Analysis

  • max time kernel
    91s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    16/10/2022, 08:07

General

  • Target

    flexvdi-client-3.1.5-x86_64.exe

  • Size

    10.9MB

  • MD5

    5654c6e758797b2b1fa5943e2f153703

  • SHA1

    aa85b9af79bf46569ee718760ab5d82a1d5e7a61

  • SHA256

    3b2e361e0dd284b24127bb7c97aefeb6a5911141063af455ad49cfe47418bda7

  • SHA512

    240362a58245a556d2583c781756661e807769c7876e0a0854e0adcda86d55d354ee9852e0f929ac2140d3101d1d3a8a4ca7272873dac7d265ad246e5d8b5b91

  • SSDEEP

    196608:GVIttAJulOoP8OCv2z96BcmUD4ZH5gaBpG26Ayrxpqw9ExGBQj5OaPJSdf:4o5lBffz9Vm447TG6yrxKB5OaPJU

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 61 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\flexvdi-client-3.1.5-x86_64.exe
    "C:\Users\Admin\AppData\Local\Temp\flexvdi-client-3.1.5-x86_64.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:112
    • C:\Program Files\flexVDI Client\bin\flexvdi-client.exe
      "C:\Program Files\flexVDI Client\bin\flexvdi-client.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1108

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\flexVDI Client\bin\flexvdi-client.exe

    Filesize

    143KB

    MD5

    d1f5b44271479725ef006e08898644f2

    SHA1

    c9ff98a2e227eb36be1c67fb9bc733cc2e5d63a4

    SHA256

    864116cb6ccc4fd796b11963c4cfb75f01e5e7840f820b55c1f9d0e60857a498

    SHA512

    99ecc37df5e86b92a31ae87986e20ba4a9dff4dcad580c6e96da5c4908f331ce801e7a0279b5e53168f556b27a399921d93521e9d8cfa59583985ce2504f0f19

  • C:\Program Files\flexVDI Client\bin\libbz2.dll

    Filesize

    75KB

    MD5

    bf4d8fab7a10c715aa6333edbb7f52b2

    SHA1

    15f12732837c8a39b0f244e47f37b77813edcb30

    SHA256

    ec301b40e181d5e4cba51859efcb75bdf0ade54545dd3f837eab4f3eb8f2eca4

    SHA512

    202694a9ad917976d11916fff6dd66814a1f4967c0f6d9a866284d51120e243970f5a8acb95557e44b3de0b77307a249708fdd0e5d2760fafef6cc653da7f76c

  • C:\Program Files\flexVDI Client\bin\libcairo-2.dll

    Filesize

    917KB

    MD5

    4746e0e68a97116f337dc6133d71dcae

    SHA1

    2d058b6a63e91abed3bbc2b0bfd820f2e504e999

    SHA256

    053cbde9034c59d38f06d116017adcecfc1987c81b27496001400b89ec8e6eaa

    SHA512

    f6cd6dde87d133f3629a3cd8555fca6041bf0fe2d87c5ed15c4eada31a7d8b22053fdf2e37226f67a933dcd6ba4a927eedac77c584a921a07fdf89c4c2a42b7e

  • C:\Program Files\flexVDI Client\bin\libcairo-gobject-2.dll

    Filesize

    35KB

    MD5

    24443798c8ffe3a1b5c01f98ce84fd71

    SHA1

    683d4da1b1af77925bcc7da920197d668fa5df60

    SHA256

    042f5d44ec7bec799cd3315b8a5c4b2aeb1e36cffb3d46a60b8c0a54ec710438

    SHA512

    de07c722d231dcca2b239ad392412aeaa519e2e2681edc1ff1393d0700c733495ad3f3bb2bbe3fbe834d0b38307b15b68ceadc9e963a55f386da069c954db5c8

  • C:\Program Files\flexVDI Client\bin\libepoxy-0.dll

    Filesize

    1.6MB

    MD5

    1734c6eed7faf3daa36df13b76b27e1f

    SHA1

    510335fc5d1dc9fd962b7ea86ead093f54a52a69

    SHA256

    3e88d413a51b91439253a2e18582330a0e60234decde7c6bca47dfdd6fe3bd82

    SHA512

    7ba05297c6bfa6bc2ad4778b02319f50f7110bff6e50d0dfdc3e457e4b914f09c2d81e13f68e71e862f659874f42f958064a6935940a28e2cfc574c4c024dc68

  • C:\Program Files\flexVDI Client\bin\libexpat-1.dll

    Filesize

    222KB

    MD5

    6679dfa0aea15a15491349a1b749d798

    SHA1

    d2002bfad34acd13094c92f695eb02816c637d2f

    SHA256

    7ec3769e0bb5de6534c631d5b0df127080de807611157658e72e0786484b27c1

    SHA512

    e71afadc1481fe8f9074b3c680191e11511ca504535fe7b5268bf738b98001ef13e82aa97e3c9f2a9a61e8927d30e5f3e1c688cab2015e64402a723402a5c617

