Windows Analysis Report
Broker_Service_x64.msi

Overview

General Information

Sample name: Broker_Service_x64.msi
Analysis ID: 1529042
MD5: 2d8222e63cc0a2d86d80a57d26347c84
SHA1: 8d762e32f294bc971873f031027393520ac0161d
SHA256: 991636b9ba9a4a528e0267de74cad67012fe031dc5b859a9a7a32a1303b90dd8
Infos:

Detection

Score: 30
Range: 0 - 100
Whitelisted: false
Confidence: 20%

Signatures

Changes security center settings (notifications, updates, antivirus, firewall)
Modifies Internet Explorer zone settings
Modifies Internet Explorer zonemap settings
Query firmware table information (likely to detect VMs)
Yara detected Generic Downloader
AV process strings found (often used to terminate AV products)
Adds / modifies Windows certificates
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks for available system drives (often done to infect USB drives)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains capabilities to detect virtual machines
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
May sleep (evasive loops) to hinder dynamic analysis
Modifies existing windows services
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Stores large binary data to the registry

Classification

Source: ccauthcpp_dynamic.dll.4.dr Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_16f64683-e
Source: C:\Windows\System32\msiexec.exe Window detected: WixUI_Bmp_DialogI &accept the terms in the License Agreement&Print&Back&InstallCancelCITRIX LICENSE AGREEMENTUse of this component is subject to the Citrix license or terms of service covering the Citrix product(s) and/or service(s) with which you will be using this component. This component is licensed for use only with such Citrix product(s) and/or service(s).CTX_code EP_R_A10352779Please read the Citrix Broker Service License Agreement
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddIns Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\UpdateScripts Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\zh-CN Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ImportScripts Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\ManagedMachine Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\ManagedMachine\v2.5.0.0 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\ThirdParty Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\ThirdParty\v2.5.0.0 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\CitrixMachineCreation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\CitrixMachineCreation\v1.0.0.0 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\32 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\32\ccauthcpp_dynamic.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\64 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\64\ccauthcpp_dynamic.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ActiveDirectory.SiteManagement.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ADIdentityInterService.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\AlwaysOnTracing.man Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\AlwaysOnTracing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\amd64 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\amd64\libccauth.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.Utilities.AssemblyResolver.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.Authentication.Models.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Avro.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.Aws.Batcher.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSPlugin.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.EBS.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.EC2.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.IdentityManagement.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.S3.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.SecurityToken.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Azure.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Azure.Identity.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Setup Scripts Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Setup Scripts\BackupDesktopServerKeys.ps1 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BaseDAL.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\BlankVhdTemplate.vhd Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\BlankVhdTemplate.vhd Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\BlankVhdTemplate.vhd Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\BlankVhdTemplate.vhd Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\BlankVhdTemplate.vhd Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BouncyCastle.Cryptography.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerAdminQuery.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerAdminService.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerCde.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerCdeLibrary.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerComponentCommon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerComponent.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerDAL.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerEnvTests.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerEventsProvider.man Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerFiltering.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerSDKDefinition.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerSDKLogic.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerService.exe.config.orig Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerServiceEventLogResources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerServiceSupport.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\Castle.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Castle.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Castle.Windsor.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\CbpConstants.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\CbpControllerSdk.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\CbpTypes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\CdeEvents.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\CdeLibrary.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Diagnostics.Tracing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Networking.WebSocket.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Networking.WebSocket.pdb Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.Xaxd.Authentication.Models.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.DistributedTracing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.Xaxd.NgsTunnel.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.Utilities.AssemblyResolver.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.Utilities.EnumCache.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.Utils.Strings.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.ADIdentity.DataModel.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Base.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Broker.CasCommandQueuePayload.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.AgentFoundation.Common.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.AgentFoundation.Common.Classic.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.AgentFoundation.OnPremiseCommon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.AgentFoundation.OnPremiseContracts.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Core.Api.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Diagnostics.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Logging.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Monitoring.ApplicationInsights.Shared.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Redis.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Security.CCAuth.Managed.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.ServiceRuntime.ApiClient.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.ServiceRuntime.Configuration.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Trust.Api.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Utilities.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.ConfigLogging.Wcf.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.ConfigurationLogging.Rest.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Configuration.Rest.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.DelegatedAdmin.Rest.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Monitor.BrokerCodes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.DelegatedAdminInterfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.DistributedTracing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.ServiceCommon.KeySharingInterfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.ServiceCore.Common.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.Utilities.Sids.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HCL.DistributedTracing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Host.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Common.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.HostView.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Models.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Wcf.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Wcf.Types.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.IconConverter.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.IdentityManagement.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.IdentityManagement.Logging.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.IdentityManagement.Utilities.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.MachineCreationAPI.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.MachineCreationAPI.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.ManagedMachineAPI.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.ManagedMachineAPI.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.ManagedMachineAPI.HostView.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.ManagedMachinePluginFinder.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.OperationalEvents.Broker.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.OperationalEvents.Common.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Services.ServiceHosting.WindowsServiceHostingApi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Services.ServiceLocator.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Trust.Library.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.CasConfigClient.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.CasEventHubClient.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.CasInterfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.Common.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.AspNet.CitrixCloud.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.AspNet.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.CitrixCloudCommon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.Interfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.Models.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.Profiles.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.CasDispatcher.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cdf.Net.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cloud.AclStore.Rest.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cloud.ServiceRegistry.Grpc.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cloud.ServiceRegistry.Rest.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cloud.VirtualSiteRegistry.Rest.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Common.Headers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Compression.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Compression.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Compression.Interfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Exporter.NewRelic.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Exporter.Cas.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.Wcf.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.Tc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.WebSocket.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.Wcf.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.Http.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Exceptions.Common.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Exceptions.Interfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Grpc.Client.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Grpc.Common.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Hostname.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Hostname.Interfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Logging.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Posh.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.RateLimiting.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.RateLimiting.Wcf.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Rest.Client.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Rest.Client.Interfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Retry.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Signer.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Tenancy.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Tenancy.Interfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utilities.AssemblyResolver.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utilities.EnumCache.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Collections.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.DateTime.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Dynamic.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Events.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Minimatch.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Networking.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Objectpool.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Reflection.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Retry.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.SecretBuffer.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Serialization.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Strings.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.Xaxd.Utils.Strings.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.StrongName.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Uri.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Windows.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Wcf.Client.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Wcf.Client.Interfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.XenDesktop.Cloud.DataStore.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.XenDesktop.Cloud.DataStore.Models.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\de Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\de\CloudCommon.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\es Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\es\CloudCommon.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\fr Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\fr\CloudCommon.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\ja Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\ja\CloudCommon.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\zh-CN Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\zh-CN\CloudCommon.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\CloudCommon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ComponentInterface.Constants.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ComponentInterface.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ConfigLoggingSupport.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Setup Scripts\ConfigureHighAvailabilityService.ps1 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ControllerDAL.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ControllerInterfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\CookComputing.XmlRpcV2.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\CredentialSecurity64.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\cs Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\cs\Microsoft.VisualStudio.Threading.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\cs\Microsoft.VisualStudio.Validation.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\CtxAdmin.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\CtxMcp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\CtxSta.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\CustomProvisioningCommon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\BrokerServiceSupport.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\Citrix.Base.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\Citrix.CloudServices.Core.Api.Client.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\Citrix.IconConverter.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\ConfigLoggingSupport.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\FmaCommonEnvTests.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\FmaConfigLoggingClient.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\GpAnalyzer.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\GpDocument.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\GpfxSettings.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.Edm.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.OData.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.Services.Client.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.SqlClient.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.SqlServer.Management.SqlParser.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.VisualStudio.Threading.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.VisualStudio.Validation.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\System.Spatial.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ImportScripts\Default.zip Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\DelegatedAdminSupport.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\DiscUtils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\DiscUtils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\DiscUtils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\DiscUtils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\DiscUtils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\DiscUtils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.DistributedTracing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\DnsIpSupport.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\DocumentFormat.OpenXml.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\UpdateScripts\downgrade_site_7.41.1100.0-7.41.100.0.xdu Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\BrokerServiceSupport.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\Citrix.Base.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\Citrix.CloudServices.Core.Api.Client.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\Citrix.IconConverter.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\ConfigLoggingSupport.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\FmaCommonEnvTests.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\FmaConfigLoggingClient.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\GpAnalyzer.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\GpDocument.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\GpfxSettings.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.Data.Edm.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.Data.OData.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.Data.Services.Client.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.Data.SqlClient.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.SqlServer.Management.SqlParser.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.VisualStudio.Threading.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.VisualStudio.Validation.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\System.Spatial.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\EventLogCodeGenHelper.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\EventLog.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaAbstractions.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaActiveDirectory.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaActiveDirectory.Interfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaCommandLine.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaCommandQueues.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaCommonEnvTests.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaConfigLoggingClient.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaConfigLoggingClientInterService.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaConfigLoggingShared.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaDalAttributes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaDalExceptions.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaDalRuntime.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaDependencyInjection.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaEnv.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaEnv.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaEnvTestInterfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaEnv.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaEventLog.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaFeature.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaFeature.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaFiltering.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaFilteringSdkSupport.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaIdentity.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaIdentity.Interfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.Interface.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.Models.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaLogging.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaLogging.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaLogging.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaPlugin.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaProductInfo.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaRegistry.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaRegistry.Interface.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaSchemaProbeDal.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaSchemaTools.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaSecretEncryption.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaSecretEncryptionManager.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.DelegatedAdmin.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Features.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Ism.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.KeySharing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Logging.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.ServiceControl.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.ServiceDiscovery.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.ServiceRegistration.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Settings.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSite.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSite.Interface.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSiteManager.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSiteProvider.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceControlInterface.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaServiceStatus.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceStatus.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaSiteServices.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaSiteServicesSupport.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaSqlScriptBuilder.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaSqlUtils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaTransactionScope.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FMAUtils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaUtils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaUtils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaWcf.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\BrokerServiceSupport.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\Citrix.Base.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\Citrix.CloudServices.Core.Api.Client.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\Citrix.IconConverter.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\ConfigLoggingSupport.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\FmaCommonEnvTests.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\FmaConfigLoggingClient.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\GpAnalyzer.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\GpDocument.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\GpfxSettings.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.Data.Edm.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.Data.OData.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.Data.Services.Client.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.Data.SqlClient.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.SqlServer.Management.SqlParser.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.VisualStudio.Threading.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.VisualStudio.Validation.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\System.Spatial.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Google.Api.CommonProtos.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Google.Protobuf.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\GpAnalyzer.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\GpContracts.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\GpDocument.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\GpfxSettings.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\GpXmlSchema.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\grpc_csharp_ext.x64.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\grpc_csharp_ext.x86.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Grpc.Core.Api.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Grpc.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Grpc.Net.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Grpc.Net.Common.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HypervisorCommunicationsLibrary.Contracts.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.HCL.DistributedTracing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HCL.DistributedTracing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\Citrix.HCL.DistributedTracing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.HCL.DistributedTracing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\Citrix.HCL.DistributedTracing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HypervisorCommunicationsLibrary.Models.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HCL.Shared.Contracts.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HCL.TlsCertificateVerification.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.HCL.TlsCertificateVerification.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\HighAvailabilityEventsProvider.man Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ControlScripts Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ControlScripts\HighAvailabilityServiceControl.psm1 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\HighAvailabilityServiceEventLogResources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\HostingManagementComponent.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HypervisorCommunicationsLibrary.AddInSideAdapter.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\HostSideAdapters Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\HostSideAdapters\Citrix.HypervisorCommunicationsLibrary.HostSideAdapter.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.Wcf.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.Wcf.Types.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\HypervisorsCommon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\HypervisorsCommon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\HypervisorsCommon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\HypervisorsCommon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\HypervisorsCommon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\HypervisorsCommon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\i386 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\i386\libccauth.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\IBrokerAdminQuery.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\IBrokerDAL.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\IBrokerDALInternal.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\IControllerDAL.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\IControllerDALInternal.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ICwcSupport.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\IDnsIpSupport.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\IEdgeProxySupport.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ILeasingControl.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSConfiguration Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSConfiguration\InstanceTypes.xml Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSConfiguration\InstanceTypes.xsd Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Interop.GPMGMTLib.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Interop.NetFwTypeLib.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\iobfuncdll.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ISdkLogic.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ISecondaryBrokerControl.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\it Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.Edm.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.OData.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.Services.Client.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.SqlClient.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.SqlServer.Management.SqlParser.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.VisualStudio.Threading.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.VisualStudio.Validation.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\it\System.Spatial.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\BrokerServiceSupport.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\Citrix.Base.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\Citrix.CloudServices.Core.Api.Client.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\Citrix.IconConverter.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\ConfigLoggingSupport.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\FmaCommonEnvTests.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\FmaConfigLoggingClient.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\GpAnalyzer.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\GpDocument.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\GpfxSettings.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.Edm.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.OData.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.Services.Client.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.SqlClient.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.SqlServer.Management.SqlParser.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.VisualStudio.Threading.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.VisualStudio.Validation.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\System.Spatial.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ko Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.Edm.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.OData.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.Services.Client.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.SqlClient.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.SqlServer.Management.SqlParser.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.VisualStudio.Threading.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.VisualStudio.Validation.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ko\System.Spatial.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\LhcUtils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Licensing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\LicPolEng.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.ManagedMachineAPI.AddInSideAdapter.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.ManagedMachineAPI.Contracts.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\HostSideAdapters\Citrix.ManagedMachineAPI.HostSideAdapter.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Microsoft.Bcl.AsyncInterfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Microsoft.Extensions.Logging.Abstractions.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Microsoft.Extensions.ObjectPool.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Microsoft.Extensions.ObjectPool.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.ApplicationInsights.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.AspNetCore.Http.Abstractions.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.AspNetCore.Http.Features.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.AspNetCore.SystemWebAdapters.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.KeyVault.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.KeyVault.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.KeyVault.WebKey.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.Services.AppAuthentication.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.Storage.Blob.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.Storage.Common.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Bcl.AsyncInterfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Bcl.HashCode.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.Edm.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.OData.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.Services.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.SNI.arm64.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.SNI.x64.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.SNI.x86.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.Tools.Sql.BatchParser.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Deployment.Compression.Cab.dll Jump to behavior
