SHA256 5ca08eb81d02d4bd7743e66f6c31d5d8e8ea8192a45781d6cf49ec06695b32f3
          • MD5 SHA1 SHA512 TLSH

          24x24.png

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\icons\24x24.png
          • Size 1KB
          • SHA256 6a6b5fcdab36548bef3372079b4b3b1b6cc11cf077cd19f8a94dd4b66009cec2
          • MD5 SHA1 SHA512 TLSH

          32x32.png

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\icons\32x32.png
          • Size 1KB
          • SHA256 b806cb06bbc81d63b5d4e30c8a97afd11317f271fcafd3aa58c07d8741a50b52
          • MD5 SHA1 SHA512 TLSH

          48x48.png

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\icons\48x48.png
          • Size 2KB
          • SHA256 eaa05d996763970139b022a5aa47ee5185e3bd54cd8a2ee878d5e13c87760121
          • MD5 SHA1 SHA512 TLSH

          512x512.png

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\icons\512x512.png
          • Size 24KB
          • SHA256 2990a3d0c89983f3bec0e9f056a68c1c244350c125c3dd422aaae2a48d0501de
          • MD5 SHA1 SHA512 SSDEEP TLSH

          64x64.png

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\icons\64x64.png
          • Size 2KB
          • SHA256 b8e2da9fe749e91be57fc2ad5931a012f60fbd5a53d0fa184fd39ccd004dce84
          • MD5 SHA1 SHA512 TLSH

          96x96.png

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\icons\96x96.png
          • Size 4KB
          • SHA256 469ea42635839e18309c669be5a2b21c79761a6d9d4d18b619758d678445f031
          • MD5 SHA1 SHA512 SSDEEP TLSH

          installer.nsh

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\installer.nsh
          • Size 3KB
          • SHA256 c4247b93bc12e01bf214519eefa0dba83537ea0ba139f48cdd08eb516c3c906d
          • MD5 SHA1 SHA512 TLSH

          make_icons.sh

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\make_icons.sh
          • Size 1KB
          • SHA256 275f8d6bd6ee4d92ebf9ef8c5d58846757b0e4d0829e2e21d582dccd00e04ef0
          • MD5 SHA1 SHA512 TLSH