  • C:\Program Files\flexVDI Client\bin\libffi-7.dll

    Filesize

    33KB

    MD5

    cbd1b8ce4d989d4c5b89bba816855c0e

    SHA1

    e5ce5f2f0467e8ff6f423999ee95e7203fef8a71

    SHA256

    3b2d885aa42971a6748b9e47bb4e7147f4e27a9a87eb1edad5aba96ea7307d66

    SHA512

    dd271cf1765cb0f9576f66979f50bf4382d9974885d8f6bf5160d210e9b7f7f335867f74bf8943d3f3d6945d1acd2b17652b7588bf08890dbca92853c48ea909

  • C:\Program Files\flexVDI Client\bin\libfontconfig-1.dll

    Filesize

    254KB

    MD5

    de00fcedd9197e929816669cb594f1f2

    SHA1

    451ed0bc133703d06c2a599bdf9fd7e3f6201bc8

    SHA256

    026f6cc23aca46e1a34754200721cda4655e35c7e61298b9dd83f3ffe66f01bd

    SHA512

    56a8c3063f44b80bd85145c49e3b03f51a4b7bf06241f6970ff7bdfd5dee0f6406dfed8c16befb580e1b552d6d44d154ec3ee1432d37170fd1f0a3e22daa9854

  • C:\Program Files\flexVDI Client\bin\libfreetype-6.dll

    Filesize

    591KB

    MD5

    4c1eccdbc0e3c62cde5a601e0f970184

    SHA1

    53a7e8790f8b86938c9b9cb74128953176a1fbe2

    SHA256

    5f59923db48f6c3af37f450c7d1361fb71ef8a869937965cb74975c2178d5498

    SHA512

    0b89d32fd6c44e0867792f1bde4d4d5dbb0d50a7cfb04c59ad67f6ac4dd2388cebe11261fb903b44d48316ecd280cacc434ed6873c73cf66d6909bb45b1cdb2a

  • C:\Program Files\flexVDI Client\bin\libfribidi-0.dll

    Filesize

    116KB

    MD5

    aa90fd517d9821144735a980b0382069

    SHA1

    b67e165fc6228eaa3f7f450f9186fbaf1cfaeb7a

    SHA256

    c18efc1cac054a059acbabcbcad36153d4b95fade0b25cc5e114fd37f9109f63

    SHA512

    4d8e966476a0a6ca3fc04f7ceed80f35c0918d43adc51b73c0d4161226d04fa1efa0b393702d63432d2dcb2b2fa829fbc7ed7c2c5e80e725e914add29ccfccb7

  • C:\Program Files\flexVDI Client\bin\libgcc_s_seh-1.dll

    Filesize

    80KB

    MD5

    e3738d1be4db057193f875912d147f9c

    SHA1

    9081df283988917e2b2ff9219bb91bfe06cc8086

    SHA256

    62cf126824a0edadbfafe9788c224f9804237192179fbbc279e780ee984f78d3

    SHA512

    8bb223d72c054e33c60795a8cd52c4453fc447bc1a5c4bbe74040c7122a46e89600cfbc1808b5074f66b3097b4ad94d218cc00e2e29a2983c6b814159071273f

  • C:\Program Files\flexVDI Client\bin\libgdk-3-0.dll

    Filesize

    1.1MB

    MD5

    dc840fc0deea57d2fefd78081967ad03

    SHA1

    884a12f920be758f1155bdc83ee1c7ed5da1dfe0

    SHA256

    6916046c4a9da034f7060c62b0a68ea4c05e80ebb5b4e0766360483a930b08c5

    SHA512

    942a6ec8296dda61e9df9b562fbde3a87d9a429f9a194d61ffae3b422118a9634f36322eee90c1a96ab0d63af87df683a08fa2f02e5d50758e80fe7b4b21b201

  • C:\Program Files\flexVDI Client\bin\libgdk_pixbuf-2.0-0.dll

    Filesize

    291KB

    MD5

    a0eba7c5001ec8c6bf5b9c3dcbae6757

    SHA1

    9b77227fbae38fdf6b8c364ea45fa686dd100f02

    SHA256

    1198b870fee69bd9090caad75b075706be7871cbb235b6fbc6be0cfc6d74025b

    SHA512

    cb42bab569182caee013c9df4adae045d9d41331a141d4dd1815a68d7b82f0f229163f2a19af6dbfbddf2cf0f4a3b3e9d830ca9e48d8dfca179e47fd642b5ae1

  • C:\Program Files\flexVDI Client\bin\libgio-2.0-0.dll

    Filesize

    1.3MB

    MD5

    6036c48b45d418a11887954e4164b232

    SHA1

    63b482dc2b002cc48e81ad860e143e53385b33ab

    SHA256

    f73e7da4cfb860a9a4bb9d7559ff11b84334de629bbeff24bd41bd0f42621393

    SHA512

    250261bf601b216177aa5ee5fac6afc230ea806f8e6b96268231f39c4674df60a443c38c6042ad19e8635dd311525628e8d5463f40dbbad863c28c4757e0b6e1

  • C:\Program Files\flexVDI Client\bin\libglib-2.0-0.dll

    Filesize

    1.2MB

    MD5

    b843b0190f791344d501c445c6dbde9c

    SHA1

    a34a64142ec0437cca1a25adeb996eed9a361725

    SHA256

    e5d6147e9b80c5449039a745e06f9e134b1637858bbd498aaf03ff55613bc1ca

    SHA512

    858448f5da6d5561c750237ef566da1844ef17937644374834c1eff557c18b255f8bcb71fd8796a23809b0167cf93f2d61a8bea92d5629e13c56b6033dc6e57b

