Analysis
- user interaction
yes - max time kernel
148s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/08/2026, 01:03
Static task
static1
Behavioral task
behavioral1
Sample
nxwitness-client-6.1.2.42921-windows_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
nxwitness-client-6.1.2.42921-windows_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target nxwitness-client-6.1.2.42921-windows_x64.exe
- Size 232.6MB
- Sample260803-bessvszycs
- SHA256 cd3e007902bcc034389de8feae33b38f85460275ec36c1896adf40ab4b79c675
- MD5 87c7736bfb056387389ae180a7359483
- SHA1 39825239f6bced3b95a463129c15787617a7b5b6
- SHA512 222f2a4332e7037b636d2e763cc4c37b3ac39aa68e60a8ad33caf9b8bd57246e1c96311110e447e4e55adf079b4897ab0b4101ed92a0a1b1be3bc415aba78dff
- SSDEEP 6291456:vF927pz0WeMxQiy+YCV2jyhxuIkJlE1uEVQ/WsEhKIhrX:tI7pz062ibYCVQybuLlPEVQtZIhrX
- TLSH T1D4C833015528EF77CD24A930E37022BCE7393626069B0969D65CFAE596772CF32B2DC1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{59e0d4bd-82d0-4d38-bf76-cf24090609f1} = "\"C:\\ProgramData\\Package Cache\\{59e0d4bd-82d0-4d38-bf76-cf24090609f1}\\client-unsigned.exe\" /burn.runonce" client-unsigned.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{59e0d4bd-82d0-4d38-bf76-cf24090609f1} = "\"C:\\ProgramData\\Package Cache\\{59e0d4bd-82d0-4d38-bf76-cf24090609f1}\\client-unsigned.exe\" /burn.runonce" client-unsigned.exe - Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 11 2496 msiexec.exe 28 2496 msiexec.exe 30 2496 msiexec.exe 37 2496 msiexec.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation nxwitness-client-6.1.2.42921-windows_x64.exe Key value queried \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation client-unsigned.exe Key value queried \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation HD Witness.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\help\archive_retention.html msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected] msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\help\jstopics\global_notifications_2.js msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\light\images\radiobutton-indicator-hovered.png msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected] msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected] msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\fonts\RobotoMono-Light.ttf msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\help\jstopics\archive_backup_finished.js msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\help\mail_notifications.html msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQml\plugins.qmltypes msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\Material\impl\SliderHandle.qml msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\help\using_bookmarks.html msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Dialogs\quickimpl\qml\+Universal\FileDialog.qml msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\help\jstopics\navigating_and_searching_throu.js msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\Qt6Positioning.dll msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\light\images\rangeslider-groove.png msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\help\jstopics\selecting-ptz-presets.js msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\help\jstopics\sending_anonymous_usage_and_cr.js msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected] msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\help\jstopics\users-and-groups.js msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\help\jstopics\configuring-expert-streaming-s.js msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\Qt5Compat\GraphicalEffects\plugins.qmltypes msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\help\configuring_multi-server_envir.html msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\help\jstopics\performing_smart_search.js msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected] msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\Qt6Xml.dll msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\light\images\editablecombobox-background-hovered-open.png msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\Material\Label.qml msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\light\images\rangeslider-first-handle-hovered.png msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\help\images\spacer.gif msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\spinbox-indicator-down-background-up-pressed.png msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\api-ms-win-core-libraryloader-l1-1-0.dll msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\help\assigning_logical_id.html msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\editablecombobox-indicator-hovered-open.png msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\Qt\labs\platform\qmldir msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\Universal\RangeSlider.qml msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected] msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\help\roles_management.html msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\help\jstopics\vms_quick_start.js msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\translations\qtwebengine_locales\pt-BR.pak msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\nx_vms_common.dll msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected] msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\help\jstopics\deleting_a_camera_(admin_only).js msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\help\screen_recording.html msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\Universal\ScrollIndicator.qml msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected] msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\MenuBar.qml msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\help\navigating_and_searching_throu.html msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\Imagine\plugins.qmltypes msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\Qt6WebEngineWidgets.dll msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\Qt5Compat\GraphicalEffects\RecursiveBlur.qml msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\fonts\Roboto-Medium.ttf msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected] msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\help\jstopics\editing_recording_schedule.js msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Effects\qmldir msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\Qt6QuickControls2.dll msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected] msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected] msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\icuuc74.dll msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\help\jstopics\assigning_logical_id.js msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\help\certificate-validation.html msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\help\configuring_cameras.html msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\help\event_rule_advanced_settigns_f.html msiexec.exe File created C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected] msiexec.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Installer\{309F65AC-67C4-4C72-ADF7-E45CC82F5586}\application_icon msiexec.exe File opened for modification C:\Windows\Installer\{309F65AC-67C4-4C72-ADF7-E45CC82F5586}\application_icon msiexec.exe File created C:\Windows\Installer\e58bcb4.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI118B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6A8B.tmp msiexec.exe File created C:\Windows\Installer\e58bcb8.msi msiexec.exe File opened for modification C:\Windows\Installer\e58bcb4.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{309F65AC-67C4-4C72-ADF7-E45CC82F5586} msiexec.exe File opened for modification C:\Windows\Installer\MSIAB4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI24C6.tmp msiexec.exe - Executes dropped EXE 11 IoCs