          old_icon.icns

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\old_icon.icns
          • Size 109KB
          • SHA256 6db2814c193690d44e7b7aa1c8e0949534315e2a7cba55f830c31f97a417de59
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_01.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\monitor\placeholder_01.jpg
          • Size 165KB
          • SHA256 b9eb9e229f2e26d56e5e35beaf9fe4b71551fa8571ab7d0a6e112064b2d69a06
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_02.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\monitor\placeholder_02.jpg
          • Size 180KB
          • SHA256 84d2a5dbd7537c0da771ce60b8574a2544e334cdd78d6be40fbffebd0c2fec54
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_03.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\monitor\placeholder_03.jpg
          • Size 139KB
          • SHA256 6b05b0c1dac0f7c7d4c221013af586f3c9750f0596d298890bc5ab2d647cf580
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_04.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\monitor\placeholder_04.jpg
          • Size 129KB
          • SHA256 eff0e8ad28696e900fc39c0de917bf967b43bdd01c2efed9df7d27c2f231ff12
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_05.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\monitor\placeholder_05.jpg
          • Size 141KB
          • SHA256 5d0537ee6205ea600cf5c24d9b8204584946553fb12b11ca7da39bafbe444624
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_06.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\monitor\placeholder_06.jpg
          • Size 173KB
          • SHA256 a73432ffeed3ad7e7ef891ea7b218c1e5323067f2683c6b0abfede1a880fc13a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_07.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\monitor\placeholder_07.jpg
          • Size 150KB
          • SHA256 8398bd8cc66bf13c373487fe1e54ac6bfdaca92f864bd30fc9b9ef1a84a33368
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_08.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\monitor\placeholder_08.jpg
          • Size 150KB
          • SHA256 3ee33fbb3e0e0e20388867825a1ffb6fbc382030869187ba4963cd63199f980d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_09.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\monitor\placeholder_09.jpg
          • Size 221KB
          • SHA256 3189ac16afa7d72eb3e1d0f22131a4d0f4498c50e71bff50b6153d4af87a75d2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_10.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\monitor\placeholder_10.jpg
          • Size 153KB
          • SHA256 bad244442313db9a1998021a402ad2255bc4043b8b4079762dae5c4da2fb2697
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_11.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\monitor\placeholder_11.jpg
          • Size 152KB
          • SHA256 fe4bafa7d6f35d3e42831ffdafe95656ee7e31d2083b0f9fd915a76142f40924
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_12.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\monitor\placeholder_12.jpg
          • Size 236KB
          • SHA256 b7e40553f1e8de1990fb4240b2850bc0671df8334da471cae8526131e0ce7ffa
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_13.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\monitor\placeholder_13.jpg
          • Size 200KB
          • SHA256 68a6c7c167b19accbd3298713f3f3ad2e8cf7cf460b8de8b9569b83080739509
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_14.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\monitor\placeholder_14.jpg
          • Size 151KB
          • SHA256 f06f4057c9c978cea209058ff9cb3ec3c8457a667004ec387ff3ad29ee1c352e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_15.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\monitor\placeholder_15.jpg
          • Size 122KB
          • SHA256 e5cb385d4429b4f4272d7ecd9981d05d26c6b0ebc742a802690fbfa622c46f1b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_16.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\monitor\placeholder_16.jpg
          • Size 189KB
          • SHA256 f854154ad3f1c52d7d6880a57d4f3cdc94e18bb88aa11d3c1b500cdb83495e26
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_17.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\monitor\placeholder_17.jpg
          • Size 148KB
          • SHA256 90b12104f60d8792c92ea126725b2aa946ce0bb0ee672a174d909d4c53224e1e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_01.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\review\placeholder_01.jpg
          • Size 251KB
          • SHA256 6f10db804da8ca579e39bc8def044f8d8be5976f05dea9cfee30de0f1f3e9ad5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_02.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\review\placeholder_02.jpg
          • Size 255KB
          • SHA256 d45035f10cc3aaf4dcc5dab505c377ea1655c3b59a16d908d449c3f6d5a63f42
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_03.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\review\placeholder_03.jpg
          • Size 258KB
          • SHA256 99963e59a5f701fc0fbdc0eef04c9a4696da22fb2afe93b74209de4d3168dc82
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_04.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\review\placeholder_04.jpg
          • Size 223KB
          • SHA256 5f9883bb07ac44d9d4e85c41189310467f935948fc729dcc0524356b37a0aef9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_05.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\review\placeholder_05.jpg
          • Size 293KB
          • SHA256 45194b76d7d4a8a7d9d4a52fd8c13668fc333b9335add95b6f9753d4de265450
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_06.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\review\placeholder_06.jpg
          • Size 303KB
          • SHA256 369daed5e1b8d004664e346f4569ad7e6751c86ed7dd3717c1b384f414db4146
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_07.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\review\placeholder_07.jpg
          • Size 252KB
          • SHA256 9dae949e86083837c56300120f9eb9cb9b6d6294c74a2febc570504abaf3e7f0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_08.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\review\placeholder_08.jpg
          • Size 273KB
          • SHA256 eb90739c46aa6d19e6e1e5ebef726f223fd0bceb64528f5ce57b05cfa22febbe
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_09.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\review\placeholder_09.jpg
          • Size 255KB
          • SHA256 a09e6104b28b3cd2ec765db93dc806c509a9fd991a4060d3b0711d9518d3aa6f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_10.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\review\placeholder_10.jpg
          • Size 246KB
          • SHA256 b591662b446b19a819ecc5b9eafa3b5f0e2a39a4e6cfcc32471bdfe837dcb311
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_11.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\review\placeholder_11.jpg
          • Size 355KB
          • SHA256 e2afa8ea7e690500db05624208c817202e0d48ad5927bf3bc4132c71ac7a1bc2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_12.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\review\placeholder_12.jpg
          • Size 265KB
          • SHA256 1edc89de54189b456a7aa70d1b80de2f20a5ce6fb8cda25c0a4d5408f5b1f4a1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_13.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\review\placeholder_13.jpg
          • Size 254KB
          • SHA256 73b9e80c5f56ff310cb1866c4a2708d3d1826c1fdbc946c6f2e7efcf9d57e5d9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          placeholder_14.jpg