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\logging\cdf_sharp\win\anycpu-release__\obj\release\net472\Citrix.Diagnostics.Tracing.pdb source: BrokerService.exe, 0000001D.00000002.1915055457.00000194AB472000.00000002.00000001.01000000.0000001E.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\utils\assembly_resolver\anycpu-release__\obj\release\net472\Citrix.Xaxd.Utilities.AssemblyResolver.pdb source: BrokerService.exe, 0000001D.00000002.1909505618.00000194911D2000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\RemoteHCLClient\anycpu-release__\obj\release\net472\RemoteHCLClient.pdb(} source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Libraries\Cbp\CbpControllerSdk\anycpu-release__\obj\release\net472\CbpControllerSdk.pdb source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Shared\LhcUtils\anycpu-release__\obj\release\net472\LhcUtils.pdb source: BrokerService.exe, 0000001D.00000002.1909945480.0000019491282000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\BrokerComponent\anycpu-release__\obj\release\net472\BrokerComponent.pdb source: BrokerService.exe, 0000001F.00000002.2558857309.0000025451C32000.00000002.00000001.01000000.0000004C.sdmp
Source: Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.ValueTuple/net47\System.ValueTuple.pdb62P2 B2_CorDllMainmscoree.dll source: BrokerService.exe, 0000001F.00000002.2549401679.000002544F472000.00000002.00000001.01000000.00000036.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaSids\anycpu-release__\obj\release\net472\Citrix.Fma.Sdk.Utilities.Sids.pdb source: BrokerService.exe, 0000001F.00000002.2555275324.0000025451652000.00000002.00000001.01000000.00000046.sdmp
Source: Binary string: Microsoft.Data.SqlClient.SNI.pdb source: Microsoft.Data.SqlClient.SNI.x64.dll.4.dr, Microsoft.Data.SqlClient.SNI.x86.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\Wpnbr\anycpu-release__\obj\release\net472\Wpnbr.pdbQ source: BrokerService.exe, 0000001D.00000002.1917130914.00000194AB772000.00000002.00000001.01000000.00000030.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\CtxAdmin\anycpu-release__\obj\release\net472\CtxAdmin.pdb source: BrokerService.exe, 0000001D.00000002.1916802918.00000194AB6C2000.00000002.00000001.01000000.0000002C.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.ServiceRegistration\anycpu-release__\obj\release\net472\FmaServiceCommon.ServiceRegistration.pdb source: BrokerService.exe, 0000001F.00000002.2555021751.0000025451632000.00000002.00000001.01000000.00000045.sdmp
Source: Binary string: /_/artifacts/obj/System.Security.Permissions/Release/net462/System.Security.Permissions.pdbSHA256 source: System.Security.Permissions.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\ICwcSupport\anycpu-release__\obj\release\net472\ICwcSupport.pdbX4r4 d4_CorDllMainmscoree.dll source: ICwcSupport.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\GroupPolicy\GpAnalyzer\Analyzer\anycpu-release__\obj\release\net472\GpAnalyzer.pdbH source: GpAnalyzer.dll.4.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Rest.ClientRuntime\Release\net461\Microsoft.Rest.ClientRuntime.pdbSHA256TS- source: Microsoft.Rest.ClientRuntime.dll.4.dr
Source: Binary string: X:\src\HelperPackages\Bootstrap\Bootstrap_CA\wh32\retail\vc80\static\bootstrap_ca.pdbH source: MSIDD31.tmp.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\XmlMultiplexer\anycpu-release__\obj\release\net472\XmlMultiplexer.pdb source: BrokerService.exe, 0000001D.00000002.1916476987.00000194AB682000.00000002.00000001.01000000.00000029.sdmp
Source: Binary string: /_/obj/src/Microsoft/SqlServer/Management/CollectorEnum/Release/net462/Microsoft.SqlServer.Management.CollectorEnum.pdb source: Microsoft.SqlServer.Management.CollectorEnum.dll.4.dr
Source: Binary string: Microsoft.Data.SqlClient.SNI.pdbGCTL source: Microsoft.Data.SqlClient.SNI.x64.dll.4.dr, Microsoft.Data.SqlClient.SNI.x86.dll.4.dr
Source: Binary string: T:\altsrc\github\grpc\workspace_csharp_ext_windows_x64\cmake\build\x64\grpc_csharp_ext.pdb source: grpc_csharp_ext.x64.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaRegistry.Interface\anycpu-release__\obj\release\netstandard2.0\FmaRegistry.Interface.pdbL6f6 X6_CorDllMainmscoree.dll source: BrokerService.exe, 0000001D.00000002.1910001253.0000019491292000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\CtxMcp\anycpu-release__\obj\release\net472\CtxMcp.pdb source: BrokerService.exe, 0000001D.00000002.1917548815.00000194ABA52000.00000002.00000001.01000000.00000032.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\DiscUtils\src\anycpu-release__\obj\release\net472\DiscUtils.pdb source: DiscUtils.dll4.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.VirtualSite\anycpu-release__\obj\release\net472\FmaServiceCommon.VirtualSite.pdb source: BrokerService.exe, 0000001F.00000002.2554388742.00000254515D2000.00000002.00000001.01000000.00000042.sdmp, FmaServiceCommon.VirtualSite.dll.4.dr
Source: Binary string: c:\projects\nlog\NLog.ManualFlush\obj\Release\NLog.ManualFlush.pdb source: NLog.ManualFlush.dll.4.dr
Source: Binary string: C:\jenkins\workspace\AuthX\Build-Custom\Build-CCAuthCpp-Master\cmake_windows_32\src\Release\ccauthcpp_dynamic.pdb source: ccauthcpp_dynamic.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaEnv\anycpu-release__\obj\release\netstandard2.0\FmaEnv.pdb source: BrokerService.exe, 0000001D.00000002.1912083012.00000194AB262000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: /_/artifacts/obj/System.Security.Principal.Windows/net461-Windows_NT-Release/System.Security.Principal.Windows.pdb source: BrokerService.exe, 0000001F.00000002.2555493326.0000025451972000.00000002.00000001.01000000.00000047.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\CDE\BrokerCdeLibrary\anycpu-release__\obj\release\net472\BrokerCdeLibrary.pdb source: BrokerService.exe, 0000001D.00000002.1909749981.0000019491232000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: /_/artifacts/obj/System.ServiceProcess.ServiceController/Release/net462/System.ServiceProcess.ServiceController.pdbSHA256) source: BrokerService.exe, 0000001D.00000002.1912129198.00000194AB272000.00000002.00000001.01000000.00000013.sdmp, System.ServiceProcess.ServiceController.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\SDK\BrokerAdminService\anycpu-release__\obj\release\net472\BrokerAdminService.pdb source: BrokerAdminService.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\RemoteHCLClient\anycpu-release__\obj\release\net472\RemoteHCLClient.pdb source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp
Source: Binary string: Citrix.Networking.WebSocket.pdb.7818E375_CB2C_4E80_99E7_4C40D0D5718B source: Broker_Service_x64.msi
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\distributed_tracing\exporter\newrelic\anycpu-release__\obj\release\net472\Citrix.Xaxd.DistributedTracing.Exporter.NewRelic.pdb source: Citrix.Xaxd.DistributedTracing.Exporter.NewRelic.dll.4.dr
Source: Binary string: /_/artifacts/obj/System.Security.Principal.Windows/net461-Windows_NT-Release/System.Security.Principal.Windows.pdbSHA256zqXL source: BrokerService.exe, 0000001F.00000002.2555493326.0000025451972000.00000002.00000001.01000000.00000047.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.KeySharingInterfaces\anycpu-release__\obj\release\net472\Citrix.Fma.Sdk.ServiceCommon.KeySharingInterfaces.pdb source: Citrix.Fma.Sdk.ServiceCommon.KeySharingInterfaces.dll.4.dr
Source: Binary string: C:\jenkins\workspace\CitrixCloud\Build\Src\Logging\obj\Release\netstandard2.0\Citrix.CloudServices.Logging.pdb source: Citrix.CloudServices.Logging.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaRegistry.Interface\anycpu-release__\obj\release\netstandard2.0\FmaRegistry.Interface.pdb source: BrokerService.exe, 0000001D.00000002.1910001253.0000019491292000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\DistributedTracing\anycpu-release__\obj\release\netstandard2.0\Citrix.Fma.Sdk.DistributedTracing.pdb source: BrokerService.exe, 0000001D.00000002.1914666070.00000194AB422000.00000002.00000001.01000000.0000001A.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\DAL\IBrokerDAL\anycpu-release__\obj\release\net472\IBrokerDAL.pdb source: IBrokerDAL.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.ManagedMachineAPI\anycpu-release__\obj\release\net472\Citrix.ManagedMachineAPI.pdb source: BrokerService.exe, 0000001F.00000002.2553794425.0000025450D72000.00000002.00000001.01000000.0000003E.sdmp
Source: Binary string: D:\a\_work\1\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb source: System.Memory.dll0.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\ICwcSupport\anycpu-release__\obj\release\net472\ICwcSupport.pdb source: ICwcSupport.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaEventLog\anycpu-release__\obj\release\net472\FmaEventLog.pdb< source: BrokerService.exe, 0000001F.00000002.2553006670.00000254506D2000.00000002.00000001.01000000.00000038.sdmp
Source: Binary string: C:\workspace-analytics\workspace-analytics\Output\AnyCPU\Citrix.WorkspaceAnalytics.CasInterfaces\obj\Debug\Citrix.WorkspaceAnalytics.CasInterfaces.pdb source: Citrix.WorkspaceAnalytics.CasInterfaces.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\ActiveDirectory\FmaActiveDirectory\anycpu-release__\obj\release\netstandard2.0\FmaActiveDirectory.pdb.y source: BrokerService.exe, 0000001F.00000002.2556875287.0000025451A92000.00000002.00000001.01000000.0000004A.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Shared\VirtualSites\anycpu-release__\obj\release\net472\VirtualSites.pdb source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\SDK\BrokerSDKDefinition\anycpu-release__\obj\release\netstandard2.0\BrokerSDKDefinition.pdb source: BrokerService.exe, 0000001F.00000002.2556016980.00000254519F2000.00000002.00000001.01000000.00000049.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\utils\events\anycpu-release__\obj\release\netstandard2.0\Citrix.Xaxd.Utils.Events.pdb source: BrokerService.exe, 0000001F.00000002.2553584343.0000025450D52000.00000002.00000001.01000000.0000003C.sdmp
Source: Binary string: /_/artifacts/obj/Microsoft.Win32.Registry/net461-Windows_NT-Release/Microsoft.Win32.Registry.pdb source: BrokerService.exe, 0000001D.00000002.1912963441.00000194AB382000.00000002.00000001.01000000.00000014.sdmp, Microsoft.Win32.Registry.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaTransactionScope\anycpu-release__\obj\release\netstandard2.0\FmaTransactionScope.pdb source: BrokerService.exe, 0000001D.00000002.1913930609.00000194AB3E2000.00000002.00000001.01000000.00000018.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.PluginRegistrationTool\anycpu-release__\obj\release\net472\RegisterPlugins.pdb source: RegisterPlugins.exe, 00000022.00000000.1925697735.000002B30D5F2000.00000002.00000001.01000000.00000035.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\hostname\interfaces\anycpu-release__\obj\release\netstandard2.0\Citrix.Xaxd.Hostname.Interfaces.pdb9,S, E,_CorDllMainmscoree.dll source: Citrix.Xaxd.Hostname.Interfaces.dll.4.dr
Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.Logging.Abstractions/Release/net462/Microsoft.Extensions.Logging.Abstractions.pdbSHA256 source: BrokerService.exe, 0000001D.00000002.1914867354.00000194AB442000.00000002.00000001.01000000.0000001C.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\WorkerChannelFactoryLoader\anycpu-release__\obj\release\net472\WorkerChannelFactoryLoader.pdb source: BrokerService.exe, 0000001F.00000002.2553979605.0000025450D82000.00000002.00000001.01000000.0000003F.sdmp
Source: Binary string: /_/obj/src/Microsoft/SqlServer/Management/CollectorEnum/Release/net462/Microsoft.SqlServer.Management.CollectorEnum.pdb@aZa La_CorDllMainmscoree.dll source: Microsoft.SqlServer.Management.CollectorEnum.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.VirtualSite.Interface\anycpu-release__\obj\release\netstandard2.0\FmaServiceCommon.VirtualSite.Interface.pdb~1 source: BrokerService.exe, 0000001D.00000002.1913698768.00000194AB3D2000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.HCL.DistributedTracing\anycpu-release__\obj\release\net472\Citrix.HCL.DistributedTracing.pdb source: Citrix.HCL.DistributedTracing.dll0.4.dr
Source: Binary string: /_/artifacts/obj/System.Diagnostics.DiagnosticSource/Release/net462/System.Diagnostics.DiagnosticSource.pdbSHA256h source: BrokerService.exe, 0000001D.00000002.1915939180.00000194AB572000.00000002.00000001.01000000.00000026.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaInterServiceClients\Runtime\FmaInterServiceManager.Interface\anycpu-release__\obj\release\net472\FmaInterServiceManager.Interface.pdb source: BrokerService.exe, 0000001D.00000002.1914986331.00000194AB462000.00000002.00000001.01000000.0000001D.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\XmsInterfaces\anycpu-release__\obj\release\net472\XmsInterfaces.pdb source: BrokerService.exe, 0000001D.00000002.1916621102.00000194AB692000.00000002.00000001.01000000.0000002A.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.VirtualSiteManager\anycpu-release__\obj\release\net472\FmaServiceCommon.VirtualSiteManager.pdb source: BrokerService.exe, 0000001F.00000002.2554213094.00000254515C2000.00000002.00000001.01000000.00000041.sdmp
Source: Binary string: Citrix.Networking.WebSocket.pdb.7818E375_CB2C_4E80_99E7_4C40D0D5718BHF source: Broker_Service_x64.msi
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\RegistryCounters\anycpu-release__\obj\release\net472\RegistryCounters.pdb source: BrokerService.exe, 0000001D.00000002.1916301428.00000194AB672000.00000002.00000001.01000000.00000028.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaSqlUtils\anycpu-release__\obj\release\netstandard2.0\FmaSqlUtils.pdb source: FmaSqlUtils.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaPlugin\anycpu-release__\obj\release\netstandard2.0\FmaPlugin.pdb source: BrokerService.exe, 0000001F.00000002.2553466258.0000025450CB2000.00000002.00000001.01000000.0000003B.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.VirtualSite.Interface\anycpu-release__\obj\release\netstandard2.0\FmaServiceCommon.VirtualSite.Interface.pdb source: BrokerService.exe, 0000001D.00000002.1913698768.00000194AB3D2000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.ValueTuple/net47\System.ValueTuple.pdb source: BrokerService.exe, 0000001F.00000002.2549401679.000002544F472000.00000002.00000001.01000000.00000036.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\DiscUtils\src\anycpu-release__\obj\release\net472\DiscUtils.pdb8> source: DiscUtils.dll4.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaUtils\anycpu-release__\obj\release\net472\FmaUtils.pdbb source: BrokerService.exe, 0000001D.00000002.1909451331.00000194911C2000.00000002.00000001.01000000.00000009.sdmp, FMAUtils.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaEnv\anycpu-release__\obj\release\netstandard2.0\FmaEnv.pdb28L8 >8_CorDllMainmscoree.dll source: BrokerService.exe, 0000001D.00000002.1912083012.00000194AB262000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\ActiveDirectory\FmaActiveDirectory\anycpu-release__\obj\release\netstandard2.0\FmaActiveDirectory.pdb source: BrokerService.exe, 0000001F.00000002.2556875287.0000025451A92000.00000002.00000001.01000000.0000004A.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.HypervisorCommunicationsLibrary\anycpu-release__\obj\release\net472\Citrix.HypervisorCommunicationsLibrary.pdb source: Citrix.HypervisorCommunicationsLibrary.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Libraries\FmaCommandQueues\CasCommandQueuePayload\anycpu-release__\obj\release\netstandard2.0\Citrix.Broker.CasCommandQueuePayload.pdbB5\5 N5_CorDllMainmscoree.dll source: Citrix.Broker.CasCommandQueuePayload.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaFeature\anycpu-release__\obj\release\netstandard2.0\FmaFeature.pdb source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp
Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.HashCode/net461-Release/Microsoft.Bcl.HashCode.pdb source: Microsoft.Bcl.HashCode.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.ManagedMachineAPI\anycpu-release__\obj\release\net472\Citrix.ManagedMachineAPI.pdb> source: BrokerService.exe, 0000001F.00000002.2553794425.0000025450D72000.00000002.00000001.01000000.0000003E.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\logging\cdf_net\core\anycpu-release__\obj\release\net472\Citrix.Xaxd.Cdf.Net.pdb source: BrokerService.exe, 0000001D.00000002.1909850188.0000019491242000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\ProxyCommon\anycpu-release__\obj\release\net472\ProxyCommon.pdb$ source: BrokerService.exe, 0000001D.00000002.1917667880.00000194ABA92000.00000002.00000001.01000000.00000033.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaRegistry\anycpu-release__\obj\release\netstandard2.0\FmaRegistry.pdb source: BrokerService.exe, 0000001D.00000002.1909555493.00000194911E2000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaEventLog\anycpu-release__\obj\release\net472\FmaEventLog.pdb source: BrokerService.exe, 0000001F.00000002.2553006670.00000254506D2000.00000002.00000001.01000000.00000038.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\IDnsIpSupport\anycpu-release__\obj\release\net472\IDnsIpSupport.pdb source: IDnsIpSupport.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\utils\windows\anycpu-release__\obj\release\net472\Citrix.Xaxd.Utils.Windows.pdb source: Citrix.Xaxd.Utils.Windows.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\utils\strings\anycpu-release__\obj\release\netstandard2.0\Citrix.Xaxd.Utils.Strings.pdb source: BrokerService.exe, 0000001D.00000002.1913390576.00000194AB3C2000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaInterServiceClients\Runtime\FmaInterServiceManager\anycpu-release__\obj\release\net472\FmaInterServiceManager.pdb source: BrokerService.exe, 0000001D.00000002.1915578302.00000194AB522000.00000002.00000001.01000000.00000023.sdmp
Source: Binary string: /_/artifacts/obj/System.Security.Permissions/Release/net462/System.Security.Permissions.pdb source: System.Security.Permissions.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Libraries\FmaCommandQueues\CasCommandQueuePayload\anycpu-release__\obj\release\netstandard2.0\Citrix.Broker.CasCommandQueuePayload.pdb source: Citrix.Broker.CasCommandQueuePayload.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaDal\Runtime\FmaDalRuntime\anycpu-release__\obj\release\netstandard2.0\FmaDalRuntime.pdb source: BrokerService.exe, 0000001D.00000002.1915242829.00000194AB4C2000.00000002.00000001.01000000.0000001F.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaLogging\anycpu-release__\obj\release\net472\FmaLogging.pdb source: BrokerService.exe, 0000001D.00000002.1911974174.00000194AB232000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaInterServiceClients\Runtime\FmaInterServiceManager.Models\anycpu-release__\obj\release\netstandard2.0\FmaInterServiceManager.Models.pdb source: BrokerService.exe, 0000001D.00000002.1915395701.00000194AB4F2000.00000002.00000001.01000000.00000021.sdmp
Source: Binary string: /_/artifacts/obj/System.ServiceProcess.ServiceController/Release/net462/System.ServiceProcess.ServiceController.pdb source: BrokerService.exe, 0000001D.00000002.1912129198.00000194AB272000.00000002.00000001.01000000.00000013.sdmp, System.ServiceProcess.ServiceController.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\CtxSta\anycpu-release__\obj\release\net472\CtxSta.pdbK source: BrokerService.exe, 0000001D.00000002.1916882745.00000194AB6D2000.00000002.00000001.01000000.0000002D.sdmp, CtxSta.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaWcf\anycpu-release__\obj\release\net472\FmaWcf.pdb source: BrokerService.exe, 0000001F.00000002.2552865039.00000254506C2000.00000002.00000001.01000000.00000037.sdmp
Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdbSHA256 source: Microsoft.Bcl.AsyncInterfaces.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\ActiveDirectory\FmaActiveDirectory.Interfaces\anycpu-release__\obj\release\netstandard2.0\FmaActiveDirectory.Interfaces.pdb source: BrokerService.exe, 0000001F.00000002.2554565821.00000254515E2000.00000002.00000001.01000000.00000043.sdmp
Source: Binary string: /_/obj/src/Microsoft/SqlServer/Management/RegisteredServers/Release/net462/Microsoft.SqlServer.Management.RegisteredServers.pdb source: Microsoft.SqlServer.Management.RegisteredServers.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.HypervisorCommunicationsLibrary.Wcf\anycpu-release__\obj\release\net472\Citrix.HypervisorCommunicationsLibrary.Wcf.pdbnD source: Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr
Source: Binary string: C:\jenkins\workspace\CitrixCloud\Build\Src\Logging\obj\Release\netstandard2.0\Citrix.CloudServices.Logging.pdbSHA256 source: Citrix.CloudServices.Logging.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\GroupPolicy\GpAnalyzer\Analyzer\anycpu-release__\obj\release\net472\GpAnalyzer.pdb source: GpAnalyzer.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\Licensing\anycpu-release__\obj\release\net472\Licensing.pdb source: BrokerService.exe, 0000001D.00000002.1916686247.00000194AB6A2000.00000002.00000001.01000000.0000002B.sdmp
Source: Binary string: C:\Jenkins\workspace\CitrixCloud\Build\Src\AgentFoundation\Common\obj\Release\netstandard2.0\Citrix.CloudServices.AgentFoundation.Common.pdb source: Citrix.CloudServices.AgentFoundation.Common.dll.4.dr
Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.Logging/Release/net462/Microsoft.Extensions.Logging.pdbSHA256kYf source: Microsoft.Extensions.Logging.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\logging\cdf_sharp\win\anycpu-release__\obj\release\net472\Citrix.Diagnostics.Tracing.pdb~ source: BrokerService.exe, 0000001D.00000002.1915055457.00000194AB472000.00000002.00000001.01000000.0000001E.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\ProxyCommon\anycpu-release__\obj\release\net472\ProxyCommon.pdb source: BrokerService.exe, 0000001D.00000002.1917667880.00000194ABA92000.00000002.00000001.01000000.00000033.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\BrokerComponentCommon\anycpu-release__\obj\release\net472\BrokerComponentCommon.pdb source: BrokerService.exe, 0000001D.00000002.1917029887.00000194AB6F2000.00000002.00000001.01000000.0000002F.sdmp
Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.Logging.Abstractions/Release/net462/Microsoft.Extensions.Logging.Abstractions.pdb source: BrokerService.exe, 0000001D.00000002.1914867354.00000194AB442000.00000002.00000001.01000000.0000001C.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\HostingManagement\HostingManagementComponent\anycpu-release__\obj\release\net472\HostingManagementComponent.pdb source: BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.HypervisorCommunicationsLibrary.HostView\anycpu-release__\obj\release\net472\Citrix.HypervisorCommunicationsLibrary.HostView.pdb source: Citrix.HypervisorCommunicationsLibrary.HostView.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaUtils\anycpu-release__\obj\release\net472\FmaUtils.pdb source: BrokerService.exe, 0000001D.00000002.1909451331.00000194911C2000.00000002.00000001.01000000.00000009.sdmp, FMAUtils.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\UrlAclSupport\anycpu-release__\obj\release\net472\UrlAclSupport.pdb source: BrokerService.exe, 0000001D.00000002.1916166886.00000194AB642000.00000002.00000001.01000000.00000027.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\authentication\interfaces\anycpu-release__\obj\release\net472\Citrix.Xaxd.Authentication.Interfaces.pdb source: BrokerService.exe, 0000001D.00000002.1915326873.00000194AB4E2000.00000002.00000001.01000000.00000020.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaInterServiceClients\Runtime\FmaInterServiceManager.Models\anycpu-release__\obj\release\netstandard2.0\FmaInterServiceManager.Models.pdb"Y<Y .Y_CorDllMainmscoree.dll source: BrokerService.exe, 0000001D.00000002.1915395701.00000194AB4F2000.00000002.00000001.01000000.00000021.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.Settings\anycpu-release__\obj\release\net472\FmaServiceCommon.Settings.pdb source: BrokerService.exe, 0000001D.00000002.1914580532.00000194AB402000.00000002.00000001.01000000.00000019.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.HCL.DistributedTracing\anycpu-release__\obj\release\net472\Citrix.HCL.DistributedTracing.pdbXCrC dC_CorDllMainmscoree.dll source: Citrix.HCL.DistributedTracing.dll0.4.dr
Source: Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb source: System.Numerics.Vectors.dll0.4.dr
Source: Binary string: /_/artifacts/obj/System.Configuration.ConfigurationManager/Release/net462/System.Configuration.ConfigurationManager.pdbSHA256 source: BrokerService.exe, 0000001D.00000002.1913217539.00000194AB3A2000.00000002.00000001.01000000.00000015.sdmp, System.Configuration.ConfigurationManager.dll0.4.dr, System.Configuration.ConfigurationManager.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Shared\VirtualSites\anycpu-release__\obj\release\net472\VirtualSites.pdb: source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\XmsRuntime\anycpu-release__\obj\release\net472\XmsRuntime.pdb source: BrokerService.exe, 0000001D.00000002.1916960617.00000194AB6E2000.00000002.00000001.01000000.0000002E.sdmp
Source: Binary string: /_/artifacts/obj/System.Diagnostics.DiagnosticSource/Release/net462/System.Diagnostics.DiagnosticSource.pdb source: BrokerService.exe, 0000001D.00000002.1915939180.00000194AB572000.00000002.00000001.01000000.00000026.sdmp
Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdb source: Microsoft.Bcl.AsyncInterfaces.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\utils\date_time\anycpu-release__\obj\release\netstandard2.0\Citrix.Xaxd.Utils.DateTime.pdb source: BrokerService.exe, 0000001F.00000002.2553129762.0000025450BE2000.00000002.00000001.01000000.00000039.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\CtxSta\anycpu-release__\obj\release\net472\CtxSta.pdb source: BrokerService.exe, 0000001D.00000002.1916882745.00000194AB6D2000.00000002.00000001.01000000.0000002D.sdmp, CtxSta.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.VirtualSiteManager\anycpu-release__\obj\release\net472\FmaServiceCommon.VirtualSiteManager.pdb< source: BrokerService.exe, 0000001F.00000002.2554213094.00000254515C2000.00000002.00000001.01000000.00000041.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\TicketStore\TicketStore\anycpu-release__\obj\release\net472\TicketStore.pdb source: BrokerService.exe, 0000001F.00000002.2553679495.0000025450D62000.00000002.00000001.01000000.0000003D.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\hostname\interfaces\anycpu-release__\obj\release\netstandard2.0\Citrix.Xaxd.Hostname.Interfaces.pdb source: Citrix.Xaxd.Hostname.Interfaces.dll.4.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Rest.ClientRuntime\Release\net461\Microsoft.Rest.ClientRuntime.pdb source: Microsoft.Rest.ClientRuntime.dll.4.dr
Source: Binary string: /_/artifacts/obj/System.Configuration.ConfigurationManager/Release/net462/System.Configuration.ConfigurationManager.pdb source: BrokerService.exe, 0000001D.00000002.1913217539.00000194AB3A2000.00000002.00000001.01000000.00000015.sdmp, System.Configuration.ConfigurationManager.dll0.4.dr, System.Configuration.ConfigurationManager.dll.4.dr
Source: Binary string: C:\Jenkins\workspace\CitrixCloud\Build\Src\AgentFoundation\Common\obj\Release\netstandard2.0\Citrix.CloudServices.AgentFoundation.Common.pdbI source: Citrix.CloudServices.AgentFoundation.Common.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\distributed_tracing\core\anycpu-release__\obj\release\net472\Citrix.Xaxd.DistributedTracing.pdb source: BrokerService.exe, 0000001D.00000002.1915459492.00000194AB502000.00000002.00000001.01000000.00000022.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaCommandLine\anycpu-release__\obj\release\netstandard2.0\FmaCommandLine.pdb source: BrokerService.exe, 0000001D.00000002.1915842117.00000194AB562000.00000002.00000001.01000000.00000025.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaCommandLine\anycpu-release__\obj\release\netstandard2.0\FmaCommandLine.pdbv\ source: BrokerService.exe, 0000001D.00000002.1915842117.00000194AB562000.00000002.00000001.01000000.00000025.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\BrokerComponentCommon\anycpu-release__\obj\release\net472\BrokerComponentCommon.pdbp source: BrokerService.exe, 0000001D.00000002.1917029887.00000194AB6F2000.00000002.00000001.01000000.0000002F.sdmp
Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.Logging/Release/net462/Microsoft.Extensions.Logging.pdb source: Microsoft.Extensions.Logging.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\Wpnbr\anycpu-release__\obj\release\net472\Wpnbr.pdb source: BrokerService.exe, 0000001D.00000002.1917130914.00000194AB772000.00000002.00000001.01000000.00000030.sdmp
Source: Binary string: X:\src\HelperPackages\Bootstrap\Bootstrap_CA\wh32\retail\vc80\static\bootstrap_ca.pdb source: MSIDD31.tmp.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Shared\EventLog\anycpu-release__\obj\release\net472\EventLog.pdb source: BrokerService.exe, 0000001D.00000002.1917745850.00000194ABAD2000.00000002.00000001.01000000.00000034.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaDal\Runtime\SiteServices\FmaSiteServices\anycpu-release__\obj\release\netstandard2.0\FmaSiteServices.pdb source: BrokerService.exe, 0000001F.00000002.2554068226.0000025450DF2000.00000002.00000001.01000000.00000040.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\distributed_tracing\core\anycpu-release__\obj\release\net472\Citrix.Xaxd.DistributedTracing.pdb} source: BrokerService.exe, 0000001D.00000002.1915459492.00000194AB502000.00000002.00000001.01000000.00000022.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaLogging\anycpu-release__\obj\release\net472\FmaLogging.pdb: source: BrokerService.exe, 0000001D.00000002.1911974174.00000194AB232000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: /_/artifacts/obj/Microsoft.Win32.Registry/net461-Windows_NT-Release/Microsoft.Win32.Registry.pdbSHA256 source: BrokerService.exe, 0000001D.00000002.1912963441.00000194AB382000.00000002.00000001.01000000.00000014.sdmp, Microsoft.Win32.Registry.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.HypervisorCommunicationsLibrary.Wcf\anycpu-release__\obj\release\net472\Citrix.HypervisorCommunicationsLibrary.Wcf.pdb source: Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Controller\ControllerService\x64-release__\obj\x64\release\net472\BrokerService.pdb source: BrokerService.exe, 0000001D.00000000.1835935201.0000019490E52000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaDependencyInjection\anycpu-release__\obj\release\netstandard2.0\FmaDependencyInjection.pdb source: BrokerService.exe, 0000001D.00000002.1915775374.00000194AB542000.00000002.00000001.01000000.00000024.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaDal\Runtime\SiteServices\FmaSiteServices\anycpu-release__\obj\release\netstandard2.0\FmaSiteServices.pdb' source: BrokerService.exe, 0000001F.00000002.2554068226.0000025450DF2000.00000002.00000001.01000000.00000040.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaTransactionScope\anycpu-release__\obj\release\netstandard2.0\FmaTransactionScope.pdb(/B/ 4/_CorDllMainmscoree.dll source: BrokerService.exe, 0000001D.00000002.1913930609.00000194AB3E2000.00000002.00000001.01000000.00000018.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Shared\Settings\anycpu-release__\obj\release\net472\Settings.pdb source: BrokerService.exe, 0000001F.00000002.2553217176.0000025450C32000.00000002.00000001.01000000.0000003A.sdmp, Settings.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Controller\ComponentInterface\anycpu-release__\obj\release\net472\ComponentInterface.pdb source: BrokerService.exe, 0000001D.00000002.1909653018.0000019491202000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Plugins\HypervisorsCommon\anycpu-release__\obj\release\net472\HypervisorsCommon.pdb source: HypervisorsCommon.dll0.4.dr
Checks for available system drives (often done to infect USB drives)
Source: C:\Windows\System32\msiexec.exe File opened: z: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: x: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: v: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: t: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: r: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: p: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: n: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: l: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: j: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: h: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: f: Jump to behavior
Source: C:\Windows\System32\svchost.exe File opened: d: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: b: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: y: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: w: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: u: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: s: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: q: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: o: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: m: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: k: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: i: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: g: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: e: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: c: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: a: Jump to behavior

Networking
barindex
Yara detected Generic Downloader
Source: Yara match File source: C:\Program Files\Citrix\Broker\Service\RestSharp.dll, type: DROPPED
Source: Yara match File source: C:\Program Files\Citrix\Broker\Service\System.Management.Automation.dll, type: DROPPED
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: time.windows.com
Source: global traffic DNS traffic detected: DNS query: _ldap._tcp.