  • C:\Program Files\flexVDI Client\bin\libgmodule-2.0-0.dll

    Filesize

    24KB

    MD5

    051bfea90de7a773d5f1ce6b84b9bc73

    SHA1

    69b0ff2b5b936b09e9ee34e635b1ec59f1d510f6

    SHA256

    5b693315c61e9614b0b28a046edb67382b40bbf348053b0268311a5fd7e89f81

    SHA512

    a910cc6427f788aafa8ad29696c58538b9ee301497ef4ef1cc7f746eb5add1c879b92d86086a19c26afaa31adf062fd2aecff55a441e7ade655a2a270f26345b

  • C:\Program Files\flexVDI Client\bin\libgobject-2.0-0.dll

    Filesize

    302KB

    MD5

    b55d9d1220b7e9d8387dd54dc2f42ca7

    SHA1

    f9db920885fb53f402748fd10c52471cfb3f9a56

    SHA256

    61bdc9f59b65e5e62a622a8115ef4e6bbc1b1cac7fdab9a1a74b9b986302ae43

    SHA512

    fbe8ea8cdeacb08e93ff2ed969e7c8277b3cd2966c9d50137e01d66c6ef56fee64727478d8bd85b630aea36537fb5006d24ad8c02640c826dc562debc0881ca5

  • C:\Program Files\flexVDI Client\bin\libharfbuzz-0.dll

    Filesize

    971KB

    MD5

    e2ebb2a7207f172db89db0669cea6105

    SHA1

    630080bee1587202652796316bb01f9ad9e55e9a

    SHA256

    a5707b55adf3644965dcfe58e2f61cadb199ace081952a4f443025bc3cbfe54d

    SHA512

    2d30b1105ca3e0286923b78d373ac303ef2b08450171a7e8a1a188d6e8a2d371223dcfcf19e7976f88b140ea3c0b9d11638a4520bbc234d5694e8158aa783024

  • C:\Program Files\flexVDI Client\bin\libintl-8.dll

    Filesize

    17KB

    MD5

    c4766340a9bb41fbf5422df6ecd3a23a

    SHA1

    521ac78b7175d13d4c3be067f8fd06a87938477e

    SHA256

    7a8913c4afeb6b0b12a4d2def66f8bf4d73e9954899599c9fb6341e050697bd2

    SHA512

    5d3fc338de789f9caa90349d867f981579c13f486d60aac168101f92d33498ebc1b00b0f5e1e572d7de92fbd35a0d6cafa3bc425bd59dd467a33be9af745497c

  • C:\Program Files\flexVDI Client\bin\libjpeg-8.dll

    Filesize

    400KB

    MD5

    b2831c06f0036733e6965e0a3b51f2b1

    SHA1

    f7a47e9cc9217832b54f0c33cfffcc1967d56e4a

    SHA256

    103cc5d7415da4b51190c257f73e111dfea98ec1ac7912e1d6a52eacc4ce7e5e

    SHA512

    69e8c6769780ca8e2cce91c518f16c18f43f86b799ed8a93f0aa414f1064326cb7182cdf833c29fa7c4a1e51e1000c49aecc5229a007319d1f269427a65dbe57

  • C:\Program Files\flexVDI Client\bin\libpango-1.0-0.dll

    Filesize

    247KB

    MD5

    103c0722ec31b86da084f4eeea3adf4d

    SHA1

    a5099d6bb426c91555947205e16c3cd4df7ce10f

    SHA256

    746014e89cccfdef35d4b10122b87ee0ea40097c848a17122f306975df85233f

    SHA512

    90330d993eceba3dd5a7b3dd4f0d6560f68428c1714c29f05c0c9d15195bacb9b4c927ecb4d7066dc973f7f67b577ae9ba146b5d092cb7acfbf7e9a3830a9b2f

  • C:\Program Files\flexVDI Client\bin\libpangocairo-1.0-0.dll

    Filesize

    59KB

    MD5

    138be3bedffb8b5c8b0f07e5d5aa36c7

    SHA1

    0f8635914fd6c7b3c15f4b4fe9096d339bc14b0a

    SHA256

    6b3227752e10e4e8ab48b9a09f8f01d890bb73ed3d3830e5e5c7d38141c5ee96

    SHA512

    cd03a1875cecacd6978b0c8ca78d4fc439f6384517af2a9f0e303b8fc84b66ef8916c1318bf725752d9add6f004d4ad2322c7346de30049b67d8957de8a7f2aa

  • C:\Program Files\flexVDI Client\bin\libpangoft2-1.0-0.dll

    Filesize

    77KB

    MD5

    698ca20e9fe708c15f63ce6fe8fa062c

    SHA1

    88154e3a2837acff6ecd0794b8c322793e1dada9

    SHA256

    f7ffa892c31c70adb4ce738740ab543f6406019dcdb99b9443aa799fba548154

    SHA512

    f264c5754ffe91d9004cc55c7a06e77e025f6e30d67551d6adeffbfb94db154ba477397c8a9fd6544ee1f383899b59a8bbcf49b49189c047bfb1b0a49ed667a9