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\assets\presentation\review\placeholder_14.jpg
          • Size 262KB
          • SHA256 0329733ea45746af0a458002a9426657a92231890f88bcb90996682ea0bad8e2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ar-corrected.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\ar-corrected.json
          • Size 1KB
          • SHA256 b9e01d6a80278644e6e185fc21dbc28fee626ddd28607bd862dad4c446fe0bec
          • MD5 SHA1 SHA512 TLSH

          ar-fmt.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\ar-fmt.json
          • Size 127KB
          • SHA256 44b2782a7d0bf311e691acb4c4993f1189b3ae53ba2cab79439d8191194aa0b1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ar.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\ar.json
          • Size 9KB
          • SHA256 4b60639b5f3956824c56d636215cdc1f22625c9fad26b6aa034fb84fb9dd4fc7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bn-fmt.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\bn-fmt.json
          • Size 190KB
          • SHA256 e4ea6919356d3f821a4540da1a862e8ef56ec4d5c220be38c80178588895b35e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bn.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\bn.json
          • Size 15KB
          • SHA256 2e9f0f0d07ebf0201532c089a678aa430855f6c40e3fcde96e90ef707a340120
          • MD5 SHA1 SHA512 SSDEEP TLSH

          de-fmt.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\de-fmt.json
          • Size 105KB
          • SHA256 d6f5312d5ad434e684b0851ecba8b123bc5c15154807db403d085c1da1cef1f8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          de.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\de.json
          • Size 7KB
          • SHA256 d982ea41453622e885f441150e07a2d5f2c75d59d0a558e7a3ce2181e6435677
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-backup.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\en-backup.json
          • Size 6KB
          • SHA256 0d26a4dd1ee370267802f0baf197e14ea52f44e818017887696d678256d933fc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-bad.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\en-bad.json
          • Size 6KB
          • SHA256 8d1735947989ca602a71257d78cb9045d600dfec86e3bef5b70263328b150ec1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-fmt-new.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\en-fmt-new.json
          • Size 85KB
          • SHA256 056ffa4b928f461bcbc30eb946174452e9e941d0a1ebf24c4a73e58e36ecd0ce
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-fmt.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\en-fmt.json
          • Size 88KB
          • SHA256 0355962a640fb4aafc9f150412eaacdcd9862eb5feebb59648cf017b567ddf1e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\en.json
          • Size 87KB
          • SHA256 7a2393171c9fa5fe6b34b97d45cece1243686d0253991f494507c035d9c14372
          • MD5 SHA1 SHA512 SSDEEP TLSH

          es-fmt.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\es-fmt.json
          • Size 104KB
          • SHA256 cd906b470a3bea9ce2ba776cea9344e5af340d72fb4918606848360fce2a2aeb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          es.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\es.json
          • Size 7KB
          • SHA256 bb65de4e0b0eb7b2864bb9a0a48335f8286dd38db38eaaf023a2c2041775145e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fr-fmt.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\fr-fmt.json
          • Size 108KB
          • SHA256 7431e202358137af2d889f08ad02f2b6c41b472d00eaedfa212e34cb9872cf60
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fr.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\fr.json
          • Size 7KB
          • SHA256 0ff51b7f29b05b87119ed2fd65ea4f81d564652be118ef706f99e580b7756c9b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hi-fmt.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\hi-fmt.json
          • Size 185KB
          • SHA256 45c776ae2027a6236cbf8bd9e9a8819180887f4658a736f332d1cfc09b4965b1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hi.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\hi.json
          • Size 14KB
          • SHA256 ff474acf9f4cb5d91bc42ab8c57230a340bc69f741f67b58d8ac1e923ddf0d23
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hu-fmt.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\hu-fmt.json
          • Size 104KB
          • SHA256 fafa96996c856e8740505876bceef08bcf91b3821cf8fd6d600cb82f2fe0a2bc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hu.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\hu.json
          • Size 7KB
          • SHA256 f7988969d73db5702f293434dbc1aa9f6b47fe15c4d1ae693eb86b93ebc8f181
          • MD5 SHA1 SHA512 SSDEEP TLSH