pid Process 3672 nxwitness-client-6.1.2.42921-windows_x64.exe 1788 client-unsigned.exe 2176 client-unsigned.exe 4144 client-unsigned.exe 1928 client-unsigned.exe 3792 client-unsigned.exe 4848 HD Witness Launcher.exe 4968 applauncher.exe 2260 HD Witness.exe 952 HD Witness Launcher.exe 3380 applauncher.exe - Loads dropped DLL 64 IoCs
pid Process 3672 nxwitness-client-6.1.2.42921-windows_x64.exe 1928 client-unsigned.exe 3952 MsiExec.exe 3952 MsiExec.exe 5016 MsiExec.exe 4968 applauncher.exe 4968 applauncher.exe 4968 applauncher.exe 4968 applauncher.exe 4968 applauncher.exe 4968 applauncher.exe 4968 applauncher.exe 4968 applauncher.exe 4968 applauncher.exe 4968 applauncher.exe 4968 applauncher.exe 4968 applauncher.exe 4968 applauncher.exe 4968 applauncher.exe 4968 applauncher.exe 4968 applauncher.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe 2260 HD Witness.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxwitness-client-6.1.2.42921-windows_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxwitness-client-6.1.2.42921-windows_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language client-unsigned.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language client-unsigned.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language client-unsigned.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language client-unsigned.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language client-unsigned.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0681d78f5363a20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee0681d70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee0681d7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee0681d7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee0681d7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA56F9034C7627C4DA7F4EC58CF25568 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA56F9034C7627C4DA7F4EC58CF25568\Version = "100728834" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA56F9034C7627C4DA7F4EC58CF25568\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{309F65AC-67C4-4C72-ADF7-E45CC82F5586}v6.1.2.42921\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{309F65AC-67C4-4C72-ADF7-E45CC82F5586}\DisplayName = "Nx Witness Client" client-unsigned.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\nx-vms\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NXFile\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.nov\shell\play.default\command\ = "\"C:\\Program Files\\Network Optix\\Nx Witness\\Client\\6.1.2.42921\\HD Witness Launcher.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA56F9034C7627C4DA7F4EC58CF25568\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{309F65AC-67C4-4C72-ADF7-E45CC82F5586}\Dependents client-unsigned.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\HD Witness Launcher.exe\SupportedTypes\.nov msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.nov\shell\play.default msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.nov msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{59e0d4bd-82d0-4d38-bf76-cf24090609f1}\Dependents client-unsigned.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{309F65AC-67C4-4C72-ADF7-E45CC82F5586}\Version = "6.1.2.42921" client-unsigned.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{309F65AC-67C4-4C72-ADF7-E45CC82F5586} client-unsigned.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NXFile\shell\open\command\ = "\"C:\\Program Files\\Network Optix\\Nx Witness\\Client\\6.1.2.42921\\HD Witness Launcher.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{59e0d4bd-82d0-4d38-bf76-cf24090609f1} client-unsigned.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CA56F9034C7627C4DA7F4EC58CF25568\AlwaysFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA56F9034C7627C4DA7F4EC58CF25568\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA56F9034C7627C4DA7F4EC58CF25568\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E9960EA6D9FA1CC4583AB98F185936FA msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E9960EA6D9FA1CC4583AB98F185936FA\CA56F9034C7627C4DA7F4EC58CF25568 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA56F9034C7627C4DA7F4EC58CF25568\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA56F9034C7627C4DA7F4EC58CF25568\Clients = 3a0000000000 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{59e0d4bd-82d0-4d38-bf76-cf24090609f1} client-unsigned.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NXFile\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.nov\ = "NXFile" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA56F9034C7627C4DA7F4EC58CF25568\SourceList\Media\2 = ";" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{59e0d4bd-82d0-4d38-bf76-cf24090609f1}\Dependents client-unsigned.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\nx-vms\shell\ = "open" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA56F9034C7627C4DA7F4EC58CF25568\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA56F9034C7627C4DA7F4EC58CF25568\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{309F65AC-67C4-4C72-ADF7-E45CC82F5586}v6.1.2.42921\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\nx-vms\DefaultIcon\ = "\"C:\\Program Files\\Network Optix\\Nx Witness\\Client\\6.1.2.42921\\HD Witness.exe\" ,0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\nx-vms msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\nx-vms\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA56F9034C7627C4DA7F4EC58CF25568\ProductName = "Nx Witness Client" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{309F65AC-67C4-4C72-ADF7-E45CC82F5586}\Dependents\{59e0d4bd-82d0-4d38-bf76-cf24090609f1} client-unsigned.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{59e0d4bd-82d0-4d38-bf76-cf24090609f1}\Version = "6.1.2.42921" client-unsigned.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{59e0d4bd-82d0-4d38-bf76-cf24090609f1}\DisplayName = "Nx Witness Client" client-unsigned.exe Key created \REGISTRY\MACHINE\Software\Classes\Applications\HD Witness Launcher.exe\SupportedTypes msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA56F9034C7627C4DA7F4EC58CF25568\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA56F9034C7627C4DA7F4EC58CF25568\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA56F9034C7627C4DA7F4EC58CF25568\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{309F65AC-67C4-4C72-ADF7-E45CC82F5586}\ = "{309F65AC-67C4-4C72-ADF7-E45CC82F5586}" client-unsigned.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{59e0d4bd-82d0-4d38-bf76-cf24090609f1} client-unsigned.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\nx-vms\ = "Nx Witness Client" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\nx-vms\version = "6.1.2.42921" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\nx-vms\shell\open\command\ = "\"C:\\Program Files\\Network Optix\\Nx Witness\\Client\\6.1.2.42921\\HD Witness.exe\" -- \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\NXFile msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\HD Witness Launcher.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\nx-vms\URL Protocol msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CA56F9034C7627C4DA7F4EC58CF25568\ClientFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\HD Witness Launcher.exe\SupportedTypes msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{59e0d4bd-82d0-4d38-bf76-cf24090609f1}\ = "{59e0d4bd-82d0-4d38-bf76-cf24090609f1}" client-unsigned.