  • C:\Program Files\flexVDI Client\bin\libpangowin32-1.0-0.dll

    Filesize

    89KB

    MD5

    f9d3cdfe890cef2f18fd15fd07f47376

    SHA1

    93b5e82d12af8645fa4f6f090adc6ea124027571

    SHA256

    51df783cc382d9ca01bd2cb14bf1f03a07153b606c1c76177a37d03ad37de3c3

    SHA512

    250b607c69d97bf9c5c413d7c9318efc519d91c91e3babcefe7008c073310d5693f243b9b043cff1b9c4fda10788da405b4ce13a188f6df15e688875c9b13433

  • C:\Program Files\flexVDI Client\bin\libpixman-1-0.dll

    Filesize

    638KB

    MD5

    ecee7828f9ec4232e0dec641e44a356a

    SHA1

    4693780825cbe45bf3211da1197e0fe41c852e0b

    SHA256

    74034868fd2a91f92f886d7fcdbb23c37f49ac1be913d08578aa740aeba1705b

    SHA512

    cba3a76279d7d1919d29ab3aee1196c64559199d7a523020cea0b8493ac5ffd082b5d7701961f6826a4ddb008461adda8b05cc01977735f1f5b6d29d37e988c1

  • C:\Program Files\flexVDI Client\bin\libpng16-16.dll

    Filesize

    215KB

    MD5

    abb32e0b2dbde0cd20d42e3f1104f6a5

    SHA1

    aac7047c97004093af68bcff08c5aa1edaf806b9

    SHA256

    cf1b7766b3fc900e224cd2d130cda801d4b69c1e72452057d3567868ed5bc37e

    SHA512

    965e81486d68743356603b40aa8827c075336f853d27c5a0128fb577c4ef8746bfdd42013b878d6e15324bac42c15dbb5edadc5cbd47b6f3ec7991f78b265836

  • C:\Program Files\flexVDI Client\bin\libtiff-5.dll

    Filesize

    437KB

    MD5

    960b6f2a0c94a4224357147b2ee43404

    SHA1

    c86da53acb3c5b6261ccb76abd6b9825d02454d5

    SHA256

    ac0fc6ee7119963aa92e66f6b7dc3f3b25a8588dc182fd8d514b484f5c3c38a8

    SHA512

    76dffd42edb054d8ae22836e9607bdf5c7bbb07667083ac07fc34eef59826e0ad84ce889896833659c5070f3cf5ee761e7fb081ce247749896c910249f27d33a

  • C:\Program Files\flexVDI Client\bin\libwinpthread-1.dll

    Filesize

    79KB

    MD5

    56c14b6b12ba50752b2a2c6dec1e1e75

    SHA1

    5c31809e1999f0b5b04ee878524175463c8c4c99

    SHA256

    9557856c55ade1247180aa651efb532999845da9909cc44e4e6d94c8912fbda2

    SHA512

    b9641f29277cb955a21d85032d727bd920f44b9741525bbebe9b746036864e0e35cdc0a66b30716c7c5a87075fe2243ee5fdec70881162b2f883d83a2d9fb681

  • C:\Program Files\flexVDI Client\bin\libz-1.dll

    Filesize

    90KB

    MD5

    70a147a499826840d43384df56c1cf1e

    SHA1

    6ec2498b93e29bc26d5c5a0f2ccc9d34c081d798

    SHA256

    12edadac81ad30ca806df0ab63ac779ee2679ee2dff75fe5dec03c7027f3b6e7

    SHA512

    0bbc42271f2517993b24540d3c252bf029d42cff0c67edbeab7327a5b316fce78cc2d931e3b14795155ccb0d47ab8bd658057480b27c509372ef3d54a09f55a9

  • \Program Files\flexVDI Client\bin\flexvdi-client.exe

    Filesize

    143KB

    MD5

    d1f5b44271479725ef006e08898644f2

    SHA1

    c9ff98a2e227eb36be1c67fb9bc733cc2e5d63a4

    SHA256

    864116cb6ccc4fd796b11963c4cfb75f01e5e7840f820b55c1f9d0e60857a498

    SHA512

    99ecc37df5e86b92a31ae87986e20ba4a9dff4dcad580c6e96da5c4908f331ce801e7a0279b5e53168f556b27a399921d93521e9d8cfa59583985ce2504f0f19

  • \Program Files\flexVDI Client\bin\flexvdi-client.exe

    Filesize

    143KB

    MD5

    d1f5b44271479725ef006e08898644f2

    SHA1

    c9ff98a2e227eb36be1c67fb9bc733cc2e5d63a4

    SHA256

    864116cb6ccc4fd796b11963c4cfb75f01e5e7840f820b55c1f9d0e60857a498

    SHA512

    99ecc37df5e86b92a31ae87986e20ba4a9dff4dcad580c6e96da5c4908f331ce801e7a0279b5e53168f556b27a399921d93521e9d8cfa59583985ce2504f0f19