Source: global traffic DNS traffic detected: DNS query: _ldap._tcp.
Source: global traffic DNS traffic detected: DNS query: _ldap._tcp.
Source: BrokerService.exe, 0000001F.00000002.2552865039.00000254506C2000.00000002.00000001.01000000.00000037.sdmp String found in binary or memory: http://citrix.poshsdk.namespace/
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp, IDnsIpSupport.dll.4.dr String found in binary or memory: http://schemas.citrix.com/CBP
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IConfiguration/SetFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IConfiguration/SetResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IConfiguration/SetResponses
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IConfiguration/SetT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useAddressHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useAddressHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useCancelLaunchReplyHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useCancelLaunchReplyHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useCancelLaunchRequestHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useCancelLaunchRequestHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useFaultHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useFaultHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useForwardCallToRootOfTrustResultHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useForwardCallToRootOfTrustResultHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useGetReplyHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useGetReplyHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useGetRequestHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useGetRequestHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useIntuneMetadataResultHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useIntuneMetadataResultHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useLogonRequest2HelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useLogonRequestHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useLogonRequestHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useNotifyBrokerReplyHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useNotifyBrokerReplyHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useNotifyReplyHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useNotifyReplyHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useNotifyRequestHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useNotifyRequestHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/usePolicyDefinitionHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/usePolicyDefinitionHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/usePrepareAppReplyHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/usePrepareAppReplyHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/usePrepareAppRequestHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/usePrepareAppRequestHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/usePrepareReplyHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/usePrepareReplyHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/usePrepareRequestHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/usePrepareRequestHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useProtocolSettingsHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useProtocolSettingsHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useQueryExpressionHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useQueryExpressionHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useRendezvousReplyHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useRendezvousReplyHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useRendezvousRequestHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useRendezvousRequestHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useReservationTokenHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useReservationTokenHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useResourceDetailsHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useResourceDetailsHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useReversePrepareSessionResultHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useReversePrepareSessionResultHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useReverseSeamlessAppHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useReverseSeamlessAppHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useReverseSeamlessAppListHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useReverseSeamlessAppListHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useRoTPublicKeysHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useRoTPublicKeysHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useServiceDetailsResultHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useServiceDetailsResultHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useSessionApplicationHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useSessionApplicationHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useSetRequestHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useSetRequestHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useSiteInformationHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useSiteInformationHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useWorkerSettingsHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useWorkerSettingsHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDynamicDataQuery/GetFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDynamicDataQuery/GetResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDynamicDataQuery/GetResponsev
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IDynamicDataQuery/GetT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/CancelLaunchFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/CancelLaunchResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/CancelLaunchResponseu
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/CancelLaunchT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/PrepareAppSessionFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/PrepareAppSessionResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/PrepareAppSessionResponsez
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/PrepareAppSessionT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/PrepareRendezvousSessionFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/PrepareRendezvousSessionResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/PrepareRendezvousSessionT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/PrepareSessionFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/PrepareSessionResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/PrepareSessionResponsew
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/PrepareSessionT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllFtasFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllFtasResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllFtasResponsey
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllFtasT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllSessions2FaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllSessions2Response
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllSessions2Response~
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllSessions2T
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllSessionsFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllSessionsResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllSessionsT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllStartMenuShortcutsFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllStartMenuShortcutsResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllStartMenuShortcutsT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryStartMenuShortcutIconFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryStartMenuShortcutIconResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryStartMenuShortcutIconT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryUsersFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryUsersResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryUsersResponsew
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryUsersT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/TestFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/TestResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/TestResponseq
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/TestT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IServiceDetailsManager/GetServiceDetailsFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IServiceDetailsManager/GetServiceDetailsResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/IServiceDetailsManager/GetServiceDetailsT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/DisconnectFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/DisconnectResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/DisconnectT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/ExecuteCommandsFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/ExecuteCommandsResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/ExecuteCommandsT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/GetRecordingStatusFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/GetRecordingStatusResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/GetRecordingStatusT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/LogOffFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/LogOffResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/LogOffResponsew
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/LogOffT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/ReRegisterNowFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/ReRegisterNowResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/ReRegisterNowResponse~
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/ReRegisterNowT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/RebootFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/RebootResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/RebootResponsew
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/RebootT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/SendMessageFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/SendMessageResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/SendMessageT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/StartRecordingFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/StartRecordingResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/StartRecordingT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/StopRecordingFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/StopRecordingResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/StopRecordingResponse~
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/StopRecordingT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.ADIdentity.DataModel
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.ADIdentity.DataModelf
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.ADIdentity.DataModell
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.ADIdentity.DataModelm
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.ADIdentity.DataModelp
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.ADIdentity.DataModelu
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AdIdentity.Definitions
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AdIdentity.Definitionse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AdIdentity.Definitionsf
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AdIdentity.Definitionsm
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AdIdentity.Definitionsp
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AdIdentity.Definitionst
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AdIdentity.Definitionsu
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AdIdentity.Definitionsz
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AppLibrary.DataModel
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AppLibrary.DataModela
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AppLibrary.DataModele
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AppLibrary.DataModeli
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AppLibrary.DataModelq
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AppLibrary.DataModelv
Source: BrokerService.exe, 0000001F.00000002.2558857309.0000025451C32000.00000002.00000001.01000000.0000004C.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Cds.BrokerU
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.CloudServices.Trust.Api.Modelsi
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.DelegatedAdmin.Logick
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Fma.Sdk.ServiceCore_
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Fma.Sdk.ServiceCoreg
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Fma.Sdk.ServiceCorer
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Host.DataModel
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Host.DataModelY
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Host.DataModel_
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Host.DataModela
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Host.DataModeld
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Host.DataModelf
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Host.DataModelg
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Host.DataModelr
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Host.DataModels
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Host.DataModelu
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Host.DataModelx
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.HypervisorCommunicationsLibrary.Wcf.Types
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.HypervisorCommunicationsLibrary.Wcf.TypesN
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.HypervisorCommunicationsLibrary.Wcf.Typesb
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.HypervisorCommunicationsLibrary.Wcf.Typesm
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.HypervisorCommunicationsLibrary.Wcf.Typeso
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.HypervisorCommunicationsLibrary.Wcf.Typesq
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.HypervisorCommunicationsLibrary.Wcf.Typess
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.HypervisorCommunicationsLibrary.Wcf.Typesu
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.HypervisorCommunicationsLibrary.Wcf.Typesw
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.HypervisorCommunicationsLibrary.Wcf.Typesy
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.DataModel
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.DataModeli
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.DataModell
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.DataModeln
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.DataModelr
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.DataModelu
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.DataModelv
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.DataModelx
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.DataModelz
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.Definitions
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.Definitionsc
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.Definitionsm
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.Definitionst
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.Definitionsv
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.Definitionsx
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Trust.DataModelW
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Trust.DataModela
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Trust.Logic
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Trust.LogicX
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Trust.Logicw
Source: BrokerService.exe, 0000001D.00000002.1915395701.00000194AB4F2000.00000002.00000001.01000000.00000021.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.XDInterServiceTypes
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.XDInterServiceTypesf
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.XDInterServiceTypeso
Source: BrokerService.exe, 0000001F.00000002.2558857309.0000025451C32000.00000002.00000001.01000000.0000004C.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/System
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/System.Workflow.Runtime
Source: wevtutil.exe, 00000014.00000003.1791925447.0000027FB5F6E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.m
Source: BrokerService.exe, 0000001D.00000002.1910073183.0000019492A61000.00000004.00000800.00020000.00000000.sdmp, BrokerService.exe, 0000001D.00000002.1910073183.0000019492F6E000.00000004.00000800.00020000.00000000.sdmp, BrokerService.exe, 0000001F.00000002.2547476641.0000025304A21000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: svchost.exe, 0000000A.00000002.2538923261.00000196A3C87000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2539402260.00000196A4502000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://standards.iso.org/iso/19770/-2/2009/schema.xsd
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IADIdentityApi/GetIdentityByNameResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IADIdentityApi/GetIdentityByNameT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IADIdentityApi/GetIdentityBySidResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IADIdentityApi/GetIdentityBySidT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IADIdentityApi/GetIdentityContentInIdentityPoolByIdResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IADIdentityApi/GetIdentityContentInIdentityPoolByIdT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IADIdentityApi/GetIdentityContentInIdentityPoolByNameResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IADIdentityApi/GetIdentityContentInIdentityPoolByNameT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IADIdentityApi/GetIdentityPoolByIdResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IADIdentityApi/GetIdentityPoolByIdT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IADIdentityApi/GetIdentityPoolByNameResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IADIdentityApi/GetIdentityPoolByNameT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IADIdentityApi/GetUserCertExpirationDateResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IADIdentityApi/GetUserCertExpirationDateT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IADIdentityApi/SetLockStateForADAccountResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IADIdentityApi/SetLockStateForADAccountT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IADIdentityApi/SetServiceAccountHealthStatusByUidResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IADIdentityApi/SetServiceAccountHealthStatusByUidT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IADIdentityApi/TaintADAccountResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IADIdentityApi/TaintADAccountT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IADIdentityApi/ValidateAndLockIdentitiesForPoolBySidResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IADIdentityApi/ValidateAndLockIdentitiesForPoolBySidT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IADIdentityApi/ValidateAndLockIdentitiesForPoolResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IADIdentityApi/ValidateAndLockIdentitiesForPoolT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IAppLibApi/FetchAppVTelemetryResponse&
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IAppLibApi/FetchAppVTelemetryT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IAppLibApi/GetObjectsFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IAppLibApi/GetObjectsResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IAppLibApi/GetObjectsT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApi/DummyOperationResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApi/DummyOperationT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV1/CheckGlobalAccessResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV1/CheckGlobalAccessT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV1/CheckScopeAccessMultipleResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV1/CheckScopeAccessMultipleT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV1/CheckScopeAccessResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV1/CheckScopeAccessT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV1/LookupScopeResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV1/LookupScopeT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV1/RetrieveScopesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV1/RetrieveScopesT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV2/CheckGlobalAccessUsingBearerTokenResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV2/CheckGlobalAccessUsingBearerTokenT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV2/CheckScopeAccessMultipleUsingBearerTokenResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV2/CheckScopeAccessMultipleUsingBearerTokenT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV2/CheckScopeAccessUsingBearerTokenResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV2/CheckScopeAccessUsingBearerTokenT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV3/GetCloudAdminDetailsAsDictionaryResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV3/GetCloudAdminDetailsAsDictionaryT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV3/GetUserAdminTypeResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV3/GetUserAdminTypeT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV3/GetUserAdminTypeWithBearerTokenResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV3/GetUserAdminTypeWithBearerTokenT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV4/CheckScopeAccessMultipleUsingBearerTokenWithExcludedResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV4/CheckScopeAccessMultipleUsingBearerTokenWithExcludedT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV4/CheckScopeAccessMultipleWithExcludedResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV4/CheckScopeAccessMultipleWithExcludedT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV4/CheckScopeAccessUsingBearerTokenWithExcludedResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV4/CheckScopeAccessUsingBearerTokenWithExcludedT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV4/CheckScopeAccessWithExcludedResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV4/CheckScopeAccessWithExcludedT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetDefinedFeaturesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetDefinedFeaturesT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetEnabledFeaturesForConfigurationResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetEnabledFeaturesForConfigurationT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetEnabledFeaturesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetEnabledFeaturesT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetLicenseInfoResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetLicenseInfoT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetLicenseServerDetailsResponseu
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetLicenseServerDetailsT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetSiteInfoResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetSiteInfoT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetValidProductAndModelsResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetValidProductAndModelsT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IFeatureChecksApi/IsFeatureDefinedResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IFeatureChecksApi/IsFeatureDefinedT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IFeatureChecksApi/IsFeatureEnabledResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IFeatureChecksApi/IsFeatureEnabledT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IFeatureChecksApi/UpdateSiteLicenseSaaSEnabledResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IFeatureChecksApi/UpdateSiteLicenseSaaSEnabledT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IFeatureChecksApi/ZoneExistsResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IFeatureChecksApi/ZoneExistsT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/AddPvsCollectionResponseu
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/AddPvsCollectionT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/AddPvsDeviceResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/AddPvsDeviceT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/AddVolumeServiceBootstrappedTemplateResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/AddVolumeServiceBootstrappedTemplateT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/ConfirmPvsCollectionNameAvailableResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/ConfirmPvsCollectionNameAvailableT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/DeletePvsCollectionResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/DeletePvsCollectionT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/DeletePvsDeviceResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/DeletePvsDeviceT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/GetHostingUnitByIdResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/GetHostingUnitByIdT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/GetHostingUnitByNameResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/GetHostingUnitByNameT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/GetHostingUnitsAllResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/GetHostingUnitsAllT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/GetHypervisorConnectionByIdResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/GetHypervisorConnectionByIdT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/GetHypervisorConnectionRevByIdResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/GetHypervisorConnectionRevByIdT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/GetHypervisorConnectionsAllResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/GetHypervisorConnectionsAllT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/GetPvsDiskInfoByIdResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/GetPvsDiskInfoByIdT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/GetPvsServersBySiteIdResponsey
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/GetPvsServersBySiteIdT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/GetPvsSiteByIdResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/GetPvsSiteByIdT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/GetVolumeServiceBootstrappedTemplatesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/GetVolumeServiceBootstrappedTemplatesT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/IsZoneEmptyResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/IsZoneEmptyT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/MoveResourcesToNewZoneResponses
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/MoveResourcesToNewZoneT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/RemoveVolumeServiceBootstrappedTemplateResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/RemoveVolumeServiceBootstrappedTemplateT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/SetHypervisorConnectionMetadataResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IHostApi/SetHypervisorConnectionMetadataT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/BeginVirtualMachinePowerStateChangesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/BeginVirtualMachinePowerStateChangesT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/BeginVirtualMachineStateChangesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/BeginVirtualMachineStateChangesT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/CheckResetVirtualMachineOperationsResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/CheckResetVirtualMachineOperationsT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/CheckResetVmOperationsResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/CheckResetVmOperationsT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/CheckVirtualMachinePowerActionsResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/CheckVirtualMachinePowerActionsT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/CheckVirtualMachinePowerStateChangesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/CheckVirtualMachinePowerStateChangesT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/CheckVirtualMachineStateChangesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/CheckVirtualMachineStateChangesT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/GetMaximumMachineCapabilitiesQuerySizeResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/GetMaximumMachineCapabilitiesQuerySizeT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/GetMaximumPowerStateQuerySizeResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/GetMaximumPowerStateQuerySizeT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/GetProvisionedVirtualMachineBySidResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/GetProvisionedVirtualMachineBySidT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/GetProvisioningSchemeByIdResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/GetProvisioningSchemeByIdT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/GetTaskResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/GetTaskT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/PollVirtualMachineCapabilitiesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/PollVirtualMachineCapabilitiesT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/PollVirtualMachinePowerStatesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/PollVirtualMachinePowerStatesT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/StartResetVirtualMachineResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/StartResetVirtualMachineT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/StartVirtualMachinePowerActionResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/StartVirtualMachinePowerActionT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/StartVirtualMachinePowerActionsResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/StartVirtualMachinePowerActionsT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/TerminateTaskResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/TerminateTaskT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/UpdateProvVmHostVmIdResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IMachineCreationApi/UpdateProvVmHostVmIdT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/FilterServiceAccountByIdentityProviderTypeNoSuchServiceAccount
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/FilterServiceAccountByIdentityProviderTypeResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/FilterServiceAccountByIdentityProviderTypeT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/GetAzureADAccessTokenByUidNoSuchServiceAccountFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/GetAzureADAccessTokenByUidResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/GetAzureADAccessTokenByUidT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/InterfaceIsActiveResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/InterfaceIsActiveT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/RetrieveAdAccountNoSuchAdAccountFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/RetrieveAdAccountResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/RetrieveAdAccountT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/SetAdAccountInUseAndClearPasswordNoSuchAdAccountFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/SetAdAccountInUseAndClearPasswordResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/SetAdAccountInUseAndClearPasswordT
Source: BrokerService.exe, 0000001F.00000002.2558857309.0000025451C32000.00000002.00000001.01000000.0000004C.sdmp String found in binary or memory: http://tempuri.org/ISecondaryBrokerControl/GetAllConnectionLeaseRevocationDateTimesInUtcResponseQ
Source: BrokerService.exe, 0000001F.00000002.2558857309.0000025451C32000.00000002.00000001.01000000.0000004C.sdmp String found in binary or memory: http://tempuri.org/ISecondaryBrokerControl/GetAllConnectionLeaseRevocationDateTimesInUtcT
Source: BrokerService.exe, 0000001F.00000002.2558857309.0000025451C32000.00000002.00000001.01000000.0000004C.sdmp String found in binary or memory: http://tempuri.org/ISecondaryBrokerControl/StartBrokeringResponse
Source: BrokerService.exe, 0000001F.00000002.2558857309.0000025451C32000.00000002.00000001.01000000.0000004C.sdmp String found in binary or memory: http://tempuri.org/ISecondaryBrokerControl/StartBrokeringT
Source: BrokerService.exe, 0000001F.00000002.2558857309.0000025451C32000.00000002.00000001.01000000.0000004C.sdmp String found in binary or memory: http://tempuri.org/ISecondaryBrokerControl/StopBrokeringResponse
Source: BrokerService.exe, 0000001F.00000002.2558857309.0000025451C32000.00000002.00000001.01000000.0000004C.sdmp String found in binary or memory: http://tempuri.org/ISecondaryBrokerControl/StopBrokeringT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustAdminQuery/GetRegisteredServiceByNameResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustAdminQuery/GetRegisteredServiceByNameT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustAdminQuery/GetServiceKeyNamesFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustAdminQuery/GetServiceKeyNamesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustAdminQuery/GetServiceKeyNamesT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustAdminQuery/GetServicesInstancesByNameResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustAdminQuery/GetServicesInstancesByNameT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustAdminQuery/RegisterServiceInstanceFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustAdminQuery/RegisterServiceInstanceResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustAdminQuery/RegisterServiceInstanceT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustAdminQuery/SetServiceInstanceKeyFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustAdminQuery/SetServiceInstanceKeyResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustAdminQuery/SetServiceInstanceKeyT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustAdminQuery/UnregisterServiceInstancesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustAdminQuery/UnregisterServiceInstancesT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustAdminQuery/UpdateServiceKeyFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustAdminQuery/UpdateServiceKeyResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustAdminQuery/UpdateServiceKeyT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/AuthenticateAndExtractSidsFromBearerTokenResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/AuthenticateAndExtractSidsFromBearerTokenT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/AuthenticateHeaderResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/AuthenticateHeaderT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/CreateServiceKeyResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/CreateServiceKeyT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/DeleteVdaEnrollmentTokenByIdFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/DeleteVdaEnrollmentTokenByIdResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/DeleteVdaEnrollmentTokenByIdT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/GetRegisteredServiceResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/GetRegisteredServiceT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/GetRegisteredServicesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/GetRegisteredServicesT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/GetTrustVdaEnrollmentTokensFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/GetTrustVdaEnrollmentTokensResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/GetTrustVdaEnrollmentTokensT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/NewBearerTokenForCurrentUserResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/NewBearerTokenForCurrentUserT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/NewBearerTokenResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/NewBearerTokenT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/NewTrustVdaEnrollmentTokenFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/NewTrustVdaEnrollmentTokenResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/NewTrustVdaEnrollmentTokenT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/RevokeTrustVdaEnrollmentTokenFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/RevokeTrustVdaEnrollmentTokenResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/RevokeTrustVdaEnrollmentTokenT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/UnregisterConnectorsResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/UnregisterConnectorsT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/UnregisterServiceInstanceResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/UnregisterServiceInstanceT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/ValidateTrustVdaEnrollmentTokenFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/ValidateTrustVdaEnrollmentTokenResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp String found in binary or memory: http://tempuri.org/ITrustApi/ValidateTrustVdaEnrollmentTokenT
Source: svchost.exe, 00000002.00000002.1368957735.0000020960E13000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.bingmapsportal.com
Source: BrokerService.exe, 0000001F.00000002.2552865039.00000254506C2000.00000002.00000001.01000000.00000037.sdmp String found in binary or memory: http://www.citrix.com/fmaplatform/CitrixTransactionId