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{59e0d4bd-82d0-4d38-bf76-cf24090609f1}\Version = "6.1.2.42921" client-unsigned.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{59e0d4bd-82d0-4d38-bf76-cf24090609f1}\DisplayName = "Nx Witness Client" client-unsigned.exe Key created \REGISTRY\MACHINE\Software\Classes\.nov msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA56F9034C7627C4DA7F4EC58CF25568\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA56F9034C7627C4DA7F4EC58CF25568\SourceList\PackageName = "client" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{309F65AC-67C4-4C72-ADF7-E45CC82F5586} client-unsigned.exe Key created \REGISTRY\MACHINE\Software\Classes\nx-vms\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\NXFile\shell\open\command msiexec.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2260 HD Witness.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2496 msiexec.exe 2496 msiexec.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2260 HD Witness.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 3816 vssvc.exe Token: SeRestorePrivilege 3816 vssvc.exe Token: SeAuditPrivilege 3816 vssvc.exe Token: SeBackupPrivilege 3692 srtasks.exe Token: SeRestorePrivilege 3692 srtasks.exe Token: SeSecurityPrivilege 3692 srtasks.exe Token: SeTakeOwnershipPrivilege 3692 srtasks.exe Token: SeShutdownPrivilege 1788 client-unsigned.exe Token: SeIncreaseQuotaPrivilege 1788 client-unsigned.exe Token: SeSecurityPrivilege 2496 msiexec.exe Token: SeCreateTokenPrivilege 1788 client-unsigned.exe Token: SeAssignPrimaryTokenPrivilege 1788 client-unsigned.exe Token: SeLockMemoryPrivilege 1788 client-unsigned.exe Token: SeIncreaseQuotaPrivilege 1788 client-unsigned.exe Token: SeMachineAccountPrivilege 1788 client-unsigned.exe Token: SeTcbPrivilege 1788 client-unsigned.exe Token: SeSecurityPrivilege 1788 client-unsigned.exe Token: SeTakeOwnershipPrivilege 1788 client-unsigned.exe Token: SeLoadDriverPrivilege 1788 client-unsigned.exe Token: SeSystemProfilePrivilege 1788 client-unsigned.exe Token: SeSystemtimePrivilege 1788 client-unsigned.exe Token: SeProfSingleProcessPrivilege 1788 client-unsigned.exe Token: SeIncBasePriorityPrivilege 1788 client-unsigned.exe Token: SeCreatePagefilePrivilege 1788 client-unsigned.exe Token: SeCreatePermanentPrivilege 1788 client-unsigned.exe Token: SeBackupPrivilege 1788 client-unsigned.exe Token: SeRestorePrivilege 1788 client-unsigned.exe Token: SeShutdownPrivilege 1788 client-unsigned.exe Token: SeDebugPrivilege 1788 client-unsigned.exe Token: SeAuditPrivilege 1788 client-unsigned.exe Token: SeSystemEnvironmentPrivilege 1788 client-unsigned.exe Token: SeChangeNotifyPrivilege 1788 client-unsigned.exe Token: SeRemoteShutdownPrivilege 1788 client-unsigned.exe Token: SeUndockPrivilege 1788 client-unsigned.exe Token: SeSyncAgentPrivilege 1788 client-unsigned.exe Token: SeEnableDelegationPrivilege 1788 client-unsigned.exe Token: SeManageVolumePrivilege 1788 client-unsigned.exe Token: SeImpersonatePrivilege 1788 client-unsigned.exe Token: SeCreateGlobalPrivilege 1788 client-unsigned.exe Token: SeRestorePrivilege 2496 msiexec.exe Token: SeTakeOwnershipPrivilege 2496 msiexec.exe Token: SeBackupPrivilege 3692 srtasks.exe Token: SeRestorePrivilege 3692 srtasks.exe Token: SeSecurityPrivilege 3692 srtasks.exe Token: SeTakeOwnershipPrivilege 3692 srtasks.exe Token: SeShutdownPrivilege 3792 client-unsigned.exe Token: SeIncreaseQuotaPrivilege 3792 client-unsigned.exe Token: SeCreateTokenPrivilege 3792 client-unsigned.exe Token: SeAssignPrimaryTokenPrivilege 3792 client-unsigned.exe Token: SeLockMemoryPrivilege 3792 client-unsigned.exe Token: SeIncreaseQuotaPrivilege 3792 client-unsigned.exe Token: SeMachineAccountPrivilege 3792 client-unsigned.exe Token: SeTcbPrivilege 3792 client-unsigned.exe Token: SeSecurityPrivilege 3792 client-unsigned.exe Token: SeTakeOwnershipPrivilege 3792 client-unsigned.exe Token: SeLoadDriverPrivilege 3792 client-unsigned.exe Token: SeSystemProfilePrivilege 3792 client-unsigned.exe Token: SeSystemtimePrivilege 3792 client-unsigned.exe Token: SeProfSingleProcessPrivilege 3792 client-unsigned.exe Token: SeIncBasePriorityPrivilege 3792 client-unsigned.exe Token: SeCreatePagefilePrivilege 3792 client-unsigned.exe Token: SeCreatePermanentPrivilege 3792 client-unsigned.exe Token: SeBackupPrivilege 3792 client-unsigned.exe Token: SeRestorePrivilege 3792 client-unsigned.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3672 nxwitness-client-6.1.2.42921-windows_x64.exe 1928 client-unsigned.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2260 HD Witness.exe 2260 HD Witness.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1900 wrote to memory of 3672 1900 nxwitness-client-6.1.2.42921-windows_x64.exe 87 PID 3672 wrote to memory of 1788 3672 nxwitness-client-6.1.2.42921-windows_x64.exe 88 PID 2176 wrote to memory of 4144 2176 client-unsigned.exe 98 PID 4144 wrote to memory of 1928 4144 client-unsigned.exe 99 PID 1928 wrote to memory of 3792 1928 client-unsigned.exe 105 PID 2496 wrote to memory of 3952 2496 msiexec.exe 108 PID 2496 wrote to memory of 5016 2496 msiexec.exe 111 PID 3672 wrote to memory of 4848 3672 nxwitness-client-6.1.2.42921-windows_x64.exe 117 PID 4848 wrote to memory of 4968 4848 HD Witness Launcher.exe 118 PID 4968 wrote to memory of 2260 4968 applauncher.exe 119 PID 2260 wrote to memory of 952 2260 HD Witness.exe 124 PID 952 wrote to memory of 3380 952 HD Witness Launcher.exe 125 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\nxwitness-client-6.1.2.42921-windows_x64.exe"C:\Users\Admin\AppData\Local\Temp\nxwitness-client-6.1.2.42921-windows_x64.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\Temp\{3A7F411B-3FEF-4219-85DD-E5576F4455DE}\.cr\nxwitness-client-6.1.2.42921-windows_x64.exe"C:\Windows\Temp\{3A7F411B-3FEF-4219-85DD-E5576F4455DE}\.cr\nxwitness-client-6.1.2.42921-windows_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\nxwitness-client-6.1.2.42921-windows_x64.exe" -burn.filehandle.attached=688 -burn.filehandle.self=6922⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\Temp\{4F95723F-8C48-4B05-ACB2-04BC4F765ADB}\.be\client-unsigned.exe"C:\Windows\Temp\{4F95723F-8C48-4B05-ACB2-04BC4F765ADB}\.be\client-unsigned.exe" -q -burn.elevated BurnPipe.{09361F12-EE9F-448C-A3F2-1D9A5703B83E} {872C9538-802E-47C7-813C-07D9FC022694} 36723⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1788
-
-
C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\HD Witness Launcher.exe"C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\HD Witness Launcher.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\applauncher.exe"C:/Program Files/Network Optix/Nx Witness/Client/6.1.2.42921/applauncher.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Program Files\Network Optix\Nx Witness\client\6.1.2.42921\HD Witness.exe"C:\Program Files\Network Optix\Nx Witness\client\6.1.2.42921\HD Witness.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Program Files\Network Optix\Nx Witness\client\6.1.2.42921\HD Witness Launcher.exe"C:\Program Files\Network Optix\Nx Witness\client\6.1.2.42921\HD Witness Launcher.exe" --exec6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Network Optix\applauncher\default\applauncher.exe"C:/Users/Admin/AppData/Local/Network Optix/applauncher/default/applauncher.exe" "--exec"7⤵
- Executes dropped EXE
PID:3380
-
-
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3816
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
PID:3692
-