  • \Program Files\flexVDI Client\bin\flexvdi-client.exe

    Filesize

    143KB

    MD5

    d1f5b44271479725ef006e08898644f2

    SHA1

    c9ff98a2e227eb36be1c67fb9bc733cc2e5d63a4

    SHA256

    864116cb6ccc4fd796b11963c4cfb75f01e5e7840f820b55c1f9d0e60857a498

    SHA512

    99ecc37df5e86b92a31ae87986e20ba4a9dff4dcad580c6e96da5c4908f331ce801e7a0279b5e53168f556b27a399921d93521e9d8cfa59583985ce2504f0f19

  • \Program Files\flexVDI Client\bin\libbz2.dll

    Filesize

    75KB

    MD5

    bf4d8fab7a10c715aa6333edbb7f52b2

    SHA1

    15f12732837c8a39b0f244e47f37b77813edcb30

    SHA256

    ec301b40e181d5e4cba51859efcb75bdf0ade54545dd3f837eab4f3eb8f2eca4

    SHA512

    202694a9ad917976d11916fff6dd66814a1f4967c0f6d9a866284d51120e243970f5a8acb95557e44b3de0b77307a249708fdd0e5d2760fafef6cc653da7f76c

  • \Program Files\flexVDI Client\bin\libcairo-2.dll

    Filesize

    917KB

    MD5

    4746e0e68a97116f337dc6133d71dcae

    SHA1

    2d058b6a63e91abed3bbc2b0bfd820f2e504e999

    SHA256

    053cbde9034c59d38f06d116017adcecfc1987c81b27496001400b89ec8e6eaa

    SHA512

    f6cd6dde87d133f3629a3cd8555fca6041bf0fe2d87c5ed15c4eada31a7d8b22053fdf2e37226f67a933dcd6ba4a927eedac77c584a921a07fdf89c4c2a42b7e

  • \Program Files\flexVDI Client\bin\libcairo-gobject-2.dll

    Filesize

    35KB

    MD5

    24443798c8ffe3a1b5c01f98ce84fd71

    SHA1

    683d4da1b1af77925bcc7da920197d668fa5df60

    SHA256

    042f5d44ec7bec799cd3315b8a5c4b2aeb1e36cffb3d46a60b8c0a54ec710438

    SHA512

    de07c722d231dcca2b239ad392412aeaa519e2e2681edc1ff1393d0700c733495ad3f3bb2bbe3fbe834d0b38307b15b68ceadc9e963a55f386da069c954db5c8

  • \Program Files\flexVDI Client\bin\libepoxy-0.dll

    Filesize

    1.6MB

    MD5

    1734c6eed7faf3daa36df13b76b27e1f

    SHA1

    510335fc5d1dc9fd962b7ea86ead093f54a52a69

    SHA256

    3e88d413a51b91439253a2e18582330a0e60234decde7c6bca47dfdd6fe3bd82

    SHA512

    7ba05297c6bfa6bc2ad4778b02319f50f7110bff6e50d0dfdc3e457e4b914f09c2d81e13f68e71e862f659874f42f958064a6935940a28e2cfc574c4c024dc68

  • \Program Files\flexVDI Client\bin\libexpat-1.dll

    Filesize

    222KB

    MD5

    6679dfa0aea15a15491349a1b749d798

    SHA1

    d2002bfad34acd13094c92f695eb02816c637d2f

    SHA256

    7ec3769e0bb5de6534c631d5b0df127080de807611157658e72e0786484b27c1

    SHA512

    e71afadc1481fe8f9074b3c680191e11511ca504535fe7b5268bf738b98001ef13e82aa97e3c9f2a9a61e8927d30e5f3e1c688cab2015e64402a723402a5c617

  • \Program Files\flexVDI Client\bin\libffi-7.dll

    Filesize

    33KB

    MD5

    cbd1b8ce4d989d4c5b89bba816855c0e

    SHA1

    e5ce5f2f0467e8ff6f423999ee95e7203fef8a71

    SHA256

    3b2d885aa42971a6748b9e47bb4e7147f4e27a9a87eb1edad5aba96ea7307d66

    SHA512

    dd271cf1765cb0f9576f66979f50bf4382d9974885d8f6bf5160d210e9b7f7f335867f74bf8943d3f3d6945d1acd2b17652b7588bf08890dbca92853c48ea909

  • \Program Files\flexVDI Client\bin\libfontconfig-1.dll

    Filesize

    254KB

    MD5

    de00fcedd9197e929816669cb594f1f2

    SHA1

    451ed0bc133703d06c2a599bdf9fd7e3f6201bc8

    SHA256

    026f6cc23aca46e1a34754200721cda4655e35c7e61298b9dd83f3ffe66f01bd

    SHA512

    56a8c3063f44b80bd85145c49e3b03f51a4b7bf06241f6970ff7bdfd5dee0f6406dfed8c16befb580e1b552d6d44d154ec3ee1432d37170fd1f0a3e22daa9854

  • \Program Files\flexVDI Client\bin\libfreetype-6.dll

    Filesize

    591KB

    MD5

    4c1eccdbc0e3c62cde5a601e0f970184

    SHA1

    53a7e8790f8b86938c9b9cb74128953176a1fbe2

    SHA256

    5f59923db48f6c3af37f450c7d1361fb71ef8a869937965cb74975c2178d5498

    SHA512

    0b89d32fd6c44e0867792f1bde4d4d5dbb0d50a7cfb04c59ad67f6ac4dd2388cebe11261fb903b44d48316ecd280cacc434ed6873c73cf66d6909bb45b1cdb2a