          id-fmt.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\id-fmt.json
          • Size 95KB
          • SHA256 745508477f85855c82cee3faf0ec4f3edae52931c630b25e119b5e050bc3d6e5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          id.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\id.json
          • Size 6KB
          • SHA256 31f83e94bebea0af961cdaf2f86c5b96537995f8acbaf7c22387925f4ef1bf90
          • MD5 SHA1 SHA512 SSDEEP TLSH

          it-fmt.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\it-fmt.json
          • Size 102KB
          • SHA256 419f9128d4e860183d77abafa7bfaa50a54d22aa01bcf066453c3f4718dbd7ac
          • MD5 SHA1 SHA512 SSDEEP TLSH

          it.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\it.json
          • Size 7KB
          • SHA256 d469e107736714966f3d4b89f8d1b259651f70ddef21a2ee6d5f90bc393db54d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ja-fmt.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\ja-fmt.json
          • Size 117KB
          • SHA256 279130bec1c6d973faf4675c7abe6f07629ffe07d422d3f4687be3c421780108
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ja.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\ja.json
          • Size 8KB
          • SHA256 2bbdc6f0db6a154a926f83cb2dcf0b288989db898c3664934449c3d37d68f10f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ko-fmt.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\ko-fmt.json
          • Size 106KB
          • SHA256 3da83271574652402c95758f240b505f7e068ba7b74e9d0cc0b564f466609879
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ko.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\ko.json
          • Size 7KB
          • SHA256 3f1793d8e4573737f991829d58436e8aaa1aad3e6efc12560355597d86219d86
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pl-fmt.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\pl-fmt.json
          • Size 101KB
          • SHA256 10b80307707a5966935c46c3fadb89a35d67465f6786d34399c12d310dd05a05
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pl.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\pl.json
          • Size 7KB
          • SHA256 93187124d0984430c653288a15ea612a218d0777402b557bdf9c11d3f98ca3b1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pt-fmt.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\pt-fmt.json
          • Size 101KB
          • SHA256 9e21b94d217796653ccb00b032e681df426ab0ac572c78e0eeafe3d07907e34c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pt.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\pt.json
          • Size 7KB
          • SHA256 95bb308ee1084633f8387f48dd45aab5b51d0233d96dcaa36e25f0aa09de6b5b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ru-fmt.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\ru-fmt.json
          • Size 150KB
          • SHA256 aeda09c884c0fbc99786dca1c15c84ef21487564b6eda3b18e2d3b60ef7dadd4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ru.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\ru.json
          • Size 11KB
          • SHA256 b63cb8497d57e16efe3a4900ec1810f4792b325c1043393ca2d7de085fc0e4c1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          tr-fmt.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\tr-fmt.json
          • Size 99KB
          • SHA256 18b61692e46dcf3f997870fbabebe78c9754f7851a4c428250e7e7d25626828d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          tr.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\tr.json
          • Size 7KB
          • SHA256 6f57582a0ebbacc65404ec498787df0ca7a45af279ddbbc1f0abfe41ec36b192
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ur-fmt.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\ur-fmt.json
          • Size 137KB
          • SHA256 382f190b1f78cb55b2bee229ad02f129cc76bc8bf71921ee1d4240fabe0b780c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ur.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\ur.json
          • Size 10KB
          • SHA256 2cc3a263baef5a13d008194a5b0dabe90dbc4fbd24a337f4f5b6c63bcc92b85c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vi-fmt.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\vi-fmt.json
          • Size 114KB
          • SHA256 be46311c3e58e6486af091a89dbb53d8a6fa5b6cfcc4954663a36dc64aa01cea
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vi.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\vi.json
          • Size 8KB
          • SHA256 15e9311ac28ac70156bc645c04bc0c7cea339da9d9f05098331ce2912060d011
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zh-fmt.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\zh-fmt.json
          • Size 85KB
          • SHA256 63436d789537ae40764cd7e0d36a8f9f361a6614c91490d3f1c6ca3bbbf76ccc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zh.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\resources\locales\zh.json
          • Size 6KB
          • SHA256 ffbb0fbe69d1ad5dcd6bbf86ad90fbf4a00a801b8ae3dd6eee334db7965686a2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          snapshot_blob.bin