Source: BrokerService.exe, 0000001D.00000002.1915578302.00000194AB522000.00000002.00000001.01000000.00000023.sdmp String found in binary or memory: http://www.citrix.com/fmaplatform/VirtualSiteId
Source: BrokerService.exe, 0000001F.00000002.2554213094.00000254515C2000.00000002.00000001.01000000.00000041.sdmp String found in binary or memory: http://www.citrix.com/fmaplatform/VirtualSiteIdeVirtualSiteManager.GetVirtualSites
Source: BrokerService.exe, 0000001F.00000002.2552865039.00000254506C2000.00000002.00000001.01000000.00000037.sdmp String found in binary or memory: http://www.citrix.com/fmaplatform/trust
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp String found in binary or memory: http://www.citrix.com/hcl/connectorList%GetConnectorStatus
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp, Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr String found in binary or memory: http://www.citrix.com/hcl/opId#SourceMachineNameWhttp://www.citrix.com/hcl/sourceMachineName
Source: svchost.exe, 00000002.00000002.1369147638.0000020960E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367792280.0000020960E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000002.00000002.1369147638.0000020960E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367792280.0000020960E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000002.00000003.1367443151.0000020960E62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367764046.0000020960E41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369075101.0000020960E42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367226026.0000020960E6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369410476.0000020960E70000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367707880.0000020960E5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369233575.0000020960E63000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000002.00000003.1367226026.0000020960E6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369410476.0000020960E70000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000002.00000002.1369147638.0000020960E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367792280.0000020960E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000002.00000003.1367422163.0000020960E67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369388884.0000020960E68000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000002.00000003.1367143308.0000020960E75000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369431890.0000020960E77000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000002.00000002.1369147638.0000020960E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367792280.0000020960E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000002.00000003.1367443151.0000020960E62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1368998929.0000020960E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367707880.0000020960E5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369233575.0000020960E63000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000002.00000002.1369147638.0000020960E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367792280.0000020960E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000002.00000002.1368998929.0000020960E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367422163.0000020960E67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369388884.0000020960E68000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000002.00000002.1369147638.0000020960E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367792280.0000020960E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000002.00000002.1369147638.0000020960E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367792280.0000020960E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000002.00000002.1369147638.0000020960E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367792280.0000020960E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000002.00000003.1367443151.0000020960E62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1368998929.0000020960E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369233575.0000020960E63000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000002.00000003.1367764046.0000020960E41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369075101.0000020960E42000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000002.00000002.1369147638.0000020960E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367792280.0000020960E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000002.00000003.1367443151.0000020960E62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367764046.0000020960E41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369075101.0000020960E42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369233575.0000020960E63000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000002.00000003.1367764046.0000020960E41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367924924.0000020960E46000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.api.tilep
Source: svchost.exe, 00000002.00000002.1369233575.0000020960E63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367942743.0000020960E54000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000002.00000002.1369075101.0000020960E42000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000002.00000003.1367443151.0000020960E62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369233575.0000020960E63000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000002.00000003.1367764046.0000020960E41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369075101.0000020960E42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367532446.0000020960E5E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
Source: svchost.exe, 00000002.00000003.1367942743.0000020960E54000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000002.00000002.1369147638.0000020960E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367792280.0000020960E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000002.00000003.1265423425.0000020960E36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ecn.dev.virtualearth.net/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000002.00000002.1368998929.0000020960E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367422163.0000020960E67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369388884.0000020960E68000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: BrokerService.exe, 0000001D.00000002.1913217539.00000194AB3A2000.00000002.00000001.01000000.00000015.sdmp, BrokerService.exe, 0000001D.00000002.1912129198.00000194AB272000.00000002.00000001.01000000.00000013.sdmp, BrokerService.exe, 0000001D.00000002.1915939180.00000194AB572000.00000002.00000001.01000000.00000026.sdmp, BrokerService.exe, 0000001D.00000002.1914867354.00000194AB442000.00000002.00000001.01000000.0000001C.sdmp, System.Configuration.ConfigurationManager.dll0.4.dr, System.Security.Permissions.dll.4.dr, Microsoft.Bcl.AsyncInterfaces.dll.4.dr, Microsoft.Extensions.Logging.dll.4.dr, System.ServiceProcess.ServiceController.dll.4.dr, System.Configuration.ConfigurationManager.dll.4.dr String found in binary or memory: https://github.com/dotnet/runtime
Source: BrokerService.exe, 0000001D.00000002.1913217539.00000194AB3A2000.00000002.00000001.01000000.00000015.sdmp, BrokerService.exe, 0000001D.00000002.1912129198.00000194AB272000.00000002.00000001.01000000.00000013.sdmp, System.Configuration.ConfigurationManager.dll0.4.dr, System.Security.Permissions.dll.4.dr, System.ServiceProcess.ServiceController.dll.4.dr, System.Configuration.ConfigurationManager.dll.4.dr String found in binary or memory: https://github.com/dotnet/runtime&
Source: BrokerService.exe, 0000001D.00000002.1915055457.00000194AB472000.00000002.00000001.01000000.0000001E.sdmp String found in binary or memory: https://mindtouch.eng.citrite.net/Technologies/Citrix.Diagnostics.Tracing)
Source: BrokerService.exe, 0000001D.00000002.1915180152.00000194AB4BC000.00000002.00000001.01000000.0000001E.sdmp String found in binary or memory: https://mindtouch.eng.citrite.net/Technologies/Citrix.Diagnostics.Tracing)J
Source: svchost.exe, 00000002.00000003.1367764046.0000020960E41000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000002.00000003.1367738942.0000020960E47000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000002.00000003.1367738942.0000020960E47000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000002.00000002.1368998929.0000020960E2B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000002.00000002.1369147638.0000020960E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367792280.0000020960E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000002.00000002.1369147638.0000020960E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367792280.0000020960E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
Creates files inside the system directory
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\52b9fa.msi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIC535.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIC5C3.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIC641.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\inprogressinstallinfo.ipi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSICB14.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSICB82.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\SourceHash{16FBB4F8-8C17-4AD9-93A4-B3F2C57666D7} Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSICE62.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSICEEF.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSICF8D.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSICFCC.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID0F6.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID1E1.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID211.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID28F.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID2EE.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID31E.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIDD31.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI6212.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI6242.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI62CF.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI630F.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI660D.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI6DDE.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI736D.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI7459.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI7469.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI747A.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI747B.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI75E3.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI75F4.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\52b9fc.msi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\52b9fc.msi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI98BF.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI98EF.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIBA05.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSICFDF.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID2FD.tmp Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File created: C:\Windows\inf\Citrix XML Service\ Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File created: C:\Windows\inf\Citrix XML Service\wixperf.h Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File created: C:\Windows\inf\Citrix XML Service\wixperf.ini Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File created: C:\Windows\inf\Citrix XML Service\0009\ Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File created: C:\Windows\SysWOW64\PerfStringBackup.TMP Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File created: C:\Windows\SysWOW64\PerfStringBackup.INI Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File created: C:\Windows\inf\Citrix Broker Service\ Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File created: C:\Windows\inf\Citrix Broker Service\wixperf.h Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File created: C:\Windows\inf\Citrix Broker Service\wixperf.ini Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File created: C:\Windows\inf\Citrix Broker Service\0009\ Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File created: C:\Windows\SysWOW64\PerfStringBackup.TMP Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File created: C:\Windows\Installer\wix{16FBB4F8-8C17-4AD9-93A4-B3F2C57666D7}.SchedServiceConfig.rmi Jump to behavior
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe File created: C:\Windows\ServiceProfiles\NetworkService\Licensing
Deletes files inside the Windows folder
Source: C:\Windows\System32\msiexec.exe File deleted: C:\Windows\Installer\MSIC535.tmp Jump to behavior
Enables security privileges
Source: C:\Windows\SysWOW64\wevtutil.exe Process token adjusted: Security
Source: PvsVmTemplate.vhd0.4.dr Binary string: \Device\HarddiskVolume2\System Volume Information\_restore{D42FEF58-E684-4725-B180-37A6578E0AE8}\RP44\change.log
Source: PvsVmTemplate.vhd0.4.dr Binary string: \Device\HarddiskVolume3\$Extend\$RmMetadata\$TxfLog\$TxfLog.blf
Source: classification engine Classification label: sus30.phis.troj.evad.winMSI@56/744@4/0
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix Jump to behavior
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BrokerService.exe.log
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6276:120:WilError_03
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5964:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1792:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3260:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6472:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2712:120:WilError_03
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Mutant created: \BaseNamedObjects\Global\.net memory cache 4.0
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1292:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5688:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:7044:120:WilError_03
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user~1\AppData\Local\Temp\MSI9878.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File read: C:\Windows\win.ini Jump to behavior
Source: C:\Windows\System32\msiexec.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: MSIDD31.tmp.4.dr Binary or memory string: SELECT * FROM `Component` WHERE `Component`=?SELECT * FROM `File` WHERE `File`=?SELECT * FROM `Registry` WHERE `Registry`=?IsLegacySecurityModelGetFileHandleForDACLGetDirectoryHandleForDACLGetRegistryHandleForDACLGetFilePathFromMSIGetDirectoryPathFromMSI%i%sGetRegistryPathFromMSICanonicalizeSDCTXGetNativeNameWAccessPermission}APPID\{APPID\ChangeAppIDAccessACLLaunchPermissionChangeAppIDLaunchACLConvertSidToStringSid failedGetUserNameSidFindCtxUserDefaultUserSetupCtxUsersSecDesc>CTX)CTX_InstallACLs.2FC063C6_B4B7_4E0E_B5A1_DD207D00E9C7%u2%u1%u1|%s1|%u2|%s2|%S: The string '%s' in the Desc column for the row '%s' of the CtxAddACL table is invalid.SELECT * FROM `CtxAddACL`CTX_SetupACLsGetUserNameSid failed - the user may not existUpdateCtxUsersSecDescD:AIARD:AISetDaclHelperReg64<null>SetDaclHelperCreateWellKnownSidadvapi32.dllCtxGetNativeNameD:P(A;OICI;GA;;;SY)(A;OICI;GA;;;BA)(A;OICI;GA;;;CO)(A;OICI;GR;;;WD)SetDacl, StartSetDaclCustomActionDataCTX_InstallACLsWorkerGetUsersScheduledForRemovalCTX_RemoveACLs.2FC063C6_B4B7_4E0E_B5A1_DD207D00E9C7CtxAddACLPermCTX_SetupRemoveACLsUser_ExitFatal_ErrorExit_Dialog
Source: Broker_Service_x64.msi Static file information: TRID: Microsoft Windows Installer (60509/1) 57.88%
Source: unknown Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\Broker_Service_x64.msi"
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 61840644E35B0012964490F7155C79A4 C
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding F4607A9CFBE627DAA7B1AF4F0A87DD4D C
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 7D00F72EBD1F03FE2BA91EB00E79F5F2
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 40FEA25D10AEAC450300A64B6E69AD51
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding E5BAB935B9E62F5EF499449BA355B5C1 E Global\MSI0000
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding B57FEBC80AACA307814E81531C396CA3 E Global\MSI0000
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\AlwaysOnTracing.man"
Source: C:\Windows\SysWOW64\wevtutil.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wevtutil.exe Process created: C:\Windows\System32\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\AlwaysOnTracing.man" /fromwow64
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\BrokerEventsProvider.man"
Source: C:\Windows\SysWOW64\wevtutil.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wevtutil.exe Process created: C:\Windows\System32\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\BrokerEventsProvider.man" /fromwow64
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\HighAvailabilityEventsProvider.man"
Source: C:\Windows\SysWOW64\wevtutil.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wevtutil.exe Process created: C:\Windows\System32\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\HighAvailabilityEventsProvider.man" /fromwow64
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\SysWOW64\sc.exe" sidtype CitrixBrokerService unrestricted
Source: C:\Windows\SysWOW64\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Program Files\Citrix\Broker\Service\BrokerService.exe "C:\Program Files\Citrix\Broker\Service\BrokerService.exe" -Upgrade
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Program Files\Citrix\Broker\Service\BrokerService.exe "C:\Program Files\Citrix\Broker\Service\BrokerService.exe"
Source: C:\Windows\System32\svchost.exe Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe "C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe" -Pipeline "C:\Program Files\Citrix\Broker\Service\Pipeline\"
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe "C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe" -PluginsRoot "C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\"
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe "C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe" -PluginsRoot "C:\Program Files\Common Files\Citrix\HCLPlugins\ManagedMachine\v2.5.0.0\"
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 61840644E35B0012964490F7155C79A4 C Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding F4607A9CFBE627DAA7B1AF4F0A87DD4D C Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 7D00F72EBD1F03FE2BA91EB00E79F5F2 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 40FEA25D10AEAC450300A64B6E69AD51 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding E5BAB935B9E62F5EF499449BA355B5C1 E Global\MSI0000 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding B57FEBC80AACA307814E81531C396CA3 E Global\MSI0000 Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\AlwaysOnTracing.man" Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\BrokerEventsProvider.man" Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\HighAvailabilityEventsProvider.man" Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\SysWOW64\sc.exe" sidtype CitrixBrokerService unrestricted Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Program Files\Citrix\Broker\Service\BrokerService.exe "C:\Program Files\Citrix\Broker\Service\BrokerService.exe" -Upgrade Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe "C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe" -Pipeline "C:\Program Files\Citrix\Broker\Service\Pipeline\" Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe "C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe" -PluginsRoot "C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\" Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Windows\SysWOW64\wevtutil.exe Process created: C:\Windows\System32\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\AlwaysOnTracing.man" /fromwow64
Source: C:\Windows\SysWOW64\wevtutil.exe Process created: C:\Windows\System32\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\BrokerEventsProvider.man" /fromwow64
Source: C:\Windows\SysWOW64\wevtutil.exe Process created: C:\Windows\System32\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\HighAvailabilityEventsProvider.man" /fromwow64
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msihnd.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: moshost.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mapsbtsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mosstorage.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ztrace_maps.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mapconfiguration.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: srclient.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: spp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: vssapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: vsstrace.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: aphostservice.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: networkhelper.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: userdataplatformhelperutil.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: syncutil.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mccspal.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dmcfgutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dmcmnutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dmxmlhelputils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: inproclogger.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: flightsettings.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: windows.networking.connectivity.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: npmproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msv1_0.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntlmshared.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptdll.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: synccontroller.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: pimstore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: aphostclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: accountaccessor.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dsclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: systemeventsbrokerclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: userdatalanguageutil.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mccsengineshared.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cemapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: userdatatypehelperutil.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: phoneutil.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rmclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: storsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fltlib.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bcd.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wer.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: appxdeploymentclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: storageusage.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: w32time.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dsrole.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: vmictimeprovider.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: activeds.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: adsldpc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: activeds.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: adsldpc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: activeds.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: adsldpc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: activeds.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: adsldpc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: esdsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: activeds.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: adsldpc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: activeds.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: adsldpc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: activeds.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: adsldpc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: esdsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msxml3.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: activeds.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: adsldpc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: loadperf.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: licensemanagersvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: licensemanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: clipc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wevtutil.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe Section loaded: msxml6.dll
Source: C:\Windows\System32\wevtutil.exe Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\wevtutil.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe Section loaded: msxml6.dll
Source: C:\Windows\System32\wevtutil.exe Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\wevtutil.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe Section loaded: msxml6.dll
Source: C:\Windows\System32\wevtutil.exe Section loaded: wevtapi.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: mscoree.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: apphelp.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: version.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: cryptsp.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: rsaenh.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: cryptbase.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: windows.storage.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: wldp.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: profapi.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: urlmon.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: iertutil.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: srvcli.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: netutils.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: sspicli.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: propsys.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: ntmarta.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: iphlpapi.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: dnsapi.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: dhcpcsvc.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: winnsi.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: httpapi.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: mscoree.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: version.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: cryptsp.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: rsaenh.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: cryptbase.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: windows.storage.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: wldp.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: profapi.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: urlmon.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: iertutil.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: srvcli.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: netutils.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: sspicli.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: ieadvpack.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: devrtl.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: spinf.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: drvstore.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: spfileq.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: msasn1.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: ieadvpack.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: devrtl.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: spinf.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: drvstore.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: spfileq.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: msasn1.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: ieadvpack.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: devrtl.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: spinf.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: drvstore.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: spfileq.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: msasn1.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: ieadvpack.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: devrtl.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: spinf.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: drvstore.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: spfileq.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: msasn1.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: ieadvpack.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: devrtl.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: spinf.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: drvstore.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: spfileq.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: msasn1.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: propsys.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: iphlpapi.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: dnsapi.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: dhcpcsvc.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: winnsi.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: secur32.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: activeds.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: adsldpc.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: adsldp.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: sxs.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: ntdsapi.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: netapi32.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: logoncli.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: mswsock.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Section loaded: rasadhlp.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: gpapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: wbemcomn.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: amsi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: profapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: wscapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: urlmon.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: iertutil.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\wevtutil.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88d96a05-f192-11d4-a65f-0040963251e5}\InProcServer32
Source: C:\Windows\SysWOW64\msiexec.exe File written: C:\Users\user\AppData\Local\Temp\WIXPF001\wixperf.ini Jump to behavior
Source: C:\Windows\System32\msiexec.exe Automated click: I accept the terms in the License Agreement
Source: C:\Windows\System32\msiexec.exe Automated click: Install
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\msiexec.exe Window detected: WixUI_Bmp_DialogI &accept the terms in the License Agreement&Print&Back&InstallCancelCITRIX LICENSE AGREEMENTUse of this component is subject to the Citrix license or terms of service covering the Citrix product(s) and/or service(s) with which you will be using this component. This component is licensed for use only with such Citrix product(s) and/or service(s).CTX_code EP_R_A10352779Please read the Citrix Broker Service License Agreement
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddIns Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\UpdateScripts Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\zh-CN Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ImportScripts Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\ManagedMachine Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\ManagedMachine\v2.5.0.0 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\ThirdParty Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\ThirdParty\v2.5.0.0 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\CitrixMachineCreation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\CitrixMachineCreation\v1.0.0.0 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\32 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\32\ccauthcpp_dynamic.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\64 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\64\ccauthcpp_dynamic.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ActiveDirectory.SiteManagement.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ADIdentityInterService.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\AlwaysOnTracing.man Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\AlwaysOnTracing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\amd64 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\amd64\libccauth.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.Utilities.AssemblyResolver.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.Authentication.Models.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Avro.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.Aws.Batcher.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSPlugin.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.EBS.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.EC2.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.IdentityManagement.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.S3.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.SecurityToken.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Azure.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Azure.Identity.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Setup Scripts Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Setup Scripts\BackupDesktopServerKeys.ps1 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BaseDAL.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\BlankVhdTemplate.vhd Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\BlankVhdTemplate.vhd Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\BlankVhdTemplate.vhd Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\BlankVhdTemplate.vhd Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\BlankVhdTemplate.vhd Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BouncyCastle.Cryptography.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerAdminQuery.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerAdminService.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerCde.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerCdeLibrary.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerComponentCommon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerComponent.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerDAL.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerEnvTests.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerEventsProvider.man Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerFiltering.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerSDKDefinition.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerSDKLogic.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerService.exe.config.orig Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerServiceEventLogResources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\BrokerServiceSupport.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\Castle.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Castle.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Castle.Windsor.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\CbpConstants.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\CbpControllerSdk.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\CbpTypes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\CdeEvents.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\CdeLibrary.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Diagnostics.Tracing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Networking.WebSocket.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Networking.WebSocket.pdb Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.Xaxd.Authentication.Models.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.DistributedTracing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.Xaxd.NgsTunnel.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.Utilities.AssemblyResolver.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.Utilities.EnumCache.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.Utils.Strings.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.ADIdentity.DataModel.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Base.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Broker.CasCommandQueuePayload.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.AgentFoundation.Common.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.AgentFoundation.Common.Classic.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.AgentFoundation.OnPremiseCommon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.AgentFoundation.OnPremiseContracts.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Core.Api.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Diagnostics.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Logging.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Monitoring.ApplicationInsights.Shared.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Redis.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Security.CCAuth.Managed.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.ServiceRuntime.ApiClient.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.ServiceRuntime.Configuration.