  • \Program Files\flexVDI Client\bin\libfribidi-0.dll

    Filesize

    116KB

    MD5

    aa90fd517d9821144735a980b0382069

    SHA1

    b67e165fc6228eaa3f7f450f9186fbaf1cfaeb7a

    SHA256

    c18efc1cac054a059acbabcbcad36153d4b95fade0b25cc5e114fd37f9109f63

    SHA512

    4d8e966476a0a6ca3fc04f7ceed80f35c0918d43adc51b73c0d4161226d04fa1efa0b393702d63432d2dcb2b2fa829fbc7ed7c2c5e80e725e914add29ccfccb7

  • \Program Files\flexVDI Client\bin\libgcc_s_seh-1.dll

    Filesize

    80KB

    MD5

    e3738d1be4db057193f875912d147f9c

    SHA1

    9081df283988917e2b2ff9219bb91bfe06cc8086

    SHA256

    62cf126824a0edadbfafe9788c224f9804237192179fbbc279e780ee984f78d3

    SHA512

    8bb223d72c054e33c60795a8cd52c4453fc447bc1a5c4bbe74040c7122a46e89600cfbc1808b5074f66b3097b4ad94d218cc00e2e29a2983c6b814159071273f

  • \Program Files\flexVDI Client\bin\libgdk-3-0.dll

    Filesize

    1.1MB

    MD5

    dc840fc0deea57d2fefd78081967ad03

    SHA1

    884a12f920be758f1155bdc83ee1c7ed5da1dfe0

    SHA256

    6916046c4a9da034f7060c62b0a68ea4c05e80ebb5b4e0766360483a930b08c5

    SHA512

    942a6ec8296dda61e9df9b562fbde3a87d9a429f9a194d61ffae3b422118a9634f36322eee90c1a96ab0d63af87df683a08fa2f02e5d50758e80fe7b4b21b201

  • \Program Files\flexVDI Client\bin\libgdk_pixbuf-2.0-0.dll

    Filesize

    291KB

    MD5

    a0eba7c5001ec8c6bf5b9c3dcbae6757

    SHA1

    9b77227fbae38fdf6b8c364ea45fa686dd100f02

    SHA256

    1198b870fee69bd9090caad75b075706be7871cbb235b6fbc6be0cfc6d74025b

    SHA512

    cb42bab569182caee013c9df4adae045d9d41331a141d4dd1815a68d7b82f0f229163f2a19af6dbfbddf2cf0f4a3b3e9d830ca9e48d8dfca179e47fd642b5ae1

  • \Program Files\flexVDI Client\bin\libgio-2.0-0.dll

    Filesize

    1.3MB

    MD5

    6036c48b45d418a11887954e4164b232

    SHA1

    63b482dc2b002cc48e81ad860e143e53385b33ab

    SHA256

    f73e7da4cfb860a9a4bb9d7559ff11b84334de629bbeff24bd41bd0f42621393

    SHA512

    250261bf601b216177aa5ee5fac6afc230ea806f8e6b96268231f39c4674df60a443c38c6042ad19e8635dd311525628e8d5463f40dbbad863c28c4757e0b6e1

  • \Program Files\flexVDI Client\bin\libglib-2.0-0.dll

    Filesize

    1.2MB

    MD5

    b843b0190f791344d501c445c6dbde9c

    SHA1

    a34a64142ec0437cca1a25adeb996eed9a361725

    SHA256

    e5d6147e9b80c5449039a745e06f9e134b1637858bbd498aaf03ff55613bc1ca

    SHA512

    858448f5da6d5561c750237ef566da1844ef17937644374834c1eff557c18b255f8bcb71fd8796a23809b0167cf93f2d61a8bea92d5629e13c56b6033dc6e57b

  • \Program Files\flexVDI Client\bin\libgmodule-2.0-0.dll

    Filesize

    24KB

    MD5

    051bfea90de7a773d5f1ce6b84b9bc73

    SHA1

    69b0ff2b5b936b09e9ee34e635b1ec59f1d510f6

    SHA256

    5b693315c61e9614b0b28a046edb67382b40bbf348053b0268311a5fd7e89f81

    SHA512

    a910cc6427f788aafa8ad29696c58538b9ee301497ef4ef1cc7f746eb5add1c879b92d86086a19c26afaa31adf062fd2aecff55a441e7ade655a2a270f26345b

  • \Program Files\flexVDI Client\bin\libgobject-2.0-0.dll

    Filesize

    302KB

    MD5

    b55d9d1220b7e9d8387dd54dc2f42ca7

    SHA1

    f9db920885fb53f402748fd10c52471cfb3f9a56

    SHA256

    61bdc9f59b65e5e62a622a8115ef4e6bbc1b1cac7fdab9a1a74b9b986302ae43

    SHA512

    fbe8ea8cdeacb08e93ff2ed969e7c8277b3cd2966c9d50137e01d66c6ef56fee64727478d8bd85b630aea36537fb5006d24ad8c02640c826dc562debc0881ca5

  • \Program Files\flexVDI Client\bin\libharfbuzz-0.dll

    Filesize

    971KB

    MD5

    e2ebb2a7207f172db89db0669cea6105

    SHA1

    630080bee1587202652796316bb01f9ad9e55e9a

    SHA256

    a5707b55adf3644965dcfe58e2f61cadb199ace081952a4f443025bc3cbfe54d

    SHA512

    2d30b1105ca3e0286923b78d373ac303ef2b08450171a7e8a1a188d6e8a2d371223dcfcf19e7976f88b140ea3c0b9d11638a4520bbc234d5694e8158aa783024

  • \Program Files\flexVDI Client\bin\libintl-8.dll

    Filesize

    17KB

    MD5

    c4766340a9bb41fbf5422df6ecd3a23a

    SHA1

    521ac78b7175d13d4c3be067f8fd06a87938477e

    SHA256

    7a8913c4afeb6b0b12a4d2def66f8bf4d73e9954899599c9fb6341e050697bd2

    SHA512

    5d3fc338de789f9caa90349d867f981579c13f486d60aac168101f92d33498ebc1b00b0f5e1e572d7de92fbd35a0d6cafa3bc425bd59dd467a33be9af745497c

  • \Program Files\flexVDI Client\bin\libjpeg-8.dll

    Filesize

    400KB

    MD5

    b2831c06f0036733e6965e0a3b51f2b1

    SHA1

    f7a47e9cc9217832b54f0c33cfffcc1967d56e4a

    SHA256

    103cc5d7415da4b51190c257f73e111dfea98ec1ac7912e1d6a52eacc4ce7e5e

    SHA512

    69e8c6769780ca8e2cce91c518f16c18f43f86b799ed8a93f0aa414f1064326cb7182cdf833c29fa7c4a1e51e1000c49aecc5229a007319d1f269427a65dbe57

  • \Program Files\flexVDI Client\bin\libpango-1.0-0.dll

    Filesize

    247KB

    MD5

    103c0722ec31b86da084f4eeea3adf4d

    SHA1

    a5099d6bb426c91555947205e16c3cd4df7ce10f

    SHA256

    746014e89cccfdef35d4b10122b87ee0ea40097c848a17122f306975df85233f

    SHA512

    90330d993eceba3dd5a7b3dd4f0d6560f68428c1714c29f05c0c9d15195bacb9b4c927ecb4d7066dc973f7f67b577ae9ba146b5d092cb7acfbf7e9a3830a9b2f

  • \Program Files\flexVDI Client\bin\libpangocairo-1.0-0.dll

    Filesize

    59KB

    MD5

    138be3bedffb8b5c8b0f07e5d5aa36c7

    SHA1

    0f8635914fd6c7b3c15f4b4fe9096d339bc14b0a

    SHA256

    6b3227752e10e4e8ab48b9a09f8f01d890bb73ed3d3830e5e5c7d38141c5ee96

    SHA512

    cd03a1875cecacd6978b0c8ca78d4fc439f6384517af2a9f0e303b8fc84b66ef8916c1318bf725752d9add6f004d4ad2322c7346de30049b67d8957de8a7f2aa

  • \Program Files\flexVDI Client\bin\libpangoft2-1.0-0.dll

    Filesize

    77KB

    MD5

    698ca20e9fe708c15f63ce6fe8fa062c

    SHA1

    88154e3a2837acff6ecd0794b8c322793e1dada9

    SHA256

    f7ffa892c31c70adb4ce738740ab543f6406019dcdb99b9443aa799fba548154

    SHA512

    f264c5754ffe91d9004cc55c7a06e77e025f6e30d67551d6adeffbfb94db154ba477397c8a9fd6544ee1f383899b59a8bbcf49b49189c047bfb1b0a49ed667a9

  • \Program Files\flexVDI Client\bin\libpixman-1-0.dll

    Filesize

    638KB

    MD5

    ecee7828f9ec4232e0dec641e44a356a

    SHA1

    4693780825cbe45bf3211da1197e0fe41c852e0b

    SHA256

    74034868fd2a91f92f886d7fcdbb23c37f49ac1be913d08578aa740aeba1705b

    SHA512

    cba3a76279d7d1919d29ab3aee1196c64559199d7a523020cea0b8493ac5ffd082b5d7701961f6826a4ddb008461adda8b05cc01977735f1f5b6d29d37e988c1

  • \Program Files\flexVDI Client\bin\libpng16-16.dll

    Filesize

    215KB

    MD5

    abb32e0b2dbde0cd20d42e3f1104f6a5

    SHA1

    aac7047c97004093af68bcff08c5aa1edaf806b9

    SHA256

    cf1b7766b3fc900e224cd2d130cda801d4b69c1e72452057d3567868ed5bc37e

    SHA512

    965e81486d68743356603b40aa8827c075336f853d27c5a0128fb577c4ef8746bfdd42013b878d6e15324bac42c15dbb5edadc5cbd47b6f3ec7991f78b265836

  • \Program Files\flexVDI Client\bin\libtiff-5.dll

    Filesize

    437KB

    MD5

    960b6f2a0c94a4224357147b2ee43404

    SHA1

    c86da53acb3c5b6261ccb76abd6b9825d02454d5

    SHA256

    ac0fc6ee7119963aa92e66f6b7dc3f3b25a8588dc182fd8d514b484f5c3c38a8

    SHA512

    76dffd42edb054d8ae22836e9607bdf5c7bbb07667083ac07fc34eef59826e0ad84ce889896833659c5070f3cf5ee761e7fb081ce247749896c910249f27d33a

  • \Program Files\flexVDI Client\bin\libwinpthread-1.dll

    Filesize

    79KB

    MD5

    56c14b6b12ba50752b2a2c6dec1e1e75

    SHA1

    5c31809e1999f0b5b04ee878524175463c8c4c99

    SHA256

    9557856c55ade1247180aa651efb532999845da9909cc44e4e6d94c8912fbda2

    SHA512

    b9641f29277cb955a21d85032d727bd920f44b9741525bbebe9b746036864e0e35cdc0a66b30716c7c5a87075fe2243ee5fdec70881162b2f883d83a2d9fb681

  • \Program Files\flexVDI Client\bin\libz-1.dll

    Filesize

    90KB

    MD5

    70a147a499826840d43384df56c1cf1e

    SHA1

    6ec2498b93e29bc26d5c5a0f2ccc9d34c081d798

    SHA256

    12edadac81ad30ca806df0ab63ac779ee2679ee2dff75fe5dec03c7027f3b6e7

    SHA512

    0bbc42271f2517993b24540d3c252bf029d42cff0c67edbeab7327a5b316fce78cc2d931e3b14795155ccb0d47ab8bd658057480b27c509372ef3d54a09f55a9

  • \Program Files\flexVDI Client\uninstall.exe

    Filesize

    178KB

    MD5

    d367b028b160a27e66c3368b479484e2

    SHA1

    a9072e1bf1f5831156daef24fe635473e299f433

    SHA256

    c2882f39188fdc1d66a54f66911d04ae0d5f8418e33b70c01913da70abb3abdf

    SHA512

    f05cb84c5a49bd0166caf7edc27d2ce42082ad7ac0469d8d4e7b4eaf6102d80f05af9f8d9a99f5135e67dbf3d24d8015fbe7240666bb9cd2def5c98e4fb1f82b

  • \Users\Admin\AppData\Local\Temp\nsd24F1.tmp\LangDLL.dll

    Filesize

    7KB

    MD5

    e5fbf4d860220d35005442ce9254b2d2

    SHA1

    12dc8aebe5922cf68193149ca744a2dd65171334

    SHA256

    378fca352e2649f8e0f0f50f0389b2262d790d12c1c0c1ed3e695f74f289562c

    SHA512

    e251758ebad149f73abcbe3d5c6fb8b3e0006b17185934aa8a1713a827b9c33230c83f20935e499d4db21017343d44ed7b373d8df3c3670c79e9c3417295af47

  • \Users\Admin\AppData\Local\Temp\nsd24F1.tmp\StartMenu.dll

    Filesize

    10KB

    MD5

    725e2a4f066f431a8e664e21e69045b3

    SHA1

    7c20eb1168e3c73dea2cc20bf8bddc70d8d9b809

    SHA256

    fb8631f1b5ea75d2a82641a861bb79cb0e0fefec44a5219487b3f45427a529df

    SHA512

    e18e19ddcea7b6cafda5e0aad84aea77cfe3758cfad4e232a2dd4df958d154bc93b0f14a01f02fc982d94980522deb533d5c4362b598b04eb2ca79b38963ac76

  • \Users\Admin\AppData\Local\Temp\nsd24F1.tmp\System.dll

    Filesize

    27KB

    MD5

    749e3f0bb4233e5be530487fbd85d06c

    SHA1

    fbff07bc5569340266ad43be65b10da7392d679f

    SHA256

    edd2e9f1faa7a3f0d730043717ed1682fc0fef885e87baf90e38323b834191c3

    SHA512

    49717293b7eaf5bbdc1e8024c1f675e682f45f6984854f88f707ef5fcbb6b4cefea41f37a03b1f2bb52ca5d8d8a9afca3ccb7a1d15e13736755f6e7c47064359

  • \Users\Admin\AppData\Local\Temp\nsd24F1.tmp\nsDialogs.dll

    Filesize

    12KB

    MD5

    6a47606acc197b91ebc4093a877f8868

    SHA1

    44aada47b777339e48fe787e91794099f1deda6b

    SHA256

    c3371ba23259d7ce5baaa1e8884f3035001c0627e09682524b4ba2e935e71111

    SHA512

    bb7c3672e6ff6f994123fc3ee6a289d0125996994dd20b9a75eb941c3e2f54bf1e6d51c178b53af8c8668d155f34c1d4bcd7126848d428c82922c44cf5e6bd1a

  • memory/112-54-0x0000000074C11000-0x0000000074C13000-memory.dmp

    Filesize

    8KB

  • memory/1108-103-0x0000000000660000-0x00000000007C2000-memory.dmp

    Filesize

    1.4MB

  • memory/1108-121-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

    Filesize

    8KB

  • memory/1108-122-0x00000000002C0000-0x00000000003C7000-memory.dmp

    Filesize

    1.0MB