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\snapshot_blob.bin
          • Size 158KB
          • SHA256 e87fb952df8e36a5461f328c37afd701f20c427810824e9541709cccb87c22b3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          start-chrome-with-proxy.bat

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\user_scripts\start-chrome-with-proxy.bat
          • Size 3KB
          • SHA256 0dda448e1b771d1d04c05be3fa376c588610480208a017ba44314cc74fcdda4e
          • MD5 SHA1 SHA512 TLSH

          v8_context_snapshot.bin

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\v8_context_snapshot.bin
          • Size 466KB
          • SHA256 4f69d3512c141d88a6137b08a1da04ab80d8e685bd5e9378865d6de828f0cb5a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vk_swiftshader.dll

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\vk_swiftshader.dll
          • Size 5.0MB
          • SHA256 600e158b7d7fb95eb63552da1ae8159a6eb9bb04ff6341d11db2d10bd6c30c8e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vk_swiftshader_icd.json

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\vk_swiftshader_icd.json
          • Size 106B
          • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
          • MD5 SHA1 SHA512 TLSH

          vulkan-1.dll

          • Path C:\Users\Admin\AppData\Local\Programs\capturegem\vulkan-1.dll
          • Size 899KB
          • SHA256 d04035c59f49444bd3cafd71296afd70bad5daa6e28bf5d7de3ffd0e36a85938
          • MD5 SHA1 SHA512 SSDEEP TLSH

          LICENSES.chromium.html

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\7z-out\LICENSES.chromium.html
          • Size 6.4MB
          • SHA256 57b8e5a3f2cd62805001aefca035c7348b4d1abac157e6df3d798bb31f2ec3d2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cacert.pem

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\7z-out\bin\cacert.pem
          • Size 195KB
          • SHA256 796f1389bfea13c0ed78f663b765baaff54a508e5483786bd6ece73c5e3e3cbe
          • MD5 SHA1 SHA512 SSDEEP TLSH

          curl.exe

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\7z-out\bin\curl.exe
          • Size 3.8MB
          • SHA256 b3eefdc2420dd4e91c87dbd20682a29c64bf6fd8e5504eab3ab3c76a8a131ca0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          MyIcon.icns

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\7z-out\resources\assets\MyIcon.icns
          • Size 131KB
          • SHA256 fdfa051a14e33c48cfec51bf4332b087548bdb0c5ee2aaf8dadbf873ef36710b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          256x256.png

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\7z-out\resources\assets\icons\256x256.png
          • Size 10KB
          • SHA256 c5736e303ef683e0becb977d2e5b68a16fdaacabe7b4a3880ec40efaf2aee7ec
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ar-fmt-new.json

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\7z-out\resources\locales\ar-fmt-new.json
          • Size 9KB
          • SHA256 c5251dd94876bbf6f5673deb7042934573cde905780741423960aaaa2749f25f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bn-fmt-new.json

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\7z-out\resources\locales\bn-fmt-new.json
          • Size 15KB
          • SHA256 9d171e4b6138ed721852574bf11351353d5f6b68cd622dc648a3726adac6582b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          de-fmt-new.json