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Trust.Api.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Utilities.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.ConfigLogging.Wcf.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.ConfigurationLogging.Rest.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Configuration.Rest.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.DelegatedAdmin.Rest.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Monitor.BrokerCodes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.DelegatedAdminInterfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.DistributedTracing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.ServiceCommon.KeySharingInterfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.ServiceCore.Common.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.Utilities.Sids.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HCL.DistributedTracing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Host.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Common.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.HostView.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Models.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Wcf.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Wcf.Types.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.IconConverter.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.IdentityManagement.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.IdentityManagement.Logging.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.IdentityManagement.Utilities.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.MachineCreationAPI.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.MachineCreationAPI.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.ManagedMachineAPI.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.ManagedMachineAPI.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.ManagedMachineAPI.HostView.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.ManagedMachinePluginFinder.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.OperationalEvents.Broker.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.OperationalEvents.Common.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Services.ServiceHosting.WindowsServiceHostingApi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Services.ServiceLocator.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Trust.Library.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.CasConfigClient.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.CasEventHubClient.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.CasInterfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.Common.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.AspNet.CitrixCloud.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.AspNet.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.CitrixCloudCommon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.Interfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.Models.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.Profiles.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.CasDispatcher.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cdf.Net.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cloud.AclStore.Rest.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cloud.ServiceRegistry.Grpc.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cloud.ServiceRegistry.Rest.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cloud.VirtualSiteRegistry.Rest.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Common.Headers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Compression.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Compression.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Compression.Interfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Exporter.NewRelic.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Exporter.Cas.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.Wcf.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.Tc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.WebSocket.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.Wcf.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.Http.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Exceptions.Common.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Exceptions.Interfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Grpc.Client.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Grpc.Common.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Hostname.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Hostname.Interfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Logging.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Posh.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.RateLimiting.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.RateLimiting.Wcf.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Rest.Client.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Rest.Client.Interfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Retry.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Signer.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Tenancy.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Tenancy.Interfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utilities.AssemblyResolver.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utilities.EnumCache.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Collections.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.DateTime.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Dynamic.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Events.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Minimatch.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Networking.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Objectpool.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Reflection.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Retry.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.SecretBuffer.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Serialization.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Strings.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.Xaxd.Utils.Strings.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.StrongName.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Uri.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Windows.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Wcf.Client.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Wcf.Client.Interfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.XenDesktop.Cloud.DataStore.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.XenDesktop.Cloud.DataStore.Models.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\de Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\de\CloudCommon.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\es Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\es\CloudCommon.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\fr Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\fr\CloudCommon.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\ja Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\ja\CloudCommon.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\zh-CN Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\zh-CN\CloudCommon.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\CloudCommon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ComponentInterface.Constants.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ComponentInterface.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ConfigLoggingSupport.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Setup Scripts\ConfigureHighAvailabilityService.ps1 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ControllerDAL.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ControllerInterfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\CookComputing.XmlRpcV2.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\CredentialSecurity64.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\cs Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\cs\Microsoft.VisualStudio.Threading.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\cs\Microsoft.VisualStudio.Validation.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\CtxAdmin.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\CtxMcp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\CtxSta.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\CustomProvisioningCommon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\BrokerServiceSupport.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\Citrix.Base.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\Citrix.CloudServices.Core.Api.Client.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\Citrix.IconConverter.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\ConfigLoggingSupport.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\FmaCommonEnvTests.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\FmaConfigLoggingClient.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\GpAnalyzer.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\GpDocument.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\GpfxSettings.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.Edm.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.OData.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.Services.Client.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.SqlClient.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.SqlServer.Management.SqlParser.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.VisualStudio.Threading.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.VisualStudio.Validation.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\de\System.Spatial.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ImportScripts\Default.zip Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\DelegatedAdminSupport.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\DiscUtils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\DiscUtils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\DiscUtils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\DiscUtils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\DiscUtils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\DiscUtils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.DistributedTracing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\DnsIpSupport.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\DocumentFormat.OpenXml.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\UpdateScripts\downgrade_site_7.41.1100.0-7.41.100.0.xdu Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\BrokerServiceSupport.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\Citrix.Base.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\Citrix.CloudServices.Core.Api.Client.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\Citrix.IconConverter.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\ConfigLoggingSupport.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\FmaCommonEnvTests.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\FmaConfigLoggingClient.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\GpAnalyzer.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\GpDocument.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\GpfxSettings.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.Data.Edm.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.Data.OData.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.Data.Services.Client.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.Data.SqlClient.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.SqlServer.Management.SqlParser.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.VisualStudio.Threading.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.VisualStudio.Validation.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\es\System.Spatial.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\EventLogCodeGenHelper.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\EventLog.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaAbstractions.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaActiveDirectory.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaActiveDirectory.Interfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaCommandLine.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaCommandQueues.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaCommonEnvTests.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaConfigLoggingClient.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaConfigLoggingClientInterService.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaConfigLoggingShared.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaDalAttributes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaDalExceptions.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaDalRuntime.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaDependencyInjection.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaEnv.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaEnv.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaEnvTestInterfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaEnv.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaEventLog.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaFeature.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaFeature.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaFiltering.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaFilteringSdkSupport.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaIdentity.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaIdentity.Interfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.Interface.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.Models.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaLogging.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaLogging.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaLogging.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaPlugin.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaProductInfo.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaRegistry.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaRegistry.Interface.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaSchemaProbeDal.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaSchemaTools.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaSecretEncryption.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaSecretEncryptionManager.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.DelegatedAdmin.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Features.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Ism.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.KeySharing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Logging.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.ServiceControl.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.ServiceDiscovery.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.ServiceRegistration.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Settings.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSite.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSite.Interface.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSiteManager.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSiteProvider.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceControlInterface.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaServiceStatus.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceStatus.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaSiteServices.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaSiteServicesSupport.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaSqlScriptBuilder.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaSqlUtils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaTransactionScope.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FMAUtils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaUtils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaUtils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\FmaWcf.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\BrokerServiceSupport.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\Citrix.Base.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\Citrix.CloudServices.Core.Api.Client.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\Citrix.IconConverter.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\ConfigLoggingSupport.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\FmaCommonEnvTests.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\FmaConfigLoggingClient.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\GpAnalyzer.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\GpDocument.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\GpfxSettings.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.Data.Edm.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.Data.OData.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.Data.Services.Client.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.Data.SqlClient.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.SqlServer.Management.SqlParser.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.VisualStudio.Threading.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.VisualStudio.Validation.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\fr\System.Spatial.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Google.Api.CommonProtos.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Google.Protobuf.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\GpAnalyzer.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\GpContracts.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\GpDocument.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\GpfxSettings.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\GpXmlSchema.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\grpc_csharp_ext.x64.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\grpc_csharp_ext.x86.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Grpc.Core.Api.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Grpc.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Grpc.Net.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Grpc.Net.Common.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HypervisorCommunicationsLibrary.Contracts.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.HCL.DistributedTracing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HCL.DistributedTracing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\Citrix.HCL.DistributedTracing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.HCL.DistributedTracing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\Citrix.HCL.DistributedTracing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HypervisorCommunicationsLibrary.Models.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HCL.Shared.Contracts.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HCL.TlsCertificateVerification.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.HCL.TlsCertificateVerification.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\HighAvailabilityEventsProvider.man Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ControlScripts Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ControlScripts\HighAvailabilityServiceControl.psm1 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\HighAvailabilityServiceEventLogResources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\HostingManagementComponent.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HypervisorCommunicationsLibrary.AddInSideAdapter.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\HostSideAdapters Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\HostSideAdapters\Citrix.HypervisorCommunicationsLibrary.HostSideAdapter.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.Wcf.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.Wcf.Types.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\HypervisorsCommon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\HypervisorsCommon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\HypervisorsCommon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\HypervisorsCommon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\HypervisorsCommon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\HypervisorsCommon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\i386 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\i386\libccauth.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\IBrokerAdminQuery.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\IBrokerDAL.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\IBrokerDALInternal.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\IControllerDAL.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\IControllerDALInternal.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ICwcSupport.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\IDnsIpSupport.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\IEdgeProxySupport.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ILeasingControl.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSConfiguration Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSConfiguration\InstanceTypes.xml Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSConfiguration\InstanceTypes.xsd Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Interop.GPMGMTLib.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Interop.NetFwTypeLib.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\iobfuncdll.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ISdkLogic.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ISecondaryBrokerControl.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\it Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.Edm.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.OData.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.Services.Client.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.SqlClient.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.SqlServer.Management.SqlParser.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.VisualStudio.Threading.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.VisualStudio.Validation.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\it\System.Spatial.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\BrokerServiceSupport.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\Citrix.Base.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\Citrix.CloudServices.Core.Api.Client.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\Citrix.IconConverter.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\ConfigLoggingSupport.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\FmaCommonEnvTests.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\FmaConfigLoggingClient.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\GpAnalyzer.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\GpDocument.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\GpfxSettings.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.Edm.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.OData.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.Services.Client.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.SqlClient.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.SqlServer.Management.SqlParser.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.VisualStudio.Threading.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.VisualStudio.Validation.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ja\System.Spatial.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ko Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.Edm.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.OData.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.Services.Client.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.SqlClient.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.SqlServer.Management.SqlParser.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.VisualStudio.Threading.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.VisualStudio.Validation.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\ko\System.Spatial.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\LhcUtils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Licensing.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\LicPolEng.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.ManagedMachineAPI.AddInSideAdapter.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.ManagedMachineAPI.Contracts.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\HostSideAdapters\Citrix.ManagedMachineAPI.HostSideAdapter.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Microsoft.Bcl.AsyncInterfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Microsoft.Extensions.Logging.Abstractions.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Microsoft.Extensions.ObjectPool.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Microsoft.Extensions.ObjectPool.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.ApplicationInsights.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.AspNetCore.Http.Abstractions.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.AspNetCore.Http.Features.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.AspNetCore.SystemWebAdapters.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.KeyVault.Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.KeyVault.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.KeyVault.WebKey.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.Services.AppAuthentication.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.Storage.Blob.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.Storage.Common.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Bcl.AsyncInterfaces.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Bcl.HashCode.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.Edm.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.OData.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.Services.Client.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.SNI.arm64.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.SNI.x64.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.SNI.x86.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.Tools.Sql.BatchParser.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Deployment.Compression.Cab.dll Jump to behavior
Source: Broker_Service_x64.msi Static file information: File size 72298496 > 1048576
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\logging\cdf_sharp\win\anycpu-release__\obj\release\net472\Citrix.Diagnostics.Tracing.pdb source: BrokerService.exe, 0000001D.00000002.1915055457.00000194AB472000.00000002.00000001.01000000.0000001E.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\utils\assembly_resolver\anycpu-release__\obj\release\net472\Citrix.Xaxd.Utilities.AssemblyResolver.pdb source: BrokerService.exe, 0000001D.00000002.1909505618.00000194911D2000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\RemoteHCLClient\anycpu-release__\obj\release\net472\RemoteHCLClient.pdb(} source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Libraries\Cbp\CbpControllerSdk\anycpu-release__\obj\release\net472\CbpControllerSdk.pdb source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Shared\LhcUtils\anycpu-release__\obj\release\net472\LhcUtils.pdb source: BrokerService.exe, 0000001D.00000002.1909945480.0000019491282000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\BrokerComponent\anycpu-release__\obj\release\net472\BrokerComponent.pdb source: BrokerService.exe, 0000001F.00000002.2558857309.0000025451C32000.00000002.00000001.01000000.0000004C.sdmp
Source: Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.ValueTuple/net47\System.ValueTuple.pdb62P2 B2_CorDllMainmscoree.dll source: BrokerService.exe, 0000001F.00000002.2549401679.000002544F472000.00000002.00000001.01000000.00000036.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaSids\anycpu-release__\obj\release\net472\Citrix.Fma.Sdk.Utilities.Sids.pdb source: BrokerService.exe, 0000001F.00000002.2555275324.0000025451652000.00000002.00000001.01000000.00000046.sdmp
Source: Binary string: Microsoft.Data.SqlClient.SNI.pdb source: Microsoft.Data.SqlClient.SNI.x64.dll.4.dr, Microsoft.Data.SqlClient.SNI.x86.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\Wpnbr\anycpu-release__\obj\release\net472\Wpnbr.pdbQ source: BrokerService.exe, 0000001D.00000002.1917130914.00000194AB772000.00000002.00000001.01000000.00000030.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\CtxAdmin\anycpu-release__\obj\release\net472\CtxAdmin.pdb source: BrokerService.exe, 0000001D.00000002.1916802918.00000194AB6C2000.00000002.00000001.01000000.0000002C.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.ServiceRegistration\anycpu-release__\obj\release\net472\FmaServiceCommon.ServiceRegistration.pdb source: BrokerService.exe, 0000001F.00000002.2555021751.0000025451632000.00000002.00000001.01000000.00000045.sdmp
Source: Binary string: /_/artifacts/obj/System.Security.Permissions/Release/net462/System.Security.Permissions.pdbSHA256 source: System.Security.Permissions.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\ICwcSupport\anycpu-release__\obj\release\net472\ICwcSupport.pdbX4r4 d4_CorDllMainmscoree.dll source: ICwcSupport.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\GroupPolicy\GpAnalyzer\Analyzer\anycpu-release__\obj\release\net472\GpAnalyzer.pdbH source: GpAnalyzer.dll.4.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Rest.ClientRuntime\Release\net461\Microsoft.Rest.ClientRuntime.pdbSHA256TS- source: Microsoft.Rest.ClientRuntime.dll.4.dr
Source: Binary string: X:\src\HelperPackages\Bootstrap\Bootstrap_CA\wh32\retail\vc80\static\bootstrap_ca.pdbH source: MSIDD31.tmp.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\XmlMultiplexer\anycpu-release__\obj\release\net472\XmlMultiplexer.pdb source: BrokerService.exe, 0000001D.00000002.1916476987.00000194AB682000.00000002.00000001.01000000.00000029.sdmp
Source: Binary string: /_/obj/src/Microsoft/SqlServer/Management/CollectorEnum/Release/net462/Microsoft.SqlServer.Management.CollectorEnum.pdb source: Microsoft.SqlServer.Management.CollectorEnum.dll.4.dr
Source: Binary string: Microsoft.Data.SqlClient.SNI.pdbGCTL source: Microsoft.Data.SqlClient.SNI.x64.dll.4.dr, Microsoft.Data.SqlClient.SNI.x86.dll.4.dr
Source: Binary string: T:\altsrc\github\grpc\workspace_csharp_ext_windows_x64\cmake\build\x64\grpc_csharp_ext.pdb source: grpc_csharp_ext.x64.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaRegistry.Interface\anycpu-release__\obj\release\netstandard2.0\FmaRegistry.Interface.pdbL6f6 X6_CorDllMainmscoree.dll source: BrokerService.exe, 0000001D.00000002.1910001253.0000019491292000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\CtxMcp\anycpu-release__\obj\release\net472\CtxMcp.pdb source: BrokerService.exe, 0000001D.00000002.1917548815.00000194ABA52000.00000002.00000001.01000000.00000032.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\DiscUtils\src\anycpu-release__\obj\release\net472\DiscUtils.pdb source: DiscUtils.dll4.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.VirtualSite\anycpu-release__\obj\release\net472\FmaServiceCommon.VirtualSite.pdb source: BrokerService.exe, 0000001F.00000002.2554388742.00000254515D2000.00000002.00000001.01000000.00000042.sdmp, FmaServiceCommon.VirtualSite.dll.4.dr
Source: Binary string: c:\projects\nlog\NLog.ManualFlush\obj\Release\NLog.ManualFlush.pdb source: NLog.ManualFlush.dll.4.dr
Source: Binary string: C:\jenkins\workspace\AuthX\Build-Custom\Build-CCAuthCpp-Master\cmake_windows_32\src\Release\ccauthcpp_dynamic.pdb source: ccauthcpp_dynamic.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaEnv\anycpu-release__\obj\release\netstandard2.0\FmaEnv.pdb source: BrokerService.exe, 0000001D.00000002.1912083012.00000194AB262000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: /_/artifacts/obj/System.Security.Principal.Windows/net461-Windows_NT-Release/System.Security.Principal.Windows.pdb source: BrokerService.exe, 0000001F.00000002.2555493326.0000025451972000.00000002.00000001.01000000.00000047.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\CDE\BrokerCdeLibrary\anycpu-release__\obj\release\net472\BrokerCdeLibrary.pdb source: BrokerService.exe, 0000001D.00000002.1909749981.0000019491232000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: /_/artifacts/obj/System.ServiceProcess.ServiceController/Release/net462/System.ServiceProcess.ServiceController.pdbSHA256) source: BrokerService.exe, 0000001D.00000002.1912129198.00000194AB272000.00000002.00000001.01000000.00000013.sdmp, System.ServiceProcess.ServiceController.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\SDK\BrokerAdminService\anycpu-release__\obj\release\net472\BrokerAdminService.pdb source: BrokerAdminService.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\RemoteHCLClient\anycpu-release__\obj\release\net472\RemoteHCLClient.pdb source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp
Source: Binary string: Citrix.Networking.WebSocket.pdb.7818E375_CB2C_4E80_99E7_4C40D0D5718B source: Broker_Service_x64.msi
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\distributed_tracing\exporter\newrelic\anycpu-release__\obj\release\net472\Citrix.Xaxd.DistributedTracing.Exporter.NewRelic.pdb source: Citrix.Xaxd.DistributedTracing.Exporter.NewRelic.dll.4.dr
Source: Binary string: /_/artifacts/obj/System.Security.Principal.Windows/net461-Windows_NT-Release/System.Security.Principal.Windows.pdbSHA256zqXL source: BrokerService.exe, 0000001F.00000002.2555493326.0000025451972000.00000002.00000001.01000000.00000047.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.KeySharingInterfaces\anycpu-release__\obj\release\net472\Citrix.Fma.Sdk.ServiceCommon.KeySharingInterfaces.pdb source: Citrix.Fma.Sdk.ServiceCommon.KeySharingInterfaces.dll.4.dr
Source: Binary string: C:\jenkins\workspace\CitrixCloud\Build\Src\Logging\obj\Release\netstandard2.0\Citrix.CloudServices.Logging.pdb source: Citrix.CloudServices.Logging.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaRegistry.Interface\anycpu-release__\obj\release\netstandard2.0\FmaRegistry.Interface.pdb source: BrokerService.exe, 0000001D.00000002.1910001253.0000019491292000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\DistributedTracing\anycpu-release__\obj\release\netstandard2.0\Citrix.Fma.Sdk.DistributedTracing.pdb source: BrokerService.exe, 0000001D.00000002.1914666070.00000194AB422000.00000002.00000001.01000000.0000001A.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\DAL\IBrokerDAL\anycpu-release__\obj\release\net472\IBrokerDAL.pdb source: IBrokerDAL.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.ManagedMachineAPI\anycpu-release__\obj\release\net472\Citrix.ManagedMachineAPI.pdb source: BrokerService.exe, 0000001F.00000002.2553794425.0000025450D72000.00000002.00000001.01000000.0000003E.sdmp
Source: Binary string: D:\a\_work\1\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb source: System.Memory.dll0.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\ICwcSupport\anycpu-release__\obj\release\net472\ICwcSupport.pdb source: ICwcSupport.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaEventLog\anycpu-release__\obj\release\net472\FmaEventLog.pdb< source: BrokerService.exe, 0000001F.00000002.2553006670.00000254506D2000.00000002.00000001.01000000.00000038.sdmp
Source: Binary string: C:\workspace-analytics\workspace-analytics\Output\AnyCPU\Citrix.WorkspaceAnalytics.CasInterfaces\obj\Debug\Citrix.WorkspaceAnalytics.CasInterfaces.pdb source: Citrix.WorkspaceAnalytics.CasInterfaces.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\ActiveDirectory\FmaActiveDirectory\anycpu-release__\obj\release\netstandard2.0\FmaActiveDirectory.pdb.y source: BrokerService.exe, 0000001F.00000002.2556875287.0000025451A92000.00000002.00000001.01000000.0000004A.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Shared\VirtualSites\anycpu-release__\obj\release\net472\VirtualSites.pdb source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\SDK\BrokerSDKDefinition\anycpu-release__\obj\release\netstandard2.0\BrokerSDKDefinition.pdb source: BrokerService.exe, 0000001F.00000002.2556016980.00000254519F2000.00000002.00000001.01000000.00000049.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\utils\events\anycpu-release__\obj\release\netstandard2.0\Citrix.Xaxd.Utils.Events.pdb source: BrokerService.exe, 0000001F.00000002.2553584343.0000025450D52000.00000002.00000001.01000000.0000003C.sdmp
Source: Binary string: /_/artifacts/obj/Microsoft.Win32.Registry/net461-Windows_NT-Release/Microsoft.Win32.Registry.pdb source: BrokerService.exe, 0000001D.00000002.1912963441.00000194AB382000.00000002.00000001.01000000.00000014.sdmp, Microsoft.Win32.Registry.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaTransactionScope\anycpu-release__\obj\release\netstandard2.0\FmaTransactionScope.pdb source: BrokerService.exe, 0000001D.00000002.1913930609.00000194AB3E2000.00000002.00000001.01000000.00000018.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.PluginRegistrationTool\anycpu-release__\obj\release\net472\RegisterPlugins.pdb source: RegisterPlugins.exe, 00000022.00000000.1925697735.000002B30D5F2000.00000002.00000001.01000000.00000035.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\hostname\interfaces\anycpu-release__\obj\release\netstandard2.0\Citrix.Xaxd.Hostname.Interfaces.pdb9,S, E,_CorDllMainmscoree.dll source: Citrix.Xaxd.Hostname.Interfaces.dll.4.dr
Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.Logging.Abstractions/Release/net462/Microsoft.Extensions.Logging.Abstractions.pdbSHA256 source: BrokerService.exe, 0000001D.00000002.1914867354.00000194AB442000.00000002.00000001.01000000.0000001C.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\WorkerChannelFactoryLoader\anycpu-release__\obj\release\net472\WorkerChannelFactoryLoader.pdb source: BrokerService.exe, 0000001F.00000002.2553979605.0000025450D82000.00000002.00000001.01000000.0000003F.sdmp