C:\ProgramData\Package Cache\{59e0d4bd-82d0-4d38-bf76-cf24090609f1}\client-unsigned.exe"C:\ProgramData\Package Cache\{59e0d4bd-82d0-4d38-bf76-cf24090609f1}\client-unsigned.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\ProgramData\Package Cache\{59e0d4bd-82d0-4d38-bf76-cf24090609f1}\client-unsigned.exe"C:\ProgramData\Package Cache\{59e0d4bd-82d0-4d38-bf76-cf24090609f1}\client-unsigned.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Nx_Witness_Client_20260803020632.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\ProgramData\Package Cache\{59e0d4bd-82d0-4d38-bf76-cf24090609f1}\client-unsigned.exe"C:\ProgramData\Package Cache\{59e0d4bd-82d0-4d38-bf76-cf24090609f1}\client-unsigned.exe" -burn.clean.room="C:\ProgramData\Package Cache\{59e0d4bd-82d0-4d38-bf76-cf24090609f1}\client-unsigned.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Nx_Witness_Client_20260803020632.log"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\ProgramData\Package Cache\{59e0d4bd-82d0-4d38-bf76-cf24090609f1}\client-unsigned.exe"C:\ProgramData\Package Cache\{59e0d4bd-82d0-4d38-bf76-cf24090609f1}\client-unsigned.exe" -q -burn.elevated BurnPipe.{CC9A6BDB-B2F7-4773-AC4C-B50AD7DFA9C5} {B601D046-ACEA-465D-9E2E-ADB6F45B60B0} 19284⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3792
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3D7A31D25C79886241E0E3D76A68871B2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3952
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0FDCFD2EE3186D391BC25B153CA4949E E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5016
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4352
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58bcb7.rbs
- Size 929KB
- SHA256 caae00f1e71c029b4f60ca1fe8bceede90b5e928a6ec639bbcf67ed96688f1a7
- MD5 70380d087f161f280644abba47d49366
- SHA1 5dfff1f0ab4aee8061174dd79878663dde2ab0a0
- SHA512 998bc4e8cce75c2349deb200c8361b99ee01fe475a94e413c39f1fd46365d2f8ff2d04ec13f5c95504515e9a87feb2a4da2c10955f1ad2a994a0f20837b604af
- SSDEEP 6144:5vETNcYkTLGkouBZFg6pPGMRCkHoBYmN4xbxCwhMJdLT1jXZ/H1dRxtuTtvCANjD:PtSYmaX5hgBjXZ/RuBKAF
- TLSH T10715DC40651AB3F5F3065BD8BB82E9B50798D91A6F4AB3FF778C971E86C024317AD021
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\HD Witness Launcher.exe
- Size 1.6MB
- SHA256 f3228ffe6059e7659d5a4bf3e95add8ee5dbd93dde9d8cd6c97dfdb0b445a536
- MD5 f2bd267da2e25e1b30f1c0bfb41f2c6e
- SHA1 fcc4b30f35ad47baca9ea346f6a6600126ccc179
- SHA512 5cb2c1e3c6fa6af41cda1caadff49642343228c6ca5d05f2ca792540c5664f5b9f07bd70af955c7591c06f42cb249cf62d5d853a28a0d599de3c44ff5a0dcd82
- SSDEEP 12288:vDYP85DSQAr+63FgwzTKNNbUFHelF51sA3ZSoe8Y8bHIR8muUvhgN6V4:LA85Dk+6EN2A1sA3Zq8YgHILNWYV4
- TLSH T14B7516156254C3B4ED639038896D4E71EAB17C09032397F702A4B6A5DF376BC0A3AEDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\HD Witness.exe
- Size 585KB
- SHA256 f0c6d491913ebfd612f03e98e3aea7d64e2bc3c659c1422ddda93c96763e1c24
- MD5 0c2ef2c4ae80b7553981ccb1f370aa2e
- SHA1 524e5fcdb30a16afc3924b9d90f58e33d11b76b8
- SHA512 2206c8c350b35f24032c10e35c181e32a30f4033f1eac6ae65069305cf42f3b6470373847be5e5068df4cca167da162c172b55b931148187c15c2ef5e6515f80
- SSDEEP 768:Ha8dTnCB3cc38VgdABTmGnNHkLDIfWp2L6lkQESdMZ7XRCPbqFn6OxWsHYD5uGqg:HpeMrrg6mlkQESdUseR6W2Fj7E
- TLSH T1BAD4C6956759C732CE87A5300ABC8C71C6267E99493743FA6089F925CBB3AFD2408DDC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\Qt6Core.dll
- Size 9.5MB
- SHA256 3fd4497705d63054f3c4280efea96ae743dcbf2d3570d56a05c922d721cc9a12
- MD5 8d8d5fa0c7464ccafcfa4d3f67abdf8d
- SHA1 6bf33d5902273fad5cff64208a34b13c534c83ea
- SHA512 024366845797c0b91441d31e75fd53fba315b80dab12213b53770a53d89fdb34e9b134dc03ed189f13e226a67d5fd14b1e077aa1f8269c565a8d43be33e0d6cc
- SSDEEP 98304:Vt2YV8aIRcKFdu9CwJsv6teL/g4o3h02S66u/3:VQzVcKFdu9CwJsv6te1o3hz/3
- TLSH T15BA6281766FA0111FAFBDA34DABB0142DBB27C466B3496DF025821185D737F09E3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\Qt6Core5Compat.dll
- Size 844KB
- SHA256 3c662e0750c9b7472187819dde1970cf329cb98e8cfa876ff5fba3a9a6a62ca4
- MD5 6782d122f91f1cc68f319ba13032af9d
- SHA1 8d18d24c783052ee049b8d2b8a53d4dd89332b24
- SHA512 f747ec02434abfd28b31bfe729d725ce3c3dc9668a650480dea689e39a1be25548a4a7f57b51113e766369a79c12e73b8811e8656b6f0506d6c59b4ac83fc053
- SSDEEP 12288:cjkAyiSoyPFyjVyirdWPGE/4717VKIyBDPzHkSUGG1fRjfZME:JiNSy4iwG7ViDPTNyfZM
- TLSH T18E05BE7772A90996F17BC03DCFA39913D7A77012136286EFA66087067E63BF119BC211
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\Qt6Network.dll
- Size 1.7MB
- SHA256 9624bb8a885398c22b88deff2c985cff7a7a996a1ca19626fae20a1a404787ac
- MD5 c9d324911b9346b07852a353dbdf04f6
- SHA1 c19ed074cd647ba91fce6ad2bc17e530db4068de
- SHA512 b85672ed3e0f423932f45c655328c6853fec4fa7713c9f54efc463d4872c1f975c4b1f568ec83173cb13ee6282344b849416a979fb296c8444bbe4e183a15b7a
- SSDEEP 24576:UsvM6M2ttwrUeUIGNYD73YC/ywtzgU1TeBGK:UsvM6M2ttQUeUIN3YUyazRVe8
- TLSH T1A0857C57A3A50196D86EC238CB4B8A07F772700553669BDF02658B192F73BF21B7E360
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\applauncher.exe
- Size 869KB
- SHA256 863188b24937611f3ad40af741177810f05202cff81a9204a2f229f16010da93
- MD5 8594d436ede3d5d6ba6c984b3ab98b6b
- SHA1 96a0755cafebc2250806403affcecd040daf4987
- SHA512 aebd32c9cc55a5385049b63677324d30ac5546c339e9531179892aa744904517ec7f258052cf83df2350a5daef20a8efd2f3c5fab431257b433407949567e1c8
- SSDEEP 6144:sXY8dhIYTjnKojXrkfRpZ/FXzrH9sP9UCISwzNVLudusqi95i+b1k80qMPIFD7MP:sX9fnT++bKjX
- TLSH T1EE156D5A6654CBB1EC62C1398A9E8C31D6623C45832387FB0194B926DF375FD6A38DCC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\build_info.txt
- Size 419B
- SHA256 347fdb4de1d4c87fa67c42f5969beda32341769404b4f59b08db1181d1f3b60f
- MD5 31e1e40046fbd3f5192923ee97df2630
- SHA1 2453540af14d9463a6eb58f2ec394d255b97b7e4
- SHA512 869979230ca2a30bb6ac081a979ff8e6bc71040456db932aa7b46dea1d7c126d2a00be01d41bc04e2b3467602b1442ee2324883f6dacbdb41657d04b1cce6350
- TLSH T1A8E0E521A060E7B466F39BC74EF8617723B1F6D4098E908D26868479576121C53033BB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\libcrypto-1_1-x64.dll
- Size 3.1MB
- SHA256 2fa483167cb98e55d52ea817061cde25d5b504d28b352d11f4a6e939f1c93a7e
- MD5 823577837e904beded9714952cd43fa4
- SHA1 8eb9a931a158e378ddb3fa4f4c716ae98724ee52
- SHA512 e222fdb069cc832f4a368c10e886ca999eaf1b84496a590ea245523345661e701397c3118050579e491bb09edd2fd7997a822a413801fda52abb0bd88b277292
- SSDEEP 49152:FsVwASO1hIU6iy7GtlqdsUxBk9N6cRJc/jMh3KfL4JTTsDhNPHkzs0GqIfv1CPw0:FOW+Ii68UMsVZkzsb1CPwDv3uFfJ
- TLSH T1C9E58C5EA7A81084E9BAC13CC5574637D3B1F92A87B19BCF15A2C1780F27BD6263DB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\msvcp140.dll
- Size 559KB
- SHA256 1e57a6df9e3742e31a1c6d9bff81ebeeae8a7de3b45a26e5079d5e1cce54cd98
- MD5 c3d497b0afef4bd7e09c7559e1c75b05
- SHA1 295998a6455cc230da9517408f59569ea4ed7b02
- SHA512 d5c62fdac7c5ee6b2f84b9bc446d5b10ad1a019e29c653cfdea4d13d01072fdf8da6005ad4817044a86bc664d1644b98a86f31c151a3418be53eb47c1cfae386
- SSDEEP 12288:mPeu+VwM4PRpJOc8hdGE0bphVSvefIJQEKZm+jWodEEVwDaM:sqwpzSFJQEKZm+jWodEEq9
- TLSH T1BBC40923B75906A0E195E3B8A1834316D7F0BC4A8322A3C752FBD69D2F673D5673B250
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\msvcp140_1.dll
- Size 35KB
- SHA256 1274292f4cc655f295272b37e08a9683b8bb8c419b61ea2e1f43eb4d22f02f90
- MD5 7b0a25eee764d8747f02cb3ed980f07a
- SHA1 9b9c827f8c6e7f497e88b83f0654bdf97c50c50f
- SHA512 3302ee0c62947f3eddacbed0ae14f531de24392e2c73b40ab9690e6be5f869c3b525a27868a4507e7e80ec5da68b71880731a6b105e16173baa65c770f2666a7
- SSDEEP 384:vcSfZMC98zOoKF4tWci5gWLOCSt+e9UR9zsCc525yEFHRN76kUR9zsCcQfq:0SWC+zOjaIcdc9zOggElI9zOp
- TLSH T150F26DC6AF288442EC6B093096D9ED477C3DB7D28B50A6A71292F64C1DD33C5EA3462D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\nx_branding.dll
- Size 34KB
- SHA256 8f614eb571aa090c3a7dc97c134fbc7854ee213a9a573f66fd6b48520605dab1
- MD5 ec86210e352e010fd54b991625619a40
- SHA1 c2adabe68e9881964f03266d1aaf7e5b540244ca
- SHA512 31b538cfd796690a36c23ae30beecf69f904ae206cadce1207cbf6bdd287dec0ede5d280216eb9f13cf0f11e19a5e4f17e8b7de1806a39ff6a51d8e0b910f1e9
- SSDEEP 384:ETE5VhDYhN96X1J99apJgRfD7WZHwUOLJqiuNGCanZ8UtC8NADSEr:EqDYhaXyJ6OZQ1u6CoADSEr
- TLSH T136F2D8657B6A53AAF473C239C9E34B408076B074532297EF8214916E0EA73C3B47FB59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\nx_build_info.dll
- Size 32KB
- SHA256 7e0db1d062f5abb74e03fd72862c3032d4ee4477183f111be694116adc29559b
- MD5 e1ddd9ac4441c0b2c3599e129a77df50
- SHA1 5db83eabb6eded7f00434dfe9fda0a15a2301ac7
- SHA512 3b684fa15ad39f4b867904ebdd6f88d3be453f119ed276d6203a5b077032f00759240e477a5e28181fba05864bcc6dc297ce6151f37382d86f29238bde02a66e
- SSDEEP 384:z+y7nFYQMZfBpxI3zO1qhtnCEVjupGGJzLT7LQqo+WDLpE4sZAqg8wnWka:xXUJpm7jupHFTH++mEwqg9nWka
- TLSH T1B5E2299A776541AAE53BC17DCC235B50D5B2BC744362D3CF0261B29E1E333C3A63A698
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\nx_kit.dll
- Size 256KB
- SHA256 7facdce8676b032092d232a0ce54db55178c800f27aa25a869c7c6e2173aee7d
- MD5 f80b0e1509035b084572727be1c6e0fa
- SHA1 8bb28174c14a5ea5774cdf3190531b059cd912a4
- SHA512 7404bc5ff52a9f7775cadad09e1962abd8f1f8d79c67a65506917c8df7450d36d378e5a822cb6fa03e93e4d8f36e5fc9a4004b929180bea2e60aa307045b5b55
- SSDEEP 6144:zCAPii6d65prFR1EJAyT4JZQVzpuzfrhgADyZFKJ:hii6d6zEx9zuzfrhg5ZIJ
- TLSH T1FE443B2776580DACEA6FE2BD8A4B5901F67278460311C7CF03D192261F5BBC5EE3BA50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\nx_reflect.dll
- Size 186KB
- SHA256 82aa772b191ff426f8d769ad22cc271bd7ff1b062d944f8bcb6f8073b526b81d
- MD5 ff03614af901a548af790d7374ac7655
- SHA1 ffc0968ac51a96033486f1995600b2b4ec966481
- SHA512 090bf2f7e9b59202cff42f7cf5906a73509fc6822a520dddf766224b0fb2573939776c4262a429b4255c9bb25ced40b34e0e9ba82ccc4d7ccb2867f57e4e4960
- SSDEEP 1536:xGeYU6q5n5hgEqIVbiyOWc2dCVTGCh2NV5NqdGVu4TxeoquguCya8PN0QglehNkZ:DLZDEtb2NV+dRSHqEPNwle2yqeJ26U
- TLSH T190146507721A4196E5AB33F5ABC14502E3303C516B58B3EB42E6F1262FDB3CD95B79A0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\nx_utils.dll
- Size 6.4MB
- SHA256 95f3a11ce4f62f5062029349ce59cc2e3b5baf6b3ba593f1b2274b3fb92a4574
- MD5 2c27fb67bac64655ac2b471c2b1b073e
- SHA1 dde35ff73a6319f1a7037060c50adcb4f9666773
- SHA512 2c0b42fbd509ae616f5bbf31c84e41cf22b70a34b5ef26e05f27efc09defb07f6ffecbaed74a2038f246542a522d67fc6d56f89b65da587b3a463509d2381287
- SSDEEP 98304:8NYwrvIPRKjp4zVybwCVoT5liOJxT5Y7vonkNu:86wbIPRKjp4zVybwCVoTCvonk
- TLSH T1FB664BAB326D0199E0B6D17DCBDFDA07D67234219712A7CF05E983491F97AC81E7E220
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\nx_vms_applauncher_api.dll
- Size 125KB
- SHA256 7e914d960f6a599b202a93841ae0710a19fe3ee8afd71580bd217c6c843381fb
- MD5 b8bc36f0a66c792aa086c2ddf71b9e01
- SHA1 d3a1c5404b7db445d94e4a9d2d3db1744423d907
- SHA512 85e4d3f91e927c51b0b15f904dfcd68e3861372ba18b95a4f58f3c5fdb0cb731369897ab984a5fa304770783b4fec9118f0247036e33da2a3b10f33b2795220f
- SSDEEP 3072:ms7VPcarexjF/tsXii49czvCG9EpVyw/H4RY:Z7VQxjF/tsSi4JGGp74R
- TLSH T112C33B2A7F6901A8E176E27DCA9B0916F3727421430187EF06B5077A0F2F7D96E3B614
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\nx_zip.dll
- Size 40KB
- SHA256 a5758442058dca351bec7cfbf285e40a2b8c138cb56bfd782cd3abc03a0753fd
- MD5 8bc0f7298f23bd6af39bd75b47542a88
- SHA1 14dae66da98c505ff50dd6f1bea5acc19ca20328
- SHA512 52153d15c6769fd630f11c94230d0baf7082244e3db7cacffd8249bb4dd984c560d571f95f7207e4be671e3edfdde37ce2c380f00220630dc83e32a4a0f614a2
- SSDEEP 768:E7m0LTSPs1kADimzgaXNYwN+mJYwEFmzbPQWi:kmGSPIVgkN9T3zbPQWi
- TLSH T1DE03181A634640D6E5B6C279CB070B96E1B3B0548373A7DF1366821E3E273C27A7D698
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\combobox-indicator-hovered-open.png
- Size 120B
- SHA256 dda8d0d5444670f0a82f7b7aabf1f771d94d0c418f15be75b120137758932c7a
- MD5 a9d763e92351af2d6d6fb16b17e36490
- SHA1 c45d83865e7c09c8ad6f790fdcb9640eca207a5e
- SHA512 563f33bafd2fa7263eba83b6285b84d47255d9e23fd3c41ec9684b64bf820723631ac8f162765ba36e6f393c00aaeb73f3c38406693a19d7ae13630c42cd53ad
- TLSH T193B02B92E0912824C7084133120CD550A8115448448900302700D431221E10C0050F33
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 167B
- SHA256 6d584df93b6785277a090e3c2d46ebba057d262253dfcebbb81585a9f48658c1
- MD5 5829742e78fdd6cb8f893903fc814778
- SHA1 e2e3a2ebaea56c3664004e7c5758967a04862d36
- SHA512 7e4ccedbf24842f9f00123415c16e4858ef70b76783358601e5024d22faabe128ac78b314f9846af8c79818363c2f64ab77902e6ee67e2ea802ff76bfc1e9b72
- TLSH T151C08CCA62B15C698EC8456B938620A49CC40C5D28218A638286767C5DB232AA983783
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 177B
- SHA256 340dfb8f5d90ee5d986eb4b3570a2b3481ca50048a1a5eb38144e13a598d9bc9
- MD5 7a6d8bc2b7b89f67d0071fd478f03c56
- SHA1 debb609ccbf690c74690b13c424530b5fb6e1293
- SHA512 08939949b87639243e0dff61be03fedb314b76429c93248face3d8d159c3ba925b39405bfb88a70edec038312d0773cf8b770f9aab410df7b169be8ed8d52378
- TLSH T176C08CA763A09E32DE45A8F7C34A184584395D10ABA2029F8068B46F1A34192DA8AA63
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\slider-handle-disabled.png
- Size 442B
- SHA256 e04fbcc696a2ea2a326a1b7bc57f25a0e1b33091e588889da5a9d7015c595022
- MD5 34b81abeeef2a5fcceb972f1e3cf2997
- SHA1 e262ba643aace4b66c93842989135209a7b8df85
- SHA512 e575c06e29890e63c6898b31754b419eeb73ff87d7d71d0787a8fcc3d2a30c82cdd83eb94139d9f0f25d9001da9e030d7c06ba1ea2392c191d6cd9e2112fe4f7
- TLSH T1E3F0ABDA6B9F28AA8409581A10A891228C2C1C00BC20FFCB6789B46C1570E9682C410B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 698B
- SHA256 caf54e636473e19db45d86b01fb79142bf28e916030ec3b60272a14643313460
- MD5 bac5eff99d83f1b5c73fde4cd05c9db9
- SHA1 4824a9748cce1bf329558dc887bac4a509d197b5
- SHA512 8c46a4bd86b8f5e8cc4634b6af3d4f81a5dfe7f9462fcaf6aabc818fb085cb3724508d926c84a0243c69af585c1bf9ad95e02c2ed25df38ba2107815467a18d6
- TLSH T1D90123D7505614D907412E6E436C54204DB80E1C7179B2176288F3FC497591C3CEC0AA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 935B
- SHA256 60f757e557455aef99ad54ae55c3e8d18347fdef0bdc5af176055e154e7b8f38
- MD5 2f2fb4bb6e72e89435b356a6cf44c81e
- SHA1 11f3ee2d3f0cd0dd9002b33399a714d0721abf56
- SHA512 ac4bffda40907144446200808994e35c1a8512d95f3c71fc7bf6ccb41853e7dd44f63424ae1fb592a54677fb6bb3e778335541fdc6f0720b0f990cf72af93128
- TLSH T1B91163DB3918BCD685990A2F156A3211917A5E1D2025DB23A15CB8BB0F70F88A08E88A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\slider-handle.png
- Size 493B
- SHA256 4d5d16a9ef3db072309d531e11057076bfa7b03f4f47f6bd8a7d89d1fe0bd39b
- MD5 9848e43810261e6570a4cf83c3752b4c
- SHA1 6c228608e331b9fa2cf9a44e74c7507c19af7d63
- SHA512 4fa4df1cb5e08f14d1e990280e834fface6270ed637ce1cdb1799f1e568e78be9aa7f440af1d2002c5f50e2f22a96199e1fea6d957d996d09cd05e0b2911801f
- TLSH T1BFF0A357321FEC47C904D6E888A84196EA2A7D97354A73B72A267CDC093EFD8C5C9143
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 875B
- SHA256 6001207502a85ce95a405c9100e575994dab92e04fd28c1c66eefc69c52dc3ad
- MD5 775918baa819c1f84b2d51392985de66
- SHA1 1dc21dc416d21177ccd58bdbf93596cb5ecc997a
- SHA512 98d4cabd4361dc4e2226e0a2911c918a52e51cd8ce67348d0996dac0607922776b0fc72d6a527e6d46f8c12e71c606d6fa4634db9bbd18cfcc3a4a26d317f42f
- TLSH T1B5114652DA5F1477A9B0300895DD01D0DA611E4035693AF7858A7EE94036ED71C9C3A7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 1KB
- SHA256 f38227a12d179e016f9b2696d3dc8ec4c6c96c275cfccbe839dd5ba0c51d9b26
- MD5 5eb1ce92eb912af9509c4277272943b5
- SHA1 77d4586a33e99ab715a628af2ba6adac2aa7e39d
- SHA512 b1865a0eb9fa04138ec132cefc0008f70f5f181c39e4125b694079f23feaee70c92bdc58f9f5d243cba9298785a3bd2eed35638ae4c322b2e1e0303b36b47b7d
- TLSH T1B9210AC634AE983370B15B9EA0CEC196FE862CF3092405A483DD78EA577BF8604681C7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\spinbox-background-up-hovered.png
- Size 317B
- SHA256 237ff3516492b63b2ed41562ea6e3b983f277a2375f12d427a0a7769cec15043
- MD5 d0b3581b97087f79fa2e265737f44eb1
- SHA1 34add1ba94fc3b95c7335ebd9a821487bfd6ca00
- SHA512 68125745776591cc7c9869f938c42c2b19021027aa0c1c08069e4b9cb9c4425389e88134b39558832051ad64762966642c9c07c8d71ff0979b3b5e34f2e8cf64
- TLSH T104E02BF68AD0192FC6CE8FF706680716D9212CEAB813B0145111F4191C30B0EE0DAA05
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 683B
- SHA256 349cb567bded99187024758d0cb9cda60b55227a4d7fe1763f7f41753f692d7c
- MD5 d0e50dd9b89b841d6ef1cd78d2e3d1f6
- SHA1 9018ef9ff9e0f1946be96597b5f344715efaa773
- SHA512 8d09c2d0f369a673c8d9b7092b46b0ad68320a217fd4936133727331e6125ae0129c4986c3503cccca8246058ff7b07e70cb30456f480c6950490fcaa87f4d0d
- TLSH T1B50162FB16C32956B604D0E19850B80C05397F26BE520DAF5538FD2E8472D0FE782A07
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 1KB
- SHA256 4c9186092eabc6788e704b074423e009cd3b80a8d5de0bb1ada6f7599f91bb9c
- MD5 16464a005372e7a0092f1721f96a3fb0
- SHA1 900e4a0b3744bd390f89592e236bc7e2358b16d1
- SHA512 1f854ecd6dc27978a54b4ab507c662eea0c2ad4209306b0c568b4ee8a4b2c2d37d5304eb91f180eff43db9d1ba9e1310c72a76c41312fd15de0dd3fede20b67a
- TLSH T1E0218683B5705D2B5971FE17D4284544AED18EAC3F6400EAD1B6312E3679941C35B33D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\spinbox-indicator-down-background-disabled.png
- Size 83B
- SHA256 8285acc7fe450d3a72eed1432566f7aa90af7ee33a154aa7402dc707018979b7
- MD5 abd4a5f439d8f789c9f460945c09fefd
- SHA1 dad89434297a1fcb7baa221f8c924fe1e0df9cfc
- SHA512 d73432e7014978d01ee440de8144ec6d9d62cbc3c8e040de94dc2b7c2aac4c62d5582ac3dea1c1619d7e4bb9582af8a96cdf836aa292149ae3b1bef74f5dfdf0
- TLSH T1D9A012E28F4068A8D09502778526D070C876010100B30008901A8230B540A0010C4302
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 92B
- SHA256 4a812392a115a37694707507b84dc3c789fb3880c298cce2a7d31f1d837f601f
- MD5 c710613ae2b8f9e620c1663ebb8a8de5
- SHA1 fce48edc3b6183fedf5fc3ff29c68c7afcaea290
- SHA512 c35dc15a92d3df91ba6b0a2c1458b5841f4df5dcf8706566ebd7e72e609b96e7f09c8141cd099a805234318d127e147c21cb58601781b151f6bbdf61a44ab67a
- TLSH T108B012EB56400E28C0A2013B673A8040C4B072078A310104090584305C125440544352
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 101B
- SHA256 02530ad19a6a050f2813c5d801a9fe75c9b0fbf4508491c6abb1bbdb72b28734
- MD5 27d3ae547e7e8ff9c88e8ca58a201f25
- SHA1 17a828d4ec352b0ae8b6f9aa7623baaa4a920c74
- SHA512 3f55067d9369c367a0da811f61369ab11e05026258fd80a546365b7cac776869e0bf222b79b75fcc7b0deb881e340271e084bd675efb51dd1473a510cf288dff
- TLSH T139B012D793754C3CC33481228B1C8113CB56073CE019415306499C650AB1216C3D8786
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\spinbox-indicator-down-icon-up-pressed.png
- Size 118B
- SHA256 33f189b55282b1a6d904fd2424cdc051fbd3af17b942899942fc6daf46280146
- MD5 ed93c06f00fc6df9f9a60e049ee927df
- SHA1 35443a7419b91d784a93e7e89b686a4d6577dffd
- SHA512 d2b1cd6c0f6f416dd96ee9719357d088355bd9cfdb328ebc1b96d6273cfe4652ccc37e8f66d3b654f3be4b168e881b7b2f6fd8260ca2a115fb15090af2bd8723
- TLSH T16AB09BC5D15159FCCD41317B94491220D9356D2539594FD9551A553714D5045F14130D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 164B
- SHA256 e2ee0ed4ccf6d0e468b02b83598f0487cc3167d508c6e08e6490b925d8305474
- MD5 84b1c5af5460f1468c4cd17bfb7d7ffc
- SHA1 a9c6259103be4cde24e9a85e5ebd7f663ba3db97
- SHA512 a7394e01336bee9993ee2603bd7abcd56d86e815e502fab58d52311e998ffa512d3dba9a99bfb9dc7cf935d67b779059ab1b1baf53a6c9ec63c4b05cbdd5ac82
- TLSH T16AC080E01EB7597BF3040177655AD130ADB6471459195614C1DD9D3D984910EC055513
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 211B
- SHA256 d712f165711bf5e0f265607705a4e83452c8fcbc59e106238663664f791f28e5
- MD5 26568e7446e134efd965b6b5aa29c8d9
- SHA1 12eb2e9d03ea621dec674ba3c6bfbfc80656dbeb
- SHA512 29d11aa4bdf62dd609b7753a91503d50d589ca6c12761ad4d033f55d746a0f27b582a0737c319f0f5cfc1e2a213084195f81776ca4e1c91546f1b73dfe1741e5
- TLSH T1B3D012F293403C1E89D906B5529C4545C86A4E1D9E3252626418B42C7A3698481F8762
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\spinbox-indicator-up-icon-up-hovered.png
- Size 118B
- SHA256 7109a067ad00c3cdd31365c76ea8e24264910fe9b1350a292fc00dd7d2b97e5b
- MD5 199bb6520ab013968e74e85504c8544c
- SHA1 b1ebd8627cd955e44261b6f457f0229e17ab4579
- SHA512 543501c68c73ffb92379cf0eaf29e3c9cc9c950bf158a23afd49546df25ba55aa0a85abc4b6b822923bf69558badeb2ac822541530c40829faf7064f29e4eb3d
- TLSH T1F0B09BC16165793DCB16517E9605201485755B6821851768510BF4751417055D094745
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 150B
- SHA256 50e45c5bc1f41a265ccdb7106571d751b4a875577d19c5409009fcdd0e82cfc1
- MD5 48ca0e19d6ae84a966cf0a8dd4c1ff47
- SHA1 97cfdbdd03481d1b6ae8283a7bdbbdd70d2347f6
- SHA512 b60068add983d8a3e259feb0734a0d3060bace984d5693da01d3340c64949b7662956605cee90841cb0438e22bbadb9ee9aa5539d76314946e036fff22eb95c0
- TLSH T1A7C08CE26A8BB4A4A88A022660F64320D066842482D18089A954F1F841877495847A03
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 210B
- SHA256 f85b2a74823a54b1d904d44b638204ae78301a91eabacfc1dc7f07508c384057
- MD5 a53be3f2aac6ceb758f6d7669f5d3c1f
- SHA1 86f8e6e4553dbebcc5048f5ec922da300ecb76a8
- SHA512 4b58e4c8465df0dec6e022a1f91ea481ec50ae97e9ab88deaef59fd1e42e6e0030bf80b597b2c86f2a6d53b7b7b27547a778fb9e53cc225dc3f54f5c97c0fd12
- TLSH T198D012B5B209ADBF869B0753426C8209CC014D280A461156A406722D963140E9096A86
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\light\images\combobox-indicator-hovered-open.png
- Size 125B
- SHA256 0941ec5da06f1cafe91004c1b035997609ab1eef1f39a9ac5f0bb558dd8f93eb
- MD5 a189060065cfef46d1bc5a7150b390e5
- SHA1 73f7375aa440ceec13bb16ee7416f1033e6e4400
- SHA512 393cf37bbb82c5b3b5e91f989ef84bab4ca65c907d5bf4b242f0e75a056677fb5cdd55695881f70730d950adac90712e9b6074ba3824f9a42d0aca0a00840c0e
- TLSH T1F4B02BD22230287DCF4D0333490B80008D73323D454101018D05886F251DB0500DCD32
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
- Size 171B
- SHA256 840b43337d232f04aed0b3209a43a0b25bb5f4bb53920620c7e0bcc155743daa
- MD5 c5bf70b32da28a72b9907db3192fdc55
- SHA1 6fd954665a546c517567fc708645c02a33fd3f46
- SHA512 5d7c0924eee3f2b0be4f1cb71a118905131362f5871c2973bde24ba305739db51f541f491421f88beae78f586a3a1b4fee9fbd25c5e2527f6c159fc1b7c5ee35
- TLSH T176C08CE2A220AEE5C1CE003E4289210289EA8D1C3E274102F645D435AAE110E46C679F
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
- Size 184B
- SHA256 b74cf0894a7b42aae0630586e321e3cea282724a16e1ed40322cb39014c0041f
- MD5 908266ce67b93472e143907653199c82
- SHA1 bba4cf1937a44620899437018fd8b5d6409efd05
- SHA512 7e33945d29a4f6e717e22c5eb32ab8ff9ad7900842bb08112f5ae2212fe8f01be38964cf60e1d5fa643bf998c46d478038f88e1c62c62b64c1f8bfdbd994bd34
- TLSH T170C080C7F7208DF4D598D53DA51C710949161914D936026F15E5D81D4513270855D545
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\light\images\slider-handle-disabled.png
- Size 343B
- SHA256 d0f2f23ce73f6559fa3a61f4e7c068875e321dc6aca3a0eb6a423ae94054b92a
- MD5 c193c11c9827a76d682c215d8fc81a2e
- SHA1 9f0b8a87122e7ff62cc3f62a713df9de12778cc5
- SHA512 ec4562cef1a338ed11a6cb9a214698515ff4c02d3ff7b0d7381c7480c63e52ddb50b21059b81fcf982134e210f4ce156306180506594648c5a7dc96726cd90fd
- TLSH T16CE07DB392463C1AC660AD7680185A60D329035A4CA5240F0231A99639F226B90D4D67
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
- Size 590B
- SHA256 5d2c7b18155db2f3583896fde0addccc481a816a9b36531b201bc5e31bbb35ab
- MD5 698ffb59b04034eb202468c06c4f0f2b
- SHA1 c4869724b5182e9df7da9712731d0cf83d2655fc
- SHA512 056e014b701556c9af02e53fb268b53a5a2867bbb27d02072ebdfc1424d3bda4df28432d35e9137245d79037788fbfd63eca76ccfa5723adf41fe2a07b12bfb7
- TLSH T144F0C0368B61EA28CE0904B15F148DA18E10945DDA09C23D0DA6EBC99906EBEC58217A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
- Size 780B
- SHA256 7afea33b4b6109fccad617fc05ba2ffc422bc60b02e805303e129ca9954953a1
- MD5 f0522340c01a7fe94c2774d6664674ad
- SHA1 95fc0e863573a37749d5c8c32461386d2f0e2b6b
- SHA512 d9bd3fe11d905090ea0088517b80f84cb78c608aff7366606dac0a7820d2a0945de1a219d2e94c1b959ea6131539e26096883e5f41579027dd033cd07cca7631
- TLSH T16E01E911C165A4B9CC7C007A5BD43C9075B33048D83BC129931A037431D32D28F411B6
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\light\images\slider-handle.png
- Size 513B
- SHA256 3bd1cba7b0517257de59ea097e188ebaa706b7bbfca338a29ddbec2d944c5567
- MD5 320ec974cd5352b0e0ece1548d6f658e
- SHA1 b19afe19067e1f976c34848ed9d760f68e16afbb
- SHA512 40dece1f2ec1640307a315eb6b761f2b01cd2b208c0c1a87c096778bf8d142e826d51f2cbe4351a0048603c875e364332254ef100cbe5b7b106db5a643f0b6ad
- TLSH T102F0758442C4ECB4CF87C5DD508C6924D83E5BDC8D8021A4CE504C126BC72F153E8CB3
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
- Size 1KB
- SHA256 caf1dc9e14b96d649fbc00a5210fbd0e209fee56c724ba746ea7a22edf73d5ac
- MD5 c47a860f4d6d50af02b754ecb49956ba
- SHA1 091ff88d16d313ccdec4546372153ce9e4533cae
- SHA512 a69618d04414314b026d81b6d957991df794a1e1257ab54e5fae5ab872933df77163ae148e70baf15abc847d8dd91fe3803d1242b8ba7391d93d9fd13ea616d4
- TLSH T18711252F853B3DB5C1E2057B598E56449C3746ACFA610E51054FE96A9D353A110C3A94
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
- Size 1KB
- SHA256 34a47dc79f253f27a7757d747f3402559294fe080d1409890ffaeaad1a3d7b1e
- MD5 e9d1a856239067967890d74edd779f93
- SHA1 de390dcf922397ffdb8c1a0afb7ee915266fd404
- SHA512 f2ba5e6558516c3dcde9ae20c954b2ef46cc118934ddb07153924b9f0bf2fbb71aa2508ef300653806d35eb2a6a4a9179de8ca52808558466238f8fe1ca35a6d
- TLSH T1AE31C99982C89C62CC7D4DF30AE814EA1F73154ABD742D65499218D2093B2B95B94A44
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\light\images\spinbox-background-up-hovered.png
- Size 438B
- SHA256 b690ff71125077a35907ee9df97bb986fbebb2ee82b1f443d86e25fd15738204
- MD5 59b236bbfcf80799730a41eb5db6e0d9
- SHA1 db0c6bac65a9cc0f8717447e06e16c92ca0408c6
- SHA512 14b8f4d94c53a23850d5f8414617e9cc6cab23a03f82d0d3f1f17c6e99c5f3a826cc3a4a4f3e448d7cc92a148dbde4eb659efe63d8121049f7d2f16b01938068
- TLSH T115F0FADCC450ACBCF15C743148D444782D760A9FC97941196107AC3C5C3530E0EDBD42
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
- Size 992B
- SHA256 9b1916e06dd0605a1cb61052de50cda49723e08f280dfce484b8b06d54cb1a17
- MD5 1d1c5a016cfd3ea6e3a2057599da0380
- SHA1 80023655baecfc69242efd3dc53c680b681f14a9
- SHA512 7d7165b0ab589e51fac7828300a9731688d0b50e69fe9aa366f364a5e98c14d89e62418cb8a4e9be63271f95debcb09ff4b7e2781c7c8dc5bc7d90eb54f13957
- TLSH T11D1165BF74F974AFDDA49771109818711B66D609255E4C0B930908BCC0F10885554C6B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
- Size 1KB
- SHA256 ac3911723fbc5dbd7831c4049036f4f9d5b290a52164143d9e4846fc3fa5ceb0
- MD5 9b74f84a472f3c247473daa320dc7e1a
- SHA1 e9a327d1850b175610700f50bcdba9eaf59d13e8
- SHA512 81b33dadb7213e8a3fb75e69b20e44b36432567aa6915cc4066b12b2ef4e9b094b50f994c48131534b1d416e1a04c9d040c23fac9f4aaab2a5692d98da920484
- TLSH T16731F6EA40215EEAE05F35F960DD08F8A851C03C93517012871FB8786D9A26C299315C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\light\images\spinbox-indicator-down-icon-up-pressed.png
- Size 138B
- SHA256 6291f9c78c77f1fb89dd0b43c51daa98c2ab6c98ca737c2ef1f61f1f201b4514
- MD5 432942b96cec036996b48617c5b38d4a
- SHA1 c783d444d450193cbba5de874ae323fc7395a29f
- SHA512 76d935f697e31f4521c0bfd281931bd9da0b7b1aae75806a3a5fb7c8f920bb80381fdfc988aebe2564c6cfbf07fb25a055ba69975003f79a0e72fe2999cfb9ff
- TLSH T118C02BC033D85DB48E02C37B535FB6815C2C71CC10AC204492087F726D71410E4C43C5
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
- Size 180B
- SHA256 6fd283b8c8f1c96a7b0084a475dc0915cc7db16c938858b6c2fc42a2c286107a
- MD5 4cb9524e2fd47071b240da4bd839dbf0
- SHA1 6a2e10e02b4d5544159ad40a714c6b66508b7ffc
- SHA512 c093ed39741b06489928c7a3b60c812325403d6d5daf6aeba5dbb739e52d02607679293b41c8911bebb56c8949572373fb5862c8ce36a01b933af23d5d93467c
- TLSH T1D8C0C0F893C3F8F8C9C84531754B900CFF2E1150E300301560C4903C3ED1709214D382
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
- Size 215B
- SHA256 bfdd4f412de35ced17a26b6090b41befbf11e97578a244798a475c35f1b81685
- MD5 f5c20c701ba0afaef155867a3259978f
- SHA1 bd78c42b1fbf4f7ca6ec8415e20358b09b5913d1
- SHA512 a7f553839456af8dcb8dd17ee63011548c0c015756c186c6feba293588ebe7523b8a60a043ae08feb17547b84dd69e5d014c67b79de2b9afcd1a2336eb9fb183
- TLSH T150D080DBFFD47D28D50301F7C15841EDCCE2473D29076A52D1106C395D15A0E8BC2781
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\light\images\spinbox-indicator-up-icon-up-hovered.png
- Size 131B
- SHA256 95bc4afbc55494f30ec3553ae051c73b535e9aad45426eb373cb788f25f88caa
- MD5 3340595b829e7ceebc4997ce038e90e9
- SHA1 921e0225ba2ed03be7257fa2b0ae0f958a4a1d5e
- SHA512 ef0b38ebe3b48a3e2808477c5947d44aceed6bfd238dc3cd72814c9ad664113e0b78bce8163bfa517eaaab631696b3c2844abadbb075af4aa1dad259a9e83d21
- TLSH T18DC02B83002CAC38CF4850B74342024CE6701AF011A8412F0013D0310B115ED8048709
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
- Size 164B
- SHA256 d5a68925a3626dabc5a773663cd0134ae03c908c0c8adb4381578078c3fc056e
- MD5 42fd9607554573669c87044ee3472156
- SHA1 ef6a403c0581dbc7ce08eda9f1f69152242433cc
- SHA512 4f974de0e694ed5761e318fe52f2b3112cc33b86562dd374c607047e47f31b9cccd1ed1cc743492c3042289cdb948ea0865c027cd8c77056f6232942931288df
- TLSH T176C02BEE329C7C34C314153311C59110C531A6DC6082C70B044980321DE204FC1C23D2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
- Size 206B
- SHA256 9bef876bbd6193e05e5e0ad50706ee454d1ea71da782a6f9e9bf8e5e71bb920d
- MD5 10dafc29a0983b6524f168083824daf8
- SHA1 2f5197f1e9f10ba3c9a1b4c7a1c0aec5e905bb96
- SHA512 5142031c3627f6fb4e99ec899f66e918e55b714dbeb0e4ba46be4926b0161541ce1b29153b26e98cc170875b34cb238d461b82158d50586b14e8d4eac2ca5097
- TLSH T1CED0C0C21314EF91D151443BB07E010A82203C18D44BCE0424A0A40F48F9D80EDC4692
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qml\QtQuick\Controls\Windows\impl\QuickControls2WindowsStyleImpl.qmltypes
- Size 215B
- SHA256 a96c7bf5832767bdc9d91e2290a3920aec3abfbf2e3814bce38b49483f16f84a
- MD5 2006d4b7d0da455aa4c7414653c0018a
- SHA1 6685b8360b97799aa4d6b18789bf84a343e9e891
- SHA512 703804e6fab0cf44317b7292c547a1348e2e7395e4b71367c32c3b097bcfb3344d3296179bf4ba33a4c752ae58a3873af57d8cdef35a34564205356bb4e6fd84
- TLSH T18ED02352CEECF6A313451C16C44C47E72E53D1544731AD10F05401ED714771C36ABBC5
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\qt.conf
- Size 183B
- SHA256 45494c5495a12150fddde2e6f12d40250be75ac192f7e8ad7dde0c22bed87881
- MD5 56fe505b015e6be237f070f7b18c1efe
- SHA1 92455069fc5ec2aee6cfc851795af6483287deb5
- SHA512 11a867c87db7f2c0e832fc09ecf4b870468f3af8157efe2c3e6a059b55e6968aec5be0c71d0ed23f07c64b5d22db76d6064caca3db8033c8cbc0546b698105d9
- TLSH T193C012B51039E95616B3475AD25F3E53529756862803F0C9021D81245554E3715A2655
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\quazip.dll
- Size 246KB
- SHA256 81f5bf95a25c0313b4f0de39ba955be8453f430e61b46d892e3cea73c230f4e3
- MD5 8ca14ad69c40837e533c1ddfbebec33c
- SHA1 f75eee41128aa192dd38d852d7ea6c00442a15ab
- SHA512 fe452ff770966037aab5e08a99cd7de8c532b907ba2ae9abc36bfebf1358a79bf7aee5f4182a3b1dc55a2e965ed302b8e5c9d051442266d08b37f623f33d76fa
- SSDEEP 6144:77G4g0mbDKQJU9PyM8/AdtQoCAZcjw2fCxy:77G4g0mbDKQO9JSE2ak
- TLSH T112346B9B32B60E66FDB7C13DC78B8946C2B374555346CBDB022586161F13BE13A3E268
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\vcruntime140.dll
- Size 116KB
- SHA256 a06c9ea4f815dac75d2c99684d433fbfc782010fae887837a03f085a29a217e8
- MD5 e9b690fbe5c4b96871214379659dd928
- SHA1 c199a4beac341abc218257080b741ada0fadecaf
- SHA512 00cf9b22af6ebbc20d1b9c22fc4261394b7d98ccad4823abc5ca6fdac537b43a00db5b3829c304a85738be5107927c0761c8276d6cb7f80e90f0a2c991dbcd8c
- SSDEEP 1536:BqvQFDdwFBHKaPX8YKpWgeQqbekRG7MP4ddbHecbWcmpCGtodMzDZ92zfa:BqvQFDUXqWn7CkRG7jecbWb9toaera
- TLSH T1E1C37C4573A402B7D62AC274C1E35A46EB71B5458770ABCF03B689AA0F13BE1AF3D345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Network Optix\Nx Witness\Client\6.1.2.42921\vcruntime140_1.dll
- Size 48KB
- SHA256 6d3a6cde6fc4d3c79aabf785c04d2736a3e2fd9b0366c9b741f054a13ecd939e
- MD5 eb49c1d33b41eb49dfed58aafa9b9a8f
- SHA1 61786eb9f3f996d85a5f5eea4c555093dd0daab6
- SHA512 d15905a3d7203b00181609f47ce6e4b9591a629f2bf26ff33bf964f320371e06d535912fda13987610b76a85c65c659adac62f6b3176dbca91a01374178cd5c6
- SSDEEP 768:oPIyGVrxmKqOnA4j3z6S2X7pudLAivD9zigElY7ivD9zG:XBr87uWFLpudBvpziZ1vpzG
- TLSH T176236CD057784082E9AB89B0C5E6EE577D7CF6A20B50968B07A1D1981F637C0FB3D21E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Network Optix\Nx Witness\client\6.1.2.42921\nx_vms_client_desktop.dll
- Size 36.9MB
- SHA256 165111128fe2e83a5a5ef2221641c72d6dc0645d7cc3f6b973a0440b9ed7240a
- MD5 d02f5d5b2328ad39973e6c472b960527
- SHA1 684419f88673167682032386e01e2a34a79fb1c5
- SHA512 d8988628a90ee32cfc8261899cd7254cd0b460951e74a476e9cb208e22da7c6d3350f6ca39719abdd77a0e5f1d1900c78c3f2e000877dc36d0f2609673db455f
- SSDEEP 393216:i81CyAtictMmXHiv/kMxs7qQ6eK11ldnSwcrboIyp:tCyyi+Cv/DxWqCK1ZqkIq
- TLSH T13B876C2B31A542A1D136E1BDCF6B8E56E6B23405430347DB21598B5E1F77AF80E3F9A0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{59e0d4bd-82d0-4d38-bf76-cf24090609f1}\state.rsm
- Size 888B
- SHA256 6e519b996d50ca5799abe225d9dbdc386ba76f52d97ceedaeb961d3316de124c
- MD5 2e442a11963872dbfc1128105c5523d7
- SHA1 5a4ecec83796eaea4ab8ebeaa13d5409ffb058b5
- SHA512 a423b11027b6efc0c70d825613f93314fc37166fb984ec9043306528c407649f4b0d458abd56dba9bee93fa9e9b43db384bd6cb2370280d20b84b75af2b0db7d
- TLSH T1CF113A619FE7202DE3FBAB7079F653141ABDBC211D21D12C0541605E8E22B90CE64F36
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Network Optix\Network Optix HD Witness Client\settings\local\analyticsSearchTileVisibleAttributes
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Network Optix\Network Optix HD Witness Client\settings\local\browseLogsButtonVisible
- Size 4B
- SHA256 b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b
- MD5 b326b5062b2f0e69046810717534cb09
- SHA1 5ffe533b830f08a0326348a9160afafc8ada44db
- SHA512 9120cd5faef07a08e971ff024a3fcbea1e3a6b44142a6d82ca28c6c42e4f852595bcf53d81d776f10541045abdb7c37950629415d0dc66c8d86c64a5606d32de
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Network Optix\Network Optix HD Witness Client\settings\local\lastDatabaseBackupDir
- Size 2B
- SHA256 12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126
- MD5 9d4568c009d203ab10e33ea9953a0264
- SHA1 dd29ecf524b030a65261e3059c48ab9e1ecb2585
- SHA512 64d24560970ca14d349bea0e7d2526d4754bf3283568ab4dd602bd79eb454dc3657d5bb6f9a30c90ea98d9600ebd0fb45d582f4cae3f8e3c50b0e8fb18059892
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Network Optix\Network Optix HD Witness Client\settings\local\showFisheyeCalibrationGrid
- Size 5B
- SHA256 fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa
- MD5 68934a3e9455fa72420237eb05902327
- SHA1 7cb6efb98ba5972a9b5090dc2e517fe14d12cb04
- SHA512 719fa67eef49c4b2a2b83f0c62bddd88c106aaadb7e21ae057c8802b700e36f81fe3f144812d8b05d66dc663d908b25645e153262cf6d457aa34e684af9e328d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Network Optix\Network Optix HD Witness Client\settings\local\webPageSettings
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Nx_Witness_Client_20260803020632_000_ClientPackage.log
- Size 1KB
- SHA256 c32f1890d92fc71f38e862c4373778e094d780f08822dc80b6d6068275cd4383
- MD5 153176663b02ffab51a704b4080ca573
- SHA1 c7f7cb8706572decf6aa5f34c341c81075955878
- SHA512 845a375a18ab4a2a8139d8638b237cff1ace7d21b613b0ecb34b87aa37a388f253ea9d2e927baf420b6a8190fe0a7725889fd8d9e3efc2f58e4061f8a609f60f
- TLSH T1EC4127681EF40945F1B697479EF3C053AA33FCD16934CB0C22CA875A4267D05686E77A
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSI118B.tmp
- Size 149KB
- SHA256 386a4209241d3424783e2456ef79988a1032a9f4ead891b5551253520e439ee0
- MD5 8eabeadadc6d03c9807787af28381b65
- SHA1 b5015709fb98a8a849a0440c54c07c394e89bc59
- SHA512 18ddec2d28640108faf5a4b9878cc0e6224fdc6ee26bd9fcfc2c972d0ea82a21468181c6fcc3413a99e2a9bc070e71d41c998528a324eee93ee1b59351b6f037
- SSDEEP 3072:CJdLyE16iOLin7Q4RZUKnnH1uhC7vu/2nrZ/yqMPu:CJdLT1jXZ/H1dRxt
- TLSH T171E3AE01B1D08072DABF193A5434DA725F3FB9209F508ADB53988A7D9E702C09E76B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{3A7F411B-3FEF-4219-85DD-E5576F4455DE}\.cr\nxwitness-client-6.1.2.42921-windows_x64.exe
- Size 923KB
- SHA256 49ba47553b1634563d2db468bb124dd0dd82e33b303d5700cb10c0c50fe3349c
- MD5 2211debe8d9d504345679b65f0bebc16
- SHA1 2be1822b4c99e274a8f1cb16484b050dd621c8ff
- SHA512 112bf41bff3b9247be7122fb8fad02589953e1cba8f63dc8d1d811e4204949b63e194716fef47f056fbcb3fd6d55ea555455e13f9182d00b0bc0814760a99d17
- SSDEEP 12288:+3mgqnIZuYfCYqFet4CovkM7fknEINBwPyjFhsHr/jWl:+3WnIZuMCxezot7fM4PyXBl
- TLSH T176152B201010C572DFE5163276B84730E93CBF2197EF82AE95E6BA48EA79C9C25F31D5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{4F95723F-8C48-4B05-ACB2-04BC4F765ADB}\.ba\installer_bg.png
- Size 37KB
- SHA256 fb31933db9d3d9344058582233f388efb68620fbd79463f882f83526fad088f4
- MD5 9f124524d4fdebb29d35d721a973fa38
- SHA1 c7fb30ef75c96e1c02f0a0d598bb52235a45e747
- SHA512 b74e4b81b0b60c40143e664277b36c38032876172c1e02211facfe267e24bb7b25b5605e4b123269b267b9ef23564a2ac0c4451a82c6526384c2619b906297b4
- SSDEEP 768:GTjGC024eAU+nrGaEeAdP9YSimFxWYmlyEiKwzhMgIoJxTpXxo+R1/Nx+X:GTjb2U+nrGa0dPx84AGMgI8xTpXj1/NA
- TLSH T12003E020AEB5F8DD86E4B43EE3B12AF19305952BE090C145D9F04D0A2DA1952FDDDE3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{4F95723F-8C48-4B05-ACB2-04BC4F765ADB}\.ba\logo-102x102.png
- Size 3KB
- SHA256 aa31348a1b4e84ddc31bdf0f451809e36b115b406f189d1fe28ca0e83bd23ea1
- MD5 4d1d01ab3b10ef40c33ba0194105ba77
- SHA1 fe30c9e43e94ee0d4c3586ce24c077334dbac648
- SHA512 5b1b06d99974127ab31115e10ccf43dafeacb0d3de0e3e0f28c3be9ceb9850fa9c6845586167ad4275395305623d0d64a54b57588b2b04a18b753d4bcd193c97
- TLSH T1EF616CD7925DA95356BF8BB306A508387AA215433772A6C0449B30BF4216E247B74FA0
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{4F95723F-8C48-4B05-ACB2-04BC4F765ADB}\.ba\logo-64x64.png
- Size 1KB
- SHA256 3f171f9d2ff0944141ad2e3fbaac4969f041b4d724d5e57577092c26dfc0d0d2
- MD5 76f41c75bf97d967255a144b5086db99
- SHA1 04fa045086c099295b220c516abafd1de320a134
- SHA512 a884996f1e2e39e53ea067247d1e6450eadba2d2e4f9143d1837ea934c3364487086c6130d2ba0c35d3511846cc9cfcf6fb581fe0b7df408ec44d020e9f6148b
- TLSH T1F7410CECBB243B947188BB2C549BE4E2CCE2668C002987D8B1B1784783E628531DD1E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{4F95723F-8C48-4B05-ACB2-04BC4F765ADB}\.ba\wixstdba.dll
- Size 205KB
- SHA256 b7de0a0ca3a94738747abd708e30ba1f9638a8c8b7d8173c76d4f39fae3d9346
- MD5 87c8a7ea44e8ee0d9358e25b7dcd397d
- SHA1 0e2021be823fee499175d2c0d68346d15c02a376
- SHA512 98b5bbe5bb3ec331a0025e3da209296050b2f695be5a4b90b5c939f8fbbaada6dd93483eba779c10151546c2798aab5282fa619a55ec0cf04f56a03795a0a3f5
- SSDEEP 3072:tEIwsGi6eTe5uBR3SupIu+ieZpKamkOLCaQuEsSyhssS2KPjbfkd4qhgTrm9b3EJ:tEZdi6e93SuDeTKZxQfsRy26BqbUHF
- TLSH T18524AE12F5D0907AEBFB1930593AA6206DBDB9200FA0C9CE53486D2B6E705C1DB36737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{4F95723F-8C48-4B05-ACB2-04BC4F765ADB}\ClientPackage
- Size 1.8MB
- SHA256 190a4b48522097a74c2ab03d3571e4d8656562cfb7e42937cf9ae6cb71b792a1
- MD5 04f3254de11c7ac9eab33d9cef7975df
- SHA1 281024a2bd2e082401d7e5e699ff8b2ed60a36f1
- SHA512 214821fa6311dfbfe767b1ba32a0fd951470968cfcabc6aa04c1a542597782491b78ec1a4f22573b1d3080b2e96caef03067cb666e1a275588e04c9d54f200f3
- SSDEEP 24576:ZYX0NMQJCmYLZCm9Z5bSWvZgkjdoJED8OqTXOzoV:ZtNMQEJZ52WvZgkjdoJETq
- TLSH T122952804B661C37BEC624031829D0FB1DA367CA1875343664BB9B54EDF3757C822AADE
- MD5 SHA1 SHA512 SSDEEP TLSH