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\7z-out\resources\locales\de-fmt-new.json
          • Size 7KB
          • SHA256 c08aca2d2b2ad63aa6533575e4f7abf8e63b5b22f7704ddc8b7b0a5eb0e38d02
          • MD5 SHA1 SHA512 SSDEEP TLSH

          es-fmt-new.json

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\7z-out\resources\locales\es-fmt-new.json
          • Size 7KB
          • SHA256 c089f96bf39b449e022053ad46a8c8f23a9b255e31ed5d1984289d373fa63943
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fr-fmt-new.json

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\7z-out\resources\locales\fr-fmt-new.json
          • Size 7KB
          • SHA256 297dcce48dc830ef94033cacbc11e35358c200f1d37983eb75d06319872cc698
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hi-fmt-new.json

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\7z-out\resources\locales\hi-fmt-new.json
          • Size 14KB
          • SHA256 ccbbe83bd1e4124ee03e4d4141b15def3d5782efde76b1c64f64c0b69a23cb75
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hu-fmt-new.json

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\7z-out\resources\locales\hu-fmt-new.json
          • Size 7KB
          • SHA256 4ee75375409fa5946cc1e787dea922d5189fb7dfe82255657ac55254e0081257
          • MD5 SHA1 SHA512 SSDEEP TLSH

          id-fmt-new.json

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\7z-out\resources\locales\id-fmt-new.json
          • Size 6KB
          • SHA256 8e2f634e20431a4020510f26e148182b8ca9b3d90014828eda5a60c2b556aef3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          it-fmt-new.json

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\7z-out\resources\locales\it-fmt-new.json
          • Size 7KB
          • SHA256 8ee405d494f6a80f1edbc70634e42f930adbd80755c373e04ceaafb64048afff
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ja-fmt-new.json

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\7z-out\resources\locales\ja-fmt-new.json
          • Size 8KB
          • SHA256 3ac8e001f4f4fdc19724abe83e4534e970718c81976a8e5c8b63e42a81917339
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ko-fmt-new.json

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\7z-out\resources\locales\ko-fmt-new.json
          • Size 7KB
          • SHA256 219831547d4be4cadbbae4ababd052f7a7ef37d788daec348cc9558ae704f425
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pl-fmt-new.json

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\7z-out\resources\locales\pl-fmt-new.json
          • Size 7KB
          • SHA256 5417d9573bfa093875c430389604fd1d645f12e99f451f160f336ae3e0e753e7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pt-fmt-new.json

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\7z-out\resources\locales\pt-fmt-new.json
          • Size 7KB
          • SHA256 555331e8031b07389be48ca5acc51c98daaa06675f07f7b642dd452995fe7955
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ru-fmt-new.json

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\7z-out\resources\locales\ru-fmt-new.json
          • Size 11KB
          • SHA256 63a6b2de28b19db57824c6bf2221f25a5027bb57d1aaca2ea085f47bcf929672
          • MD5 SHA1 SHA512 SSDEEP TLSH

          tr-fmt-new.json

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\7z-out\resources\locales\tr-fmt-new.json
          • Size 7KB
          • SHA256 cf434e75b2b85d413d41001356a32ba9757bfc45e14c035fd21aca2c99febee6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ur-fmt-new.json

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\7z-out\resources\locales\ur-fmt-new.json
          • Size 10KB
          • SHA256 92b8258effd2896cade08148713b49eaec53f2462a71fabaca84efd797671342
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vi-fmt-new.json

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\7z-out\resources\locales\vi-fmt-new.json
          • Size 8KB
          • SHA256 b6552fb8fe3a4de1e47202d0f8d82bc7ed1f8bab13d53a3c4e1bcf682cb47a9e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zh-fmt-new.json

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\7z-out\resources\locales\zh-fmt-new.json
          • Size 6KB
          • SHA256 526018de84f74bc001f61236ef5317ce6eebafb452c169c020a64ff78fd9d6a5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          SpiderBanner.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\SpiderBanner.dll
          • Size 9KB
          • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
          • MD5 SHA1 SHA512 SSDEEP TLSH

          StdUtils.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\StdUtils.dll
          • Size 100KB
          • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          System.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\System.dll
          • Size 12KB
          • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
          • MD5 SHA1 SHA512 SSDEEP TLSH

          WinShell.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\WinShell.dll
          • Size 3KB
          • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
          • MD5 SHA1 SHA512 TLSH

          nsExec.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\nsExec.dll
          • Size 6KB
          • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nsis7z.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsfC144.tmp\nsis7z.dll
          • Size 424KB
          • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
          • MD5 SHA1 SHA512 SSDEEP TLSH

          .completed-history-1685547629.tmp

          • Path C:\Users\Admin\AppData\Local\capturegem\.completed-history-1685547629.tmp
          • Size 2B
          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
          • MD5 SHA1 SHA512

          config.json

          • Path C:\Users\Admin\AppData\Local\capturegem\config.json
          • Size 4KB
          • SHA256 1eeb86f7ba285995ba1becc9ef43c6b5679ae5c6cd57588a5013af8b5b807dc9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          reset_config.log

          • Path C:\Users\Admin\AppData\Local\capturegem\reset_config.log
          • Size 519B
          • SHA256 fd3ca76c994f7a73422ae40bd25b19215068c7706fa85043b413d43420cce7b7
          • MD5 SHA1 SHA512 TLSH

          system_monitor.json

          • Path C:\Users\Admin\AppData\Local\capturegem\system_monitor.json
          • Size 32KB
          • SHA256 0134508c723af8b2563133f48fa4e6275c31b9bcddf62f1ff669e8913c009311
          • MD5 SHA1 SHA512 SSDEEP TLSH

          default.exc

          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
          • Size 2B
          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
          • MD5 SHA1 SHA512

          temp-index

          • Path C:\Users\Admin\AppData\Roaming\capturegem\Code Cache\wasm\index-dir\temp-index
          • Size 48B
          • SHA256 81df45dcf0ab8f83463bcb92897ec6b949a2a0dce9a3ef549bdb8245b3edcc83
          • MD5 SHA1 SHA512

          CURRENT

          • Path C:\Users\Admin\AppData\Roaming\capturegem\Local Storage\leveldb\CURRENT
          • Size 16B
          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
          • MD5 SHA1 SHA512

          7a81355a-9e7c-499b-9816-e8b0388c70b3.tmp

          • Path C:\Users\Admin\AppData\Roaming\capturegem\Network\7a81355a-9e7c-499b-9816-e8b0388c70b3.tmp
          • Size 649B
          • SHA256 a0eaec6055b5f3975eb24d21b3a54cd5abfdc36205554d952ff850cd9098c30c
          • MD5 SHA1 SHA512 TLSH

          Network Persistent State

          • Path C:\Users\Admin\AppData\Roaming\capturegem\Network\Network Persistent State
          • Size 59B
          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
          • MD5 SHA1 SHA512 TLSH

          MANIFEST-000001

          • Path C:\Users\Admin\AppData\Roaming\capturegem\Session Storage\MANIFEST-000001
          • Size 41B
          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
          • MD5 SHA1 SHA512

          CaptureGem.lnk

          • Path C:\Users\Admin\Desktop\CaptureGem.lnk
          • Size 2KB
          • SHA256 199c8f9f9051b23621904e869d6842678e082b7a041a4b26920b4be6285956ab
          • MD5 SHA1 SHA512 TLSH

          memory/3956-1886-0x00007FFA38D20000-0x00007FFA38D21000-memory.dmp

          memory/3956-1887-0x00007FFA37380000-0x00007FFA37381000-memory.dmp

          memory/3956-1936-0x00000175A7BC0000-0x00000175A7BEF000-memory.dmp

          memory/3956-1937-0x00000175A81E0000-0x00000175A88D6000-memory.dmp