Source: Binary string: /_/obj/src/Microsoft/SqlServer/Management/CollectorEnum/Release/net462/Microsoft.SqlServer.Management.CollectorEnum.pdb@aZa La_CorDllMainmscoree.dll source: Microsoft.SqlServer.Management.CollectorEnum.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.VirtualSite.Interface\anycpu-release__\obj\release\netstandard2.0\FmaServiceCommon.VirtualSite.Interface.pdb~1 source: BrokerService.exe, 0000001D.00000002.1913698768.00000194AB3D2000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.HCL.DistributedTracing\anycpu-release__\obj\release\net472\Citrix.HCL.DistributedTracing.pdb source: Citrix.HCL.DistributedTracing.dll0.4.dr
Source: Binary string: /_/artifacts/obj/System.Diagnostics.DiagnosticSource/Release/net462/System.Diagnostics.DiagnosticSource.pdbSHA256h source: BrokerService.exe, 0000001D.00000002.1915939180.00000194AB572000.00000002.00000001.01000000.00000026.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaInterServiceClients\Runtime\FmaInterServiceManager.Interface\anycpu-release__\obj\release\net472\FmaInterServiceManager.Interface.pdb source: BrokerService.exe, 0000001D.00000002.1914986331.00000194AB462000.00000002.00000001.01000000.0000001D.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\XmsInterfaces\anycpu-release__\obj\release\net472\XmsInterfaces.pdb source: BrokerService.exe, 0000001D.00000002.1916621102.00000194AB692000.00000002.00000001.01000000.0000002A.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.VirtualSiteManager\anycpu-release__\obj\release\net472\FmaServiceCommon.VirtualSiteManager.pdb source: BrokerService.exe, 0000001F.00000002.2554213094.00000254515C2000.00000002.00000001.01000000.00000041.sdmp
Source: Binary string: Citrix.Networking.WebSocket.pdb.7818E375_CB2C_4E80_99E7_4C40D0D5718BHF source: Broker_Service_x64.msi
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\RegistryCounters\anycpu-release__\obj\release\net472\RegistryCounters.pdb source: BrokerService.exe, 0000001D.00000002.1916301428.00000194AB672000.00000002.00000001.01000000.00000028.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaSqlUtils\anycpu-release__\obj\release\netstandard2.0\FmaSqlUtils.pdb source: FmaSqlUtils.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaPlugin\anycpu-release__\obj\release\netstandard2.0\FmaPlugin.pdb source: BrokerService.exe, 0000001F.00000002.2553466258.0000025450CB2000.00000002.00000001.01000000.0000003B.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.VirtualSite.Interface\anycpu-release__\obj\release\netstandard2.0\FmaServiceCommon.VirtualSite.Interface.pdb source: BrokerService.exe, 0000001D.00000002.1913698768.00000194AB3D2000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.ValueTuple/net47\System.ValueTuple.pdb source: BrokerService.exe, 0000001F.00000002.2549401679.000002544F472000.00000002.00000001.01000000.00000036.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\DiscUtils\src\anycpu-release__\obj\release\net472\DiscUtils.pdb8> source: DiscUtils.dll4.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaUtils\anycpu-release__\obj\release\net472\FmaUtils.pdbb source: BrokerService.exe, 0000001D.00000002.1909451331.00000194911C2000.00000002.00000001.01000000.00000009.sdmp, FMAUtils.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaEnv\anycpu-release__\obj\release\netstandard2.0\FmaEnv.pdb28L8 >8_CorDllMainmscoree.dll source: BrokerService.exe, 0000001D.00000002.1912083012.00000194AB262000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\ActiveDirectory\FmaActiveDirectory\anycpu-release__\obj\release\netstandard2.0\FmaActiveDirectory.pdb source: BrokerService.exe, 0000001F.00000002.2556875287.0000025451A92000.00000002.00000001.01000000.0000004A.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.HypervisorCommunicationsLibrary\anycpu-release__\obj\release\net472\Citrix.HypervisorCommunicationsLibrary.pdb source: Citrix.HypervisorCommunicationsLibrary.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Libraries\FmaCommandQueues\CasCommandQueuePayload\anycpu-release__\obj\release\netstandard2.0\Citrix.Broker.CasCommandQueuePayload.pdbB5\5 N5_CorDllMainmscoree.dll source: Citrix.Broker.CasCommandQueuePayload.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaFeature\anycpu-release__\obj\release\netstandard2.0\FmaFeature.pdb source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp
Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.HashCode/net461-Release/Microsoft.Bcl.HashCode.pdb source: Microsoft.Bcl.HashCode.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.ManagedMachineAPI\anycpu-release__\obj\release\net472\Citrix.ManagedMachineAPI.pdb> source: BrokerService.exe, 0000001F.00000002.2553794425.0000025450D72000.00000002.00000001.01000000.0000003E.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\logging\cdf_net\core\anycpu-release__\obj\release\net472\Citrix.Xaxd.Cdf.Net.pdb source: BrokerService.exe, 0000001D.00000002.1909850188.0000019491242000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\ProxyCommon\anycpu-release__\obj\release\net472\ProxyCommon.pdb$ source: BrokerService.exe, 0000001D.00000002.1917667880.00000194ABA92000.00000002.00000001.01000000.00000033.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaRegistry\anycpu-release__\obj\release\netstandard2.0\FmaRegistry.pdb source: BrokerService.exe, 0000001D.00000002.1909555493.00000194911E2000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaEventLog\anycpu-release__\obj\release\net472\FmaEventLog.pdb source: BrokerService.exe, 0000001F.00000002.2553006670.00000254506D2000.00000002.00000001.01000000.00000038.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\IDnsIpSupport\anycpu-release__\obj\release\net472\IDnsIpSupport.pdb source: IDnsIpSupport.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\utils\windows\anycpu-release__\obj\release\net472\Citrix.Xaxd.Utils.Windows.pdb source: Citrix.Xaxd.Utils.Windows.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\utils\strings\anycpu-release__\obj\release\netstandard2.0\Citrix.Xaxd.Utils.Strings.pdb source: BrokerService.exe, 0000001D.00000002.1913390576.00000194AB3C2000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaInterServiceClients\Runtime\FmaInterServiceManager\anycpu-release__\obj\release\net472\FmaInterServiceManager.pdb source: BrokerService.exe, 0000001D.00000002.1915578302.00000194AB522000.00000002.00000001.01000000.00000023.sdmp
Source: Binary string: /_/artifacts/obj/System.Security.Permissions/Release/net462/System.Security.Permissions.pdb source: System.Security.Permissions.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Libraries\FmaCommandQueues\CasCommandQueuePayload\anycpu-release__\obj\release\netstandard2.0\Citrix.Broker.CasCommandQueuePayload.pdb source: Citrix.Broker.CasCommandQueuePayload.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaDal\Runtime\FmaDalRuntime\anycpu-release__\obj\release\netstandard2.0\FmaDalRuntime.pdb source: BrokerService.exe, 0000001D.00000002.1915242829.00000194AB4C2000.00000002.00000001.01000000.0000001F.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaLogging\anycpu-release__\obj\release\net472\FmaLogging.pdb source: BrokerService.exe, 0000001D.00000002.1911974174.00000194AB232000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaInterServiceClients\Runtime\FmaInterServiceManager.Models\anycpu-release__\obj\release\netstandard2.0\FmaInterServiceManager.Models.pdb source: BrokerService.exe, 0000001D.00000002.1915395701.00000194AB4F2000.00000002.00000001.01000000.00000021.sdmp
Source: Binary string: /_/artifacts/obj/System.ServiceProcess.ServiceController/Release/net462/System.ServiceProcess.ServiceController.pdb source: BrokerService.exe, 0000001D.00000002.1912129198.00000194AB272000.00000002.00000001.01000000.00000013.sdmp, System.ServiceProcess.ServiceController.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\CtxSta\anycpu-release__\obj\release\net472\CtxSta.pdbK source: BrokerService.exe, 0000001D.00000002.1916882745.00000194AB6D2000.00000002.00000001.01000000.0000002D.sdmp, CtxSta.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaWcf\anycpu-release__\obj\release\net472\FmaWcf.pdb source: BrokerService.exe, 0000001F.00000002.2552865039.00000254506C2000.00000002.00000001.01000000.00000037.sdmp
Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdbSHA256 source: Microsoft.Bcl.AsyncInterfaces.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\ActiveDirectory\FmaActiveDirectory.Interfaces\anycpu-release__\obj\release\netstandard2.0\FmaActiveDirectory.Interfaces.pdb source: BrokerService.exe, 0000001F.00000002.2554565821.00000254515E2000.00000002.00000001.01000000.00000043.sdmp
Source: Binary string: /_/obj/src/Microsoft/SqlServer/Management/RegisteredServers/Release/net462/Microsoft.SqlServer.Management.RegisteredServers.pdb source: Microsoft.SqlServer.Management.RegisteredServers.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.HypervisorCommunicationsLibrary.Wcf\anycpu-release__\obj\release\net472\Citrix.HypervisorCommunicationsLibrary.Wcf.pdbnD source: Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr
Source: Binary string: C:\jenkins\workspace\CitrixCloud\Build\Src\Logging\obj\Release\netstandard2.0\Citrix.CloudServices.Logging.pdbSHA256 source: Citrix.CloudServices.Logging.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\GroupPolicy\GpAnalyzer\Analyzer\anycpu-release__\obj\release\net472\GpAnalyzer.pdb source: GpAnalyzer.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\Licensing\anycpu-release__\obj\release\net472\Licensing.pdb source: BrokerService.exe, 0000001D.00000002.1916686247.00000194AB6A2000.00000002.00000001.01000000.0000002B.sdmp
Source: Binary string: C:\Jenkins\workspace\CitrixCloud\Build\Src\AgentFoundation\Common\obj\Release\netstandard2.0\Citrix.CloudServices.AgentFoundation.Common.pdb source: Citrix.CloudServices.AgentFoundation.Common.dll.4.dr
Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.Logging/Release/net462/Microsoft.Extensions.Logging.pdbSHA256kYf source: Microsoft.Extensions.Logging.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\logging\cdf_sharp\win\anycpu-release__\obj\release\net472\Citrix.Diagnostics.Tracing.pdb~ source: BrokerService.exe, 0000001D.00000002.1915055457.00000194AB472000.00000002.00000001.01000000.0000001E.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\ProxyCommon\anycpu-release__\obj\release\net472\ProxyCommon.pdb source: BrokerService.exe, 0000001D.00000002.1917667880.00000194ABA92000.00000002.00000001.01000000.00000033.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\BrokerComponentCommon\anycpu-release__\obj\release\net472\BrokerComponentCommon.pdb source: BrokerService.exe, 0000001D.00000002.1917029887.00000194AB6F2000.00000002.00000001.01000000.0000002F.sdmp
Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.Logging.Abstractions/Release/net462/Microsoft.Extensions.Logging.Abstractions.pdb source: BrokerService.exe, 0000001D.00000002.1914867354.00000194AB442000.00000002.00000001.01000000.0000001C.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\HostingManagement\HostingManagementComponent\anycpu-release__\obj\release\net472\HostingManagementComponent.pdb source: BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.HypervisorCommunicationsLibrary.HostView\anycpu-release__\obj\release\net472\Citrix.HypervisorCommunicationsLibrary.HostView.pdb source: Citrix.HypervisorCommunicationsLibrary.HostView.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaUtils\anycpu-release__\obj\release\net472\FmaUtils.pdb source: BrokerService.exe, 0000001D.00000002.1909451331.00000194911C2000.00000002.00000001.01000000.00000009.sdmp, FMAUtils.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\UrlAclSupport\anycpu-release__\obj\release\net472\UrlAclSupport.pdb source: BrokerService.exe, 0000001D.00000002.1916166886.00000194AB642000.00000002.00000001.01000000.00000027.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\authentication\interfaces\anycpu-release__\obj\release\net472\Citrix.Xaxd.Authentication.Interfaces.pdb source: BrokerService.exe, 0000001D.00000002.1915326873.00000194AB4E2000.00000002.00000001.01000000.00000020.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaInterServiceClients\Runtime\FmaInterServiceManager.Models\anycpu-release__\obj\release\netstandard2.0\FmaInterServiceManager.Models.pdb"Y<Y .Y_CorDllMainmscoree.dll source: BrokerService.exe, 0000001D.00000002.1915395701.00000194AB4F2000.00000002.00000001.01000000.00000021.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.Settings\anycpu-release__\obj\release\net472\FmaServiceCommon.Settings.pdb source: BrokerService.exe, 0000001D.00000002.1914580532.00000194AB402000.00000002.00000001.01000000.00000019.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.HCL.DistributedTracing\anycpu-release__\obj\release\net472\Citrix.HCL.DistributedTracing.pdbXCrC dC_CorDllMainmscoree.dll source: Citrix.HCL.DistributedTracing.dll0.4.dr
Source: Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb source: System.Numerics.Vectors.dll0.4.dr
Source: Binary string: /_/artifacts/obj/System.Configuration.ConfigurationManager/Release/net462/System.Configuration.ConfigurationManager.pdbSHA256 source: BrokerService.exe, 0000001D.00000002.1913217539.00000194AB3A2000.00000002.00000001.01000000.00000015.sdmp, System.Configuration.ConfigurationManager.dll0.4.dr, System.Configuration.ConfigurationManager.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Shared\VirtualSites\anycpu-release__\obj\release\net472\VirtualSites.pdb: source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\XmsRuntime\anycpu-release__\obj\release\net472\XmsRuntime.pdb source: BrokerService.exe, 0000001D.00000002.1916960617.00000194AB6E2000.00000002.00000001.01000000.0000002E.sdmp
Source: Binary string: /_/artifacts/obj/System.Diagnostics.DiagnosticSource/Release/net462/System.Diagnostics.DiagnosticSource.pdb source: BrokerService.exe, 0000001D.00000002.1915939180.00000194AB572000.00000002.00000001.01000000.00000026.sdmp
Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdb source: Microsoft.Bcl.AsyncInterfaces.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\utils\date_time\anycpu-release__\obj\release\netstandard2.0\Citrix.Xaxd.Utils.DateTime.pdb source: BrokerService.exe, 0000001F.00000002.2553129762.0000025450BE2000.00000002.00000001.01000000.00000039.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\CtxSta\anycpu-release__\obj\release\net472\CtxSta.pdb source: BrokerService.exe, 0000001D.00000002.1916882745.00000194AB6D2000.00000002.00000001.01000000.0000002D.sdmp, CtxSta.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.VirtualSiteManager\anycpu-release__\obj\release\net472\FmaServiceCommon.VirtualSiteManager.pdb< source: BrokerService.exe, 0000001F.00000002.2554213094.00000254515C2000.00000002.00000001.01000000.00000041.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\TicketStore\TicketStore\anycpu-release__\obj\release\net472\TicketStore.pdb source: BrokerService.exe, 0000001F.00000002.2553679495.0000025450D62000.00000002.00000001.01000000.0000003D.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\hostname\interfaces\anycpu-release__\obj\release\netstandard2.0\Citrix.Xaxd.Hostname.Interfaces.pdb source: Citrix.Xaxd.Hostname.Interfaces.dll.4.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Rest.ClientRuntime\Release\net461\Microsoft.Rest.ClientRuntime.pdb source: Microsoft.Rest.ClientRuntime.dll.4.dr
Source: Binary string: /_/artifacts/obj/System.Configuration.ConfigurationManager/Release/net462/System.Configuration.ConfigurationManager.pdb source: BrokerService.exe, 0000001D.00000002.1913217539.00000194AB3A2000.00000002.00000001.01000000.00000015.sdmp, System.Configuration.ConfigurationManager.dll0.4.dr, System.Configuration.ConfigurationManager.dll.4.dr
Source: Binary string: C:\Jenkins\workspace\CitrixCloud\Build\Src\AgentFoundation\Common\obj\Release\netstandard2.0\Citrix.CloudServices.AgentFoundation.Common.pdbI source: Citrix.CloudServices.AgentFoundation.Common.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\distributed_tracing\core\anycpu-release__\obj\release\net472\Citrix.Xaxd.DistributedTracing.pdb source: BrokerService.exe, 0000001D.00000002.1915459492.00000194AB502000.00000002.00000001.01000000.00000022.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaCommandLine\anycpu-release__\obj\release\netstandard2.0\FmaCommandLine.pdb source: BrokerService.exe, 0000001D.00000002.1915842117.00000194AB562000.00000002.00000001.01000000.00000025.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaCommandLine\anycpu-release__\obj\release\netstandard2.0\FmaCommandLine.pdbv\ source: BrokerService.exe, 0000001D.00000002.1915842117.00000194AB562000.00000002.00000001.01000000.00000025.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\BrokerComponentCommon\anycpu-release__\obj\release\net472\BrokerComponentCommon.pdbp source: BrokerService.exe, 0000001D.00000002.1917029887.00000194AB6F2000.00000002.00000001.01000000.0000002F.sdmp
Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.Logging/Release/net462/Microsoft.Extensions.Logging.pdb source: Microsoft.Extensions.Logging.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\Wpnbr\anycpu-release__\obj\release\net472\Wpnbr.pdb source: BrokerService.exe, 0000001D.00000002.1917130914.00000194AB772000.00000002.00000001.01000000.00000030.sdmp
Source: Binary string: X:\src\HelperPackages\Bootstrap\Bootstrap_CA\wh32\retail\vc80\static\bootstrap_ca.pdb source: MSIDD31.tmp.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Shared\EventLog\anycpu-release__\obj\release\net472\EventLog.pdb source: BrokerService.exe, 0000001D.00000002.1917745850.00000194ABAD2000.00000002.00000001.01000000.00000034.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaDal\Runtime\SiteServices\FmaSiteServices\anycpu-release__\obj\release\netstandard2.0\FmaSiteServices.pdb source: BrokerService.exe, 0000001F.00000002.2554068226.0000025450DF2000.00000002.00000001.01000000.00000040.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\distributed_tracing\core\anycpu-release__\obj\release\net472\Citrix.Xaxd.DistributedTracing.pdb} source: BrokerService.exe, 0000001D.00000002.1915459492.00000194AB502000.00000002.00000001.01000000.00000022.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaLogging\anycpu-release__\obj\release\net472\FmaLogging.pdb: source: BrokerService.exe, 0000001D.00000002.1911974174.00000194AB232000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: /_/artifacts/obj/Microsoft.Win32.Registry/net461-Windows_NT-Release/Microsoft.Win32.Registry.pdbSHA256 source: BrokerService.exe, 0000001D.00000002.1912963441.00000194AB382000.00000002.00000001.01000000.00000014.sdmp, Microsoft.Win32.Registry.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.HypervisorCommunicationsLibrary.Wcf\anycpu-release__\obj\release\net472\Citrix.HypervisorCommunicationsLibrary.Wcf.pdb source: Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Controller\ControllerService\x64-release__\obj\x64\release\net472\BrokerService.pdb source: BrokerService.exe, 0000001D.00000000.1835935201.0000019490E52000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaDependencyInjection\anycpu-release__\obj\release\netstandard2.0\FmaDependencyInjection.pdb source: BrokerService.exe, 0000001D.00000002.1915775374.00000194AB542000.00000002.00000001.01000000.00000024.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaDal\Runtime\SiteServices\FmaSiteServices\anycpu-release__\obj\release\netstandard2.0\FmaSiteServices.pdb' source: BrokerService.exe, 0000001F.00000002.2554068226.0000025450DF2000.00000002.00000001.01000000.00000040.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaTransactionScope\anycpu-release__\obj\release\netstandard2.0\FmaTransactionScope.pdb(/B/ 4/_CorDllMainmscoree.dll source: BrokerService.exe, 0000001D.00000002.1913930609.00000194AB3E2000.00000002.00000001.01000000.00000018.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Shared\Settings\anycpu-release__\obj\release\net472\Settings.pdb source: BrokerService.exe, 0000001F.00000002.2553217176.0000025450C32000.00000002.00000001.01000000.0000003A.sdmp, Settings.dll.4.dr
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Controller\ComponentInterface\anycpu-release__\obj\release\net472\ComponentInterface.pdb source: BrokerService.exe, 0000001D.00000002.1909653018.0000019491202000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Plugins\HypervisorsCommon\anycpu-release__\obj\release\net472\HypervisorsCommon.pdb source: HypervisorsCommon.dll0.4.dr
Binary contains a suspicious time stamp
Source: SCVMM.dll.4.dr Static PE information: 0xD15B71CF [Mon Apr 21 03:17:35 2081 UTC]
PE file contains sections with non-standard names
Source: MSI99A3.tmp.0.dr Static PE information: section name: _RDATA
Drops PE files
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\HypervisorsCommon.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.OData.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FMAUtils.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\de\Citrix.Base.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Http.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Unity.Container.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Grpc.Core.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HypervisorCommunicationsLibrary.Contracts.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.AspNetCore.Http.Abstractions.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.ServiceCommon.KeySharingInterfaces.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\es\SCVMM.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ja\FmaConfigLoggingClient.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\tr\Microsoft.VisualStudio.Validation.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\IControllerDAL.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.SqlClient.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ja\GpAnalyzer.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.SqlServer.Management.SqlParser.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Drawing.Common.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\fr\System.Spatial.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\NLog.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Primitives.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\GpAnalyzer.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID0F6.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\ja\SCVMM.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Net.Http.WinHttpHandler.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Settings.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.ManagedMachineAPI.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.Edm.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ko\System.Spatial.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\fr\GpDocument.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaSchemaProbeDal.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\LhcUtils.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.SqlScriptPublish.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\LicPolEng.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\de\GpfxSettings.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaServiceStatus.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.SqlServer.Management.SqlParser.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Management.Automation.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\CredentialSecurity64.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Microsoft.Bcl.AsyncInterfaces.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIC5C3.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Polly.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\System.Memory.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.Edm.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ru\Microsoft.Data.OData.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.VisualStudio.Validation.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Logging.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\RemoteHCLCLient.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ProxyCommon.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaServiceStatus.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Text.Json.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\protobuf-net.Core.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.SqlClient.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ADIdentityInterService.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Ism.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\SdkAttributes.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.Aws.Batcher.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.Assessment.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\fr\Citrix.IconConverter.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.IdentityModel.Logging.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIC535.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\fr\FmaCommonEnvTests.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\iobfuncdll.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.Data.Services.Client.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Security.Cryptography.Xml.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.OperationalEvents.Broker.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.WmiEnum.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.OData.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Utilities.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ru\Microsoft.Data.Edm.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\zh-CN\SCVMM.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.DelegatedAdmin.Rest.Client.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Text.Encoding.CodePages.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.CasEventHubClient.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\fr\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.VisualStudio.Validation.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HypervisorCommunicationsLibrary.Models.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaLogging.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ja\ConfigLoggingSupport.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Identity.Client.Extensions.Msal.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.Storage.Common.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ICwcSupport.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Temp\MSI9878.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\fr\Citrix.CloudServices.Core.Api.Client.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.SqlEnum.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ja\BrokerServiceSupport.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\SCVMM.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Smo.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.VisualStudio.Validation.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.Services.ServiceLocator.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\de\GpAnalyzer.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Runtime.CompilerServices.Unsafe.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Interop.GPMGMTLib.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ComponentInterface.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Models.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HCL.DistributedTracing.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ILeasingControl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.Services.Client.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Net.Http.Formatting.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\cs\Microsoft.VisualStudio.Threading.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Bcl.HashCode.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\fr\ConfigLoggingSupport.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Configuration.Abstractions.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Options.ConfigurationExtensions.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Security.Cryptography.ProtectedData.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.CasConfigClient.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.XenDesktop.Cloud.DataStore.Models.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.SmoExtended.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\System.Buffers.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\IEdgeProxySupport.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\it\System.Spatial.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.ServiceCore.Common.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\es\FmaCommonEnvTests.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Rest.ClientRuntime.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.ServiceControl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaSchemaTools.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaSecretEncryption.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Google.Protobuf.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.ServiceRuntime.Configuration.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Security.Permissions.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\GpContracts.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Microsoft.WindowsAzure.Configuration.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\amd64\libccauth.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.SqlServer.Management.SqlParser.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Assessment.Types.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Wcf.Client.Core.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.SqlWmiManagement.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\NLog.ManualFlush.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ja\GpDocument.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.IdentityManagement.Client.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.DelegatedAdminInterfaces.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Deployment.Compression.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.DependencyInjection.Abstractions.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Diagnostics.Tracing.EventSource.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaFeature.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Text.Encodings.Web.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.ApplicationInsights.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.HCL.DistributedTracing.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.SqlClrProvider.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.Collector.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\IBrokerDAL.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Diagnostics.EventLog.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.ValueTuple.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\DnsIpSupport.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Dmf.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\pt-BR\Microsoft.VisualStudio.Threading.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\de\BrokerServiceSupport.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\GpDocument.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.VisualStudio.Threading.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\IDnsIpSupport.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\HypervisorsCommon.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ru\System.Spatial.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Microsoft.Extensions.ObjectPool.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\IBrokerDALInternal.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.ServiceBrokerEnum.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Wcf.Client.Interfaces.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.SNI.arm64.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.ConnectionInfo.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Win32.Registry.AccessControl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.AspNetCore.Http.Features.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.SNI.x64.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Microsoft.Extensions.ObjectPool.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\de\CloudCommon.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\SchemaFeatures.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\System.Configuration.ConfigurationManager.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Settings.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.ServiceRegistration.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\SchemaFeature.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaWcf.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\de\SCVMM.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\64\ccauthcpp_dynamic.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\RebootSchedules.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ja\System.Spatial.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\pl\Microsoft.VisualStudio.Threading.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Uri.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.Models.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.Edm.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\ja\CloudCommon.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Unity.Abstractions.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSICEEF.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Options.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaSiteServicesSupport.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\Citrix.HCL.DistributedTracing.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ja\GpfxSettings.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Temp\MSID34D.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\CtxSta.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ru\Microsoft.VisualStudio.Threading.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Newtonsoft.Json.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.ServiceModel.Security.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaTransactionScope.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\de\Citrix.CloudServices.Core.Api.Client.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.Edm.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\System.Memory.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Numerics.Vectors.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.VisualStudio.Threading.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\DiscUtils.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.RegSvrEnum.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.XEventDbScopedEnum.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaFiltering.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\fr\GpfxSettings.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ja\Citrix.IconConverter.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\NewRelic.Api.Agent.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Microsoft.Extensions.Logging.Abstractions.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\DelegatedAdminSupport.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\pl\Microsoft.VisualStudio.Validation.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Serilog.Sinks.File.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Serilog.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\SDKUtils.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIC641.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\de\Citrix.IconConverter.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.WindowsAzure.Storage.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.IdentityModel.Tokens.Jwt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HCL.Shared.Adapters.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.ManagedMachinePluginFinder.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Configuration.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.Tools.Sql.BatchParser.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.VisualStudio.Validation.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSite.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.RegisteredServers.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.CodeDom.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIDD31.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.EBS.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.IdentityManagement.Logging.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaIdentity.Interfaces.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.IdentityModel.Protocols.OpenIdConnect.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ConfigLoggingSupport.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Monitoring.ApplicationInsights.Shared.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\es\BrokerServiceSupport.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.NgsTunnel.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.XEventDbScoped.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ComponentInterface.Constants.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\CookComputing.XmlRpcV2.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Common.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\tr\Microsoft.VisualStudio.Threading.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\CtxAdmin.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.DistributedTracing.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ja\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\grpc_csharp_ext.x86.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Security.AccessControl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID31E.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.IdentityModel.JsonWebTokens.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.XEventEnum.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\es\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.IdentityModel.Abstractions.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Google.Api.CommonProtos.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.AspNetCore.SystemWebAdapters.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\de\FmaConfigLoggingClient.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Grpc.Core.Api.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.Edm.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\fr\GpAnalyzer.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Threading.Channels.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.KeySharing.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Data.SqlClient.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\de\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.MachineCreationAPI.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\System.Numerics.Vectors.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ActiveDirectory.SiteManagement.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Threading.Tasks.Extensions.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\OpenIddict.Abstractions.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ja\Citrix.CloudServices.Core.Api.Client.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\i386\libccauth.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\es\Citrix.IconConverter.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\OpenTelemetry.Api.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\grpc_csharp_ext.x64.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Logging.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.Services.Client.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.ServiceModel.NetTcp.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Wcf.Types.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID28F.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Threading.AccessControl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Redis.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Configuration.ConfigurationManager.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.Xaxd.Utils.Strings.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Win32.Registry.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Features.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.ObjectPool.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\de\ConfigLoggingSupport.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Diagnostics.DiagnosticSource.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.XEvent.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.ServiceModel.Duplex.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\DiscUtils.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Net.Http.Json.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\StackExchange.Redis.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaSecretEncryptionManager.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.ManagedMachineAPI.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ISdkLogic.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Newtonsoft.Json.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Polly.Core.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.SqlServer.Management.SqlParser.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\DiscUtils.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.OData.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.Host.Client.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.HadrData.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\es\CloudCommon.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\HostSideAdapters\Citrix.ManagedMachineAPI.HostSideAdapter.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Licensing.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaSqlScriptBuilder.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.SqlServer.Management.SqlParser.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Avro.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Identity.Client.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID1E1.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaSqlUtils.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSPlugin.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ru\Microsoft.SqlServer.Management.SqlParser.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\StandardSocketsHttpHandler.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.HCL.DistributedTracing.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Grpc.Net.Client.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HCL.TlsCertificateVerification.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ControllerInterfaces.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.PolicyEnum.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\IControllerDALInternal.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.DependencyInjection.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Strings.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ru\Microsoft.Data.Services.Client.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\System.Diagnostics.DiagnosticSource.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Logging.Configuration.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSiteProvider.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.IdentityModel.Tokens.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.MachineCreationAPI.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.KeyVault.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\System.Text.Json.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.SqlClient.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.ManagedMachineAPI.Contracts.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.Authentication.Models.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.KeyVault.WebKey.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.VisualStudio.Validation.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ISecondaryBrokerControl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.DistributedTracing.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ja\Citrix.Base.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.ServiceModel.Primitives.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.IO.FileSystem.AccessControl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.Sdk.Sfc.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\32\ccauthcpp_dynamic.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.ComponentModel.Annotations.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaSiteServices.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\zh-CN\CloudCommon.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.EC2.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.ConfigLogging.Wcf.Client.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\fr\BrokerServiceSupport.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSICB14.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Diagnostics.PerformanceCounter.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.HadrModel.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSICF8D.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID2EE.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.OData.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Newtonsoft.Json.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Windows.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaFilteringSdkSupport.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipelines.Sockets.Unofficial.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\GpfxSettings.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.Common.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\CloudCommon.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.HostView.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Memory.Data.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Buffers.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Interop.NetFwTypeLib.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Web.Http.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.CollectorEnum.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Wcf.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\OpenTelemetry.Exporter.OpenTelemetryProtocol.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\fr\Citrix.Base.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.XenDesktop.Cloud.DataStore.Client.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.ManagedMachineAPI.AddInSideAdapter.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID211.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.ServiceBus.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\cs\Microsoft.VisualStudio.Validation.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.DelegatedAdmin.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.Utilities.AssemblyResolver.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.ConfigurationLogging.Rest.Client.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Monitor.BrokerCodes.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ru\Microsoft.VisualStudio.Validation.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Deployment.Compression.Cab.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\AlwaysOnTracing.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaProductInfo.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\DiscUtils.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.SNI.x86.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\System.Buffers.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Temp\MSI99A3.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\pt-BR\Microsoft.VisualStudio.Validation.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\OperationalEvents.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.KeyVault.Core.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\es\Citrix.Base.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaRegistry.Interface.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaLogging.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaLogging.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.IdentityModel.Clients.ActiveDirectory.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSICFCC.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\PluginUtilities.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.Services.AppAuthentication.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Memory.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.SqlClient.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.Services.Client.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ru\Microsoft.Data.SqlClient.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\CustomProvisioningCommon.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.HCL.TlsCertificateVerification.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\fr\CloudCommon.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\de\System.Spatial.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.VisualStudio.Threading.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Logging.Abstractions.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.Storage.Blob.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ProxyFmaSupport.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaPlugin.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.VisualStudio.Validation.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.VisualStudio.Threading.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.WindowsAzure.Configuration.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\DiscUtils.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSiteManager.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Bcl.AsyncInterfaces.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.OData.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Assessment.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Rest.ClientRuntime.Azure.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Smo.Notebook.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.ServiceRuntime.ApiClient.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.IdentityModel.Protocols.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.CasInterfaces.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Configuration.Binder.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.Data.OData.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.Trust.Library.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.IO.Pipelines.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaUtils.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.Interface.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.SqlParser.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Spatial.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\TicketStore.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.Core.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ControllerDAL.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.Data.SqlClient.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\Citrix.HCL.DistributedTracing.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.ServiceModel.Http.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\es\Citrix.CloudServices.Core.Api.Client.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\NetLicWrapper.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Grpc.Net.Common.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\System.Diagnostics.DiagnosticSource.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\RestSharp.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaServiceControlInterface.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\CtxMcp.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\pt-BR\Microsoft.Data.SqlClient.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.IdentityManagement.Utilities.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Security.CCAuth.Managed.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\GpXmlSchema.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\de\GpDocument.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSICB82.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\RestSharp.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\OpenTelemetry.Api.ProviderBuilderExtensions.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.HCL.DistributedTracing.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ja\FmaCommonEnvTests.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.ServiceDiscovery.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\HostSideAdapters\Citrix.HCL.Shared.Adapters.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\OpenTelemetry.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\System.ValueTuple.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.ManagedMachineAPI.HostView.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.Data.Edm.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\PluginUtilities.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HCL.Shared.Contracts.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaIdentity.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\StandardSocketsHttpHandler.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\StackExchange.Redis.StrongName.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaRegistry.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.ServiceProcess.ServiceController.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\pt-BR\Microsoft.SqlServer.Management.SqlParser.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Security.Principal.Windows.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Dmf.Common.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.StrongName.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\es\ConfigLoggingSupport.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\RemoteHCLClient.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.OperationalEvents.Common.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\StandardSocketsHttpHandler.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\DiscUtils.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\fr\SCVMM.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.Services.Client.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\RegistryCounters.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\protobuf-net.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.Configuration.Rest.Client.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\SdkDalAttributes.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\System.Collections.Immutable.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.Services.Client.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\fr\FmaConfigLoggingClient.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.IconConverter.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Trust.Api.Client.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\Newtonsoft.Json.CH.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Temp\MSI9983.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaUtils.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\IBrokerAdminQuery.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.Services.ServiceHosting.WindowsServiceHostingApi.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\de\FmaCommonEnvTests.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\SdkInterfaces.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.VisualStudio.Threading.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSite.Interface.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\System.Text.Encodings.Web.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\System.Threading.Tasks.Extensions.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.VisualStudio.Threading.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\System.Runtime.CompilerServices.Unsafe.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.Utilities.Sids.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\Citrix\Broker\Service\DocumentFormat.OpenXml.dll Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID211.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSICFCC.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIC641.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSICB14.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSICF8D.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID2EE.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID0F6.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIC5C3.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIC535.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSICEEF.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID28F.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID1E1.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID31E.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIDD31.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSICB82.tmp Jump to dropped file
Creates or modifies windows services
Source: C:\Windows\SysWOW64\msiexec.exe Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Citrix XML Service\Performance Jump to behavior
Modifies existing windows services
Source: C:\Windows\System32\svchost.exe Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\Config Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\SysWOW64\sc.exe" sidtype CitrixBrokerService unrestricted
Stores large binary data to the registry
Source: C:\Windows\SysWOW64\msiexec.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7613BA1FFF7E3EEF6E1BD42237A9A3D68FC2EE7E Blob Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Query firmware table information (likely to detect VMs)
Source: C:\Windows\System32\svchost.exe System information queried: FirmwareTableInformation Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Memory allocated: 194911A0000 memory reserve | memory write watch
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Memory allocated: 194AAA60000 memory reserve | memory write watch
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Memory allocated: 25004750000 memory reserve | memory write watch
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Memory allocated: 25444A20000 memory reserve | memory write watch
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Memory allocated: 2B30D930000 memory reserve | memory write watch
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Memory allocated: 2B327270000 memory reserve | memory write watch
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Memory allocated: 1A1F8310000 memory reserve | memory write watch
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Memory allocated: 1A1F9C50000 memory reserve | memory write watch
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Memory allocated: 21FD5900000 memory reserve | memory write watch
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Memory allocated: 21FEF320000 memory reserve | memory write watch
Contains capabilities to detect virtual machines
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Microsoft.Extensions.ObjectPool.dll
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\RestSharp.dll
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\HypervisorsCommon.dll
Source: C:\Windows\System32\msiexec.exe File opened / queried: C:\Windows\WinSxS\FileMaps\program_files_common_files_citrix_hclplugins_hypervisor_v2.73.0.0_vmware_fr_9475cb40c2be071a.cdf-ms Jump to behavior
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.HCL.DistributedTracing.dll
Source: C:\Windows\System32\msiexec.exe File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\de\ Jump to behavior
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.Xaxd.NgsTunnel.dll
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\DiscUtils.dll
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\VimService.dll
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaLogging.dll
Source: C:\Windows\System32\svchost.exe File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} Jump to behavior
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\VirtualCenter.Interfaces.dll
Source: C:\Windows\System32\msiexec.exe File opened / queried: C:\Windows\WinSxS\FileMaps\program_files_common_files_citrix_hclplugins_hypervisor_v2.73.0.0_vmware_es_9475cb66c2be06c0.cdf-ms Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\ja\ Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened / queried: C:\Windows\WinSxS\FileMaps\program_files_common_files_citrix_hclplugins_hypervisor_v2.73.0.0_vmware_faedd1614d3ab39e.cdf-ms Jump to behavior
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.HCL.TlsCertificateVerification.dll
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\VirtualCenter.Operations.dll
Source: C:\Windows\System32\msiexec.exe File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\fr\ Jump to behavior
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\VirtualCenter.dll
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Newtonsoft.Json.dll
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaUtils.dll
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.Xaxd.Authentication.Models.dll
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\StandardSocketsHttpHandler.dll
Source: C:\Windows\System32\msiexec.exe File opened / queried: C:\Windows\WinSxS\FileMaps\program_files_common_files_citrix_hclplugins_hypervisor_v2.73.0.0_vmware_zh-cn_f2c0c926ac359074.cdf-ms Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\zh-CN\ Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened / queried: C:\Windows\WinSxS\FileMaps\program_files_common_files_citrix_hclplugins_hypervisor_v2.73.0.0_vmware_de_9475cb6ec2be06ed.cdf-ms Jump to behavior
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\VimService.XmlSerializers.dll
Source: C:\Windows\System32\msiexec.exe File opened / queried: C:\Windows\WinSxS\FileMaps\program_files_common_files_citrix_hclplugins_hypervisor_v2.73.0.0_vmware_ja_9475ca8ec2be08f7.cdf-ms Jump to behavior
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaEnv.dll
Source: C:\Windows\System32\msiexec.exe File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\es\ Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Thread delayed: delay time: 7200000
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Thread delayed: delay time: 7199888
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Thread delayed: delay time: 7200000
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Window / User API: threadDelayed 379
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Window / User API: threadDelayed 4214
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Window / User API: threadDelayed 5625
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Window / User API: threadDelayed 424
Found dropped PE file which has not been started or loaded
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\HypervisorsCommon.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\HypervisorsCommon.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.OData.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FMAUtils.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\Citrix.Base.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cloud.VirtualSiteRegistry.Rest.Client.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Http.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\BrokerAdminQuery.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Unity.Container.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Grpc.Core.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HypervisorCommunicationsLibrary.Contracts.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Dynamic.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.AspNetCore.Http.Abstractions.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.ServiceCommon.KeySharingInterfaces.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\BrokerFiltering.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\es\SCVMM.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\FmaConfigLoggingClient.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\tr\Microsoft.VisualStudio.Validation.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\IControllerDAL.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.SqlClient.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\GpAnalyzer.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\Microsoft.SqlServer.Management.SqlParser.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.Tc.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\System.Spatial.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Drawing.Common.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\NLog.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Primitives.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\GpAnalyzer.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSID0F6.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\ja\SCVMM.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Net.Http.WinHttpHandler.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.AspNet.CitrixCloud.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Settings.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.ManagedMachineAPI.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.Edm.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ko\System.Spatial.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\GpDocument.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaSchemaProbeDal.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\LhcUtils.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.SqlScriptPublish.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\GpfxSettings.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\LicPolEng.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaServiceStatus.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.SqlServer.Management.SqlParser.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\BouncyCastle.Cryptography.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Management.Automation.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\CredentialSecurity64.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\BrokerDAL.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Microsoft.Bcl.AsyncInterfaces.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\FmaConfigLoggingClient.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Polly.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIC5C3.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\System.Memory.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ru\Microsoft.Data.OData.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.Edm.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Logging.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\it\Microsoft.VisualStudio.Validation.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.Interfaces.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\RemoteHCLCLient.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaServiceStatus.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ProxyCommon.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Text.Json.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\protobuf-net.Core.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.SqlClient.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Compression.Interfaces.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ADIdentityInterService.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaConfigLoggingClient.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\SdkAttributes.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Ism.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.Aws.Batcher.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.Utilities.AssemblyResolver.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.Assessment.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\Citrix.IconConverter.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.IdentityModel.Logging.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\FmaCommonEnvTests.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIC535.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\iobfuncdll.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.WebSocket.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.Data.Services.Client.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.DistributedTracing.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Security.Cryptography.Xml.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.OperationalEvents.Broker.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.WmiEnum.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.OData.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Utilities.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ru\Microsoft.Data.Edm.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\zh-CN\SCVMM.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.DelegatedAdmin.Rest.Client.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaEnvTestInterfaces.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Text.Encoding.CodePages.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.CasEventHubClient.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\Microsoft.VisualStudio.Validation.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\BrokerSDKLogic.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\Microsoft.VisualStudio.Validation.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HypervisorCommunicationsLibrary.Models.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Posh.Core.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaLogging.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\ConfigLoggingSupport.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Identity.Client.Extensions.Msal.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.Storage.Common.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.Wcf.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ICwcSupport.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Grpc.Client.Core.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI9878.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\Citrix.CloudServices.Core.Api.Client.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.SqlEnum.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Networking.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\BrokerServiceSupport.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\SCVMM.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.Xaxd.Authentication.Models.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Smo.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Services.ServiceLocator.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.VisualStudio.Validation.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\GpAnalyzer.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\BrokerSDKDefinition.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Runtime.CompilerServices.Unsafe.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ComponentInterface.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Interop.GPMGMTLib.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utilities.AssemblyResolver.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaEnv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Models.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaEnv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HCL.DistributedTracing.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ILeasingControl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.Services.Client.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Net.Http.Formatting.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\cs\Microsoft.VisualStudio.Threading.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Azure.Core.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Bcl.HashCode.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\ConfigLoggingSupport.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Configuration.Abstractions.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HypervisorCommunicationsLibrary.AddInSideAdapter.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Options.ConfigurationExtensions.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Security.Cryptography.ProtectedData.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.CasConfigClient.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\BrokerComponent.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.XenDesktop.Cloud.DataStore.Models.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.SmoExtended.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\Microsoft.Data.Services.Client.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\System.Buffers.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\HostSideAdapters\Citrix.HypervisorCommunicationsLibrary.HostSideAdapter.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\IEdgeProxySupport.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\Castle.Core.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cdf.Net.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.ServiceCore.Common.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\it\System.Spatial.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\FmaCommonEnvTests.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.ServiceControl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Rest.ClientRuntime.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaSchemaTools.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaSecretEncryption.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Google.Protobuf.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.ServiceRuntime.Configuration.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.Wcf.Types.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Security.Permissions.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaDalRuntime.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\GpContracts.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaDependencyInjection.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Microsoft.WindowsAzure.Configuration.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\amd64\libccauth.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\Microsoft.Data.SqlClient.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.ADIdentity.DataModel.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\HostingManagementComponent.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.SqlServer.Management.SqlParser.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Assessment.Types.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.CasDispatcher.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Wcf.Client.Core.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.SqlWmiManagement.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\NLog.ManualFlush.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\GpDocument.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.IdentityManagement.Client.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.RateLimiting.Wcf.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Serialization.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.DelegatedAdminInterfaces.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Logging.Client.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Deployment.Compression.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.DependencyInjection.Abstractions.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaConfigLoggingShared.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Diagnostics.Tracing.EventSource.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaFeature.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.ApplicationInsights.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.HCL.DistributedTracing.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Text.Encodings.Web.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.SqlClrProvider.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Broker.CasCommandQueuePayload.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.Collector.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Diagnostics.Tracing.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\IBrokerDAL.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Diagnostics.EventLog.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.ValueTuple.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaActiveDirectory.Interfaces.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.Utilities.EnumCache.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cloud.ServiceRegistry.Grpc.Client.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\DnsIpSupport.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\pt-BR\Microsoft.VisualStudio.Threading.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\BrokerServiceSupport.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Dmf.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\GpDocument.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.VisualStudio.Threading.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaConfigLoggingClientInterService.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Exporter.Cas.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\IDnsIpSupport.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\HypervisorsCommon.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Rest.Client.Core.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ru\System.Spatial.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Microsoft.Extensions.ObjectPool.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\IBrokerDALInternal.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.SNI.arm64.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.ServiceBrokerEnum.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Wcf.Client.Interfaces.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.ConnectionInfo.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Win32.Registry.AccessControl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.Wcf.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaActiveDirectory.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.AspNetCore.Http.Features.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.RateLimiting.Core.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.SNI.x64.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Microsoft.Extensions.ObjectPool.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\de\CloudCommon.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\SchemaFeatures.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\System.Configuration.ConfigurationManager.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.ServiceRegistration.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Settings.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\SchemaFeature.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\de\SCVMM.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaWcf.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\64\ccauthcpp_dynamic.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\RebootSchedules.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\System.Spatial.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Uri.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\pl\Microsoft.VisualStudio.Threading.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.Models.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.Edm.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\HypervisorsCommon.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\ja\CloudCommon.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Unity.Abstractions.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSICEEF.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Options.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.AgentFoundation.Common.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\HypervisorsCommon.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaSiteServicesSupport.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\Citrix.HCL.DistributedTracing.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\GpfxSettings.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSID34D.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ru\Microsoft.VisualStudio.Threading.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\CtxSta.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Newtonsoft.Json.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.ServiceModel.Security.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaTransactionScope.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\Citrix.CloudServices.Core.Api.Client.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\System.Memory.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.Edm.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Numerics.Vectors.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.S3.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cloud.ServiceRegistry.Rest.Client.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\DiscUtils.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\Microsoft.VisualStudio.Threading.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.RegSvrEnum.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.XEventDbScopedEnum.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\GpfxSettings.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaFiltering.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\Citrix.IconConverter.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Grpc.Common.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Microsoft.Extensions.Logging.Abstractions.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\NewRelic.Api.Agent.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaEventLog.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\DelegatedAdminSupport.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\pl\Microsoft.VisualStudio.Validation.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Serilog.Sinks.File.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Serilog.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\Microsoft.SqlServer.Management.SqlParser.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\SDKUtils.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\Citrix.IconConverter.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIC641.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.WindowsAzure.Storage.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.IdentityModel.Tokens.Jwt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HCL.Shared.Adapters.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.Wcf.Client.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\System.Spatial.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.ManagedMachinePluginFinder.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaDalAttributes.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Configuration.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.Tools.Sql.BatchParser.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utilities.EnumCache.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaCommonEnvTests.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.VisualStudio.Validation.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSite.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIDD31.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.CodeDom.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.EBS.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.RegisteredServers.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.IdentityManagement.Logging.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.IdentityModel.Protocols.OpenIdConnect.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaIdentity.Interfaces.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ConfigLoggingSupport.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Monitoring.ApplicationInsights.Shared.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\BrokerServiceSupport.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.NgsTunnel.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.XEventDbScoped.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ComponentInterface.Constants.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\CookComputing.XmlRpcV2.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaAbstractions.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Common.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\tr\Microsoft.VisualStudio.Threading.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.DistributedTracing.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\CtxAdmin.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\grpc_csharp_ext.x86.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Security.AccessControl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Castle.Core.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.SecurityToken.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSID31E.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.XEventEnum.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.IdentityModel.JsonWebTokens.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Google.Api.CommonProtos.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.IdentityModel.Abstractions.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\Microsoft.VisualStudio.Threading.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.AspNetCore.SystemWebAdapters.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Grpc.Core.Api.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\FmaConfigLoggingClient.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.Edm.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\CbpConstants.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\GpAnalyzer.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Threading.Channels.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.KeySharing.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Data.SqlClient.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.MachineCreationAPI.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\System.Numerics.Vectors.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ActiveDirectory.SiteManagement.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Threading.Tasks.Extensions.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\OpenIddict.Abstractions.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\Citrix.CloudServices.Core.Api.Client.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\i386\libccauth.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\Citrix.IconConverter.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaDalExceptions.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\grpc_csharp_ext.x64.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\OpenTelemetry.Api.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Logging.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Wcf.Types.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.ServiceModel.NetTcp.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.Services.Client.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSID28F.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\Microsoft.Data.OData.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Threading.AccessControl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Redis.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Configuration.ConfigurationManager.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.AgentFoundation.OnPremiseCommon.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.Xaxd.Utils.Strings.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Win32.Registry.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.ObjectPool.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Features.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Tenancy.Core.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\ConfigLoggingSupport.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Diagnostics.DiagnosticSource.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\BrokerServiceSupport.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.XEvent.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Exceptions.Common.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.ServiceModel.Duplex.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\DiscUtils.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Net.Http.Json.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Hostname.Interfaces.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\StackExchange.Redis.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaSecretEncryptionManager.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.ManagedMachineAPI.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.Core.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ISdkLogic.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Newtonsoft.Json.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Polly.Core.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\it\Microsoft.SqlServer.Management.SqlParser.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\DiscUtils.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.OData.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Host.Client.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Signer.Client.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Compression.Core.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.HadrData.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\es\CloudCommon.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\HostSideAdapters\Citrix.ManagedMachineAPI.HostSideAdapter.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Licensing.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaSqlScriptBuilder.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.SqlServer.Management.SqlParser.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Avro.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Identity.Client.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\CbpControllerSdk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSID1E1.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaSqlUtils.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSPlugin.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ru\Microsoft.SqlServer.Management.SqlParser.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.IdentityManagement.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\StandardSocketsHttpHandler.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.HCL.DistributedTracing.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\CdeEvents.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Grpc.Net.Client.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\HighAvailabilityServiceEventLogResources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HCL.TlsCertificateVerification.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ControllerInterfaces.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.PolicyEnum.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\IControllerDALInternal.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.DependencyInjection.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\BrokerCdeLibrary.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Strings.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ru\Microsoft.Data.Services.Client.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\System.Diagnostics.DiagnosticSource.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Logging.Configuration.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\HypervisorsCommon.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\EventLogCodeGenHelper.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSiteProvider.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.IdentityModel.Tokens.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.MachineCreationAPI.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.KeyVault.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Azure.Identity.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Reflection.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\System.Text.Json.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.SqlClient.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.ManagedMachineAPI.Contracts.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.Models.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Retry.Client.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.Authentication.Models.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.VisualStudio.Validation.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.KeyVault.WebKey.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ISecondaryBrokerControl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.DistributedTracing.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\Citrix.Base.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\BrokerEnvTests.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.ServiceModel.Primitives.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.IO.FileSystem.AccessControl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Exceptions.Interfaces.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\32\ccauthcpp_dynamic.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaCommandLine.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\BrokerComponentCommon.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.ComponentModel.Annotations.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaSiteServices.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.EC2.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\zh-CN\CloudCommon.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.ConfigLogging.Wcf.Client.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\BrokerServiceSupport.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.HadrModel.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Diagnostics.PerformanceCounter.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSICF8D.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSICB14.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSID2EE.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Hostname.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.OData.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Newtonsoft.Json.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Windows.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\Microsoft.Data.Edm.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaFilteringSdkSupport.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\BrokerServiceEventLogResources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipelines.Sockets.Unofficial.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\GpfxSettings.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.Common.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\CloudCommon.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.HostView.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Memory.Data.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Buffers.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Web.Http.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Interop.NetFwTypeLib.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.CollectorEnum.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Wcf.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\OpenTelemetry.Exporter.OpenTelemetryProtocol.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Retry.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\Citrix.Base.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.XenDesktop.Cloud.DataStore.Client.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.ManagedMachineAPI.AddInSideAdapter.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSID211.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.ServiceBus.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\cs\Microsoft.VisualStudio.Validation.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.DelegatedAdmin.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Core.Api.Client.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.Utilities.AssemblyResolver.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Rest.Client.Interfaces.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.ConfigurationLogging.Rest.Client.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Monitor.BrokerCodes.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ru\Microsoft.VisualStudio.Validation.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Deployment.Compression.Cab.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\AlwaysOnTracing.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\GpAnalyzer.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaProductInfo.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\DiscUtils.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.SNI.x86.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\System.Buffers.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\pt-BR\Microsoft.VisualStudio.Validation.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI99A3.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\OperationalEvents.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.KeyVault.Core.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\Citrix.Base.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaRegistry.Interface.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Common.Headers.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaLogging.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaLogging.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.IdentityModel.Clients.ActiveDirectory.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe TID: 5832 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe TID: 5832 Thread sleep time: -7200000s >= -30000s
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe TID: 6196 Thread sleep count: 379 > 30
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe TID: 6196 Thread sleep count: 97 > 30
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe TID: 5832 Thread sleep time: -7199888s >= -30000s
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe TID: 2380 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe TID: 2436 Thread sleep count: 34 > 30
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe TID: 2436 Thread sleep time: -31359464925306218s >= -30000s
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe TID: 2436 Thread sleep time: -7200000s >= -30000s
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe TID: 7132 Thread sleep count: 4214 > 30
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe TID: 2044 Thread sleep count: 5625 > 30
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe TID: 2468 Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe TID: 2468 Thread sleep time: -100000s >= -30000s
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe TID: 6240 Thread sleep count: 424 > 30
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe TID: 6240 Thread sleep count: 199 > 30
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe TID: 6924 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe TID: 6936 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe TID: 4704 Thread sleep time: -922337203685477s >= -30000s
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe File Volume queried: C:\Windows\System32 FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Thread delayed: delay time: 7200000
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Thread delayed: delay time: 7199888
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Thread delayed: delay time: 7200000
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Thread delayed: delay time: 922337203685477
Source: DiscUtils.dll4.4.dr Binary or memory string: EFI%VMware File System
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp, Citrix.HypervisorCommunicationsLibrary.dll.4.dr, Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr Binary or memory string: VirtualMachineState
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp Binary or memory string: ActionEurn:ps/IHypervisorCallbacks/ValidateVirtualMachineConfigurationUpdateT
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp Binary or memory string: Actionmurn:ps/IHypervisorCommunicationsLibraryInterface/GetVmNetworkInterfaceDetailsRemoteHclCommunicationFaultFaultT
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: `C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\BlankVhdTemplate.vhd
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CallerMemberNameAttributeTargetFrameworkAttributeAssemblyDelaySignAttributeAssemblyFileVersionAttributeAssemblyInformationalVersionAttributeAssemblyConfigurationAttributeAssemblyDescriptionAttributeInternalsVisibleToAttributeServiceBehaviorAttributeRefSafetyRulesAttributeCompilationRelaxationsAttributeAssemblyProductAttributeAssemblyCopyrightAttributeCLSCompliantAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributeByteget_Valueset_ValuemetadataValueGetValuenewValueset_KeepAliveAddCustomFieldDefPrivilegePolicyDefserviceRefovfRefresourcePoolRefvmRefmachineFolderReffolderRefsessionManagerRefcustomFieldsManagerRefhostRefLogOffSystem.ThreadingMicrosoft.Extensions.LoggingSystem.Runtime.VersioningToBase64StringEscapeDataStringSecureStringToStringPluginLogTraceMsgStopwatchFlushget_VhdTemplatePathimageDiskPathvmwareFolderPathdatacenterPathpathget_LengthGetFileLengthfileLengthset_ContentLengthVimApiget_AbsoluteUriproxyUriset_ServerCertificateCustomValidationCallbackget_SectorsPerTracklogonLockDiscUtils.VmdkSeekToSplunkSuspendVM_TaskCloneVM_TaskRelocateVM_TaskCreateVM_TaskPowerOffVM_TaskReconfigVM_TaskPowerOnVM_TaskResetVM_TaskDeleteDatastoreFile_TaskMoveDatastoreFile_TaskRename_TaskSearchDatastore_TaskCheckRelocate_TaskCreateVirtualDisk_TaskDeleteVirtualDisk_TaskCopyVirtualDisk_TaskRemoveAllSnapshots_TaskCreateSnapshot_TaskRevertToSnapshot_TaskDestroy_TaskReadDiskUploadDiskisStreamingDiskIVirtualDiskFromVirtualDiskPopulateNewDiskop_GreaterThanOrEqualSystem.ServiceModelSystem.ComponentModelCitrix.Xaxd.NgsTunnelLogLevelCallVirtualCenter.Operations.dllHttpWebClientProtocolget_Urlset_UrlvimServiceUrlserviceUrlbaseUrlGetDatastoreFileAccessUrlGetDatastoreFolderAccessUrlGetResponseStreamSparseStreamdiskStreamFromStreamOpenStreamGetRequestStreamSparseMemoryStreamget_ItemDiscFileSystemInMemoryFileSystemloggedOnLogOnsuppressPowerOnBooleanTimeSpanX509ChainchainCreateDomainTestHypCertificateInNewAppDomainget_CurrentDomainSeekOriginLoginget_RevisionGetVmwareVersionvmwareVersioncurrentStateVersionget_apiVersionversionUserSessionsessionDiskImageFileSpecificationCitrix.HCL.TlsCertificateVerificationSystem.Security.AuthenticationNGSLocationCheckStorageLocationget_SetupInformationSystem.Globalizationset_LoaderOptimizationactionSystem.ReflectionfunctionIFileDiskDefinitiondiskDefinitionset_Positionget_IsFatFilePartitionSearchOptionsearchOptionIOExceptionWebExceptionNotImplementedExceptionFileNotFoundExceptionManagedMachineGeneralExceptionArgumentNullExceptionVCenterSslCertificateAuthenticationExceptionInvalidOperationExceptionNotAuthorizedForOperationExceptionget_InnerExceptionVCenterMisconfiguredEndpointsExceptionArgumentExceptionsnapshotDescriptionHypervisorsCommonsearchPatternCultureInfoStoreCertificateInfoFileSystemInfoAboutInfoDirectoryInfoCreateInstanceAndUnwrapcdpOwnershipStopSystem.Net.HttpAppDomainSetupSystem.LinqILogProviderIFormatProviderDiskImageBuilderStringBuilderDiskBuilderdatastoreAccessUrlBuilderdestinationFoldertargetFoldersenderget_HeadsPerCylinder
Source: RegisterPlugins.exe, 00000024.00000002.2064004697.000001A1F83B8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaLogging.dll`
Source: BrokerService.exe, 0000001D.00000002.1910073183.0000019492A61000.00000004.00000800.00020000.00000000.sdmp, BrokerService.exe, 0000001F.00000002.2546935378.0000025204A21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Heartbeat Service
Source: BrokerService.exe, 0000001F.00000002.2556016980.00000254519F2000.00000002.00000001.01000000.00000049.sdmp Binary or memory string: W.VMToolsStateT
Source: BrokerService.exe, 0000001D.00000002.1909653018.0000019491202000.00000002.00000001.01000000.0000000C.sdmp Binary or memory string: <MissingVirtualMachineReportingEnabled>k__BackingField
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ZC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\VimService.dllCitr@{3
Source: Broker_Service_x64.msi Binary or memory string: DiscUtilsVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268Hp
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: eC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.Xaxd.NgsTunnel.dll
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp Binary or memory string: ActionMurn:ps/IHypervisorCommunicationsLibraryInterface/GetVmNetworkInterfaceDetailsT
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: GetVmwareVersion
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: #VMware\VirtualCenter.Operations.dll
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp Binary or memory string: ConvertArrayUsingCreateVmNetworkInterfaceDetailsConverter
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware\VimService.dll
Source: Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr Binary or memory string: <14>__CreateVmNetworkInterfaceDetails
Source: BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp Binary or memory string: ERROR: CheckResetVirtualMachineOperations returned unknown operationId: {0}[QueryMcsForCompletedResetActions: Failed: {0}yStartPendingPowerActions: Invalid credentials, no work to dokStartPendingPowerActions: MaxActions=0, no work to doQStartPendingPowerActions: MaxActions={0}wStartPendingPowerActions: No pending actions, no work to do/StartPendingPowerAction
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp, BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp Binary or memory string: VirtualMachineStateResult
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp Binary or memory string: Action[urn:ps/IHypervisorCallbacks/ValidateVirtualMachineConfigurationUpdateRemotePluginFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: ActionEhttp://tempuri.org/IMachineCreationApi/PollVirtualMachineCapabilitiesT
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: uC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.HCL.TlsCertificateVerification.dll
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: hC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\VirtualCenter.Interfaces.dll
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp, Citrix.HypervisorCommunicationsLibrary.dll.4.dr, Citrix.HypervisorCommunicationsLibrary.HostView.dll.4.dr Binary or memory string: get_VirtualMachineId
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: #VMware\VirtualCenter.Interfaces.dll
Source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp Binary or memory string: VmwareCloudOnAwsEnabled
Source: BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp Binary or memory string: McsResetVMqMcsResetVM: proxy.StartResetVirtualMachine performed {0}
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: UCitrix.InterServiceApiSpecifications.MachineCreationService.VirtualMachineStateResultX
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: ReplyActionGhttp://tempuri.org/IMachineCreationApi/StartResetVirtualMachineResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: <GetProvisionedVirtualMachineBySid>b__0
Source: Broker_Service_x64.msi Binary or memory string: BlankDiskVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: Citrix.HypervisorCommunicationsLibrary.HostView.dll.4.dr Binary or memory string: <VirtualMachineId>k__BackingField
Source: BrokerService.exe, 0000001F.00000002.2556016980.00000254519F2000.00000002.00000001.01000000.00000049.sdmp Binary or memory string: VirtualMachineNotFound
Source: BrokerService.exe, 0000001F.00000002.2556016980.00000254519F2000.00000002.00000001.01000000.00000049.sdmp Binary or memory string: <VMToolsState>k__BackingField
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: <CheckResetVirtualMachineOperations>b__0
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: ReplyActionNhttp://tempuri.org/IMachineCreationApi/CheckVirtualMachinePowerActionsResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: TerminateTask)UpdateProvVmHostVmId=PollVirtualMachineCapabilitiesMGetMaximumMachineCapabilitiesQuerySize
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: ReplyActionNhttp://tempuri.org/IMachineCreationApi/BeginVirtualMachineStateChangesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: ZCitrix.InterServiceApiSpecifications.MachineCreationService.VirtualMachinePowerStateResult
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: VirtualMachineStateResultT
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp Binary or memory string: ActionNurn:ps/IHypervisorCallbacks/GetVmNetworkInterfaceDetailsRemotePluginFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: WindowsActivationTypeProvisionedVirtualMachineField
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: ActionIhttp://tempuri.org/IMachineCreationApi/CheckResetVirtualMachineOperationsT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: UCitrix.InterServiceApiSpecifications.MachineCreationService.VirtualMachineStateResult
Source: BrokerService.exe, 0000001F.00000002.2553794425.0000025450D72000.00000002.00000001.01000000.0000003E.sdmp Binary or memory string: VirtualMachineType
Source: RegisterPlugins.exe, 00000024.00000002.2064004697.000001A1F83B8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\*
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp, Citrix.HypervisorCommunicationsLibrary.dll.4.dr Binary or memory string: UnknownVirtualMachine
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp, BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp Binary or memory string: StartVirtualMachinePowerActions
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: ProvisionedVirtualMachineT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: ActionEhttp://tempuri.org/IMachineCreationApi/StartVirtualMachinePowerActionT
Source: svchost.exe, 00000006.00000002.2538604510.0000016D5DC2B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: (@\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: RegisterPlugins.exe, 00000024.00000002.2064004697.000001A1F83B8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.Xaxd.NgsTunnel.dll
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp Binary or memory string: Actionzurn:ps/IHypervisorCommunicationsLibraryInterface/ValidateVirtualMachineConfigurationUpdateRemoteHclCommunicationFaultFaultT
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: oC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Microsoft.Extensions.ObjectPool.dll
Source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp Binary or memory string: VmwarePluginBrowseVmFolder
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: get_WindowsActivationTypeProvisionedVirtualMachine
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: InterService3GetProvisioningSchemeByIdCGetProvisionedVirtualMachineBySid1StartResetVirtualMachine-CheckResetVmOperationsECheckResetVirtualMachineOperations=StartVirtualMachinePowerAction?StartVirtualMachinePowerActions?CheckVirtualMachinePowerActionsIBeginVirtualMachinePowerStateChangesICheckVirtualMachinePowerStateChanges?BeginVirtualMachineStateChanges?CheckVirtualMachineStateChanges;PollVirtualMachinePowerStates;GetMaximumPowerStateQuerySize
Source: BrokerService.exe, 0000001F.00000002.2556016980.00000254519F2000.00000002.00000001.01000000.00000049.sdmp Binary or memory string: set_VMToolsState
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ]C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\VirtualCenter.dll
Source: RegisterPlugins.exe, 00000024.00000002.2064004697.000001A1F83B8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\RestSharp.dllRq"
Source: BrokerService.exe, 0000001D.00000002.1910073183.0000019492A61000.00000004.00000800.00020000.00000000.sdmp, BrokerService.exe, 0000001F.00000002.2546935378.0000025204A21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: !Hyper-V PowerShell Direct Service
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: ActionFhttp://tempuri.org/IMachineCreationApi/CheckVirtualMachineStateChangesT
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.Xaxd.Authentication.Models.dll
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: _C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Newtonsoft.Json.dll
Source: Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr Binary or memory string: numberOfVMs#virtualMachineUid!storageLocations-primaryStorageLocation3secondaryStorageLocations9allSecondaryStorageLocations
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: mC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\PvsVmTemplateForPreparationVM.vhd
Source: Broker_Service_x64.msi Binary or memory string: HCLTlsCertificateVerificationVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268"!
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: jC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\StandardSocketsHttpHandler.dll
Source: Broker_Service_x64.msi Binary or memory string: TemplateDiskForPreparationVMVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268&`
Source: BrokerAdminService.dll.4.dr Binary or memory string: VMToolsState
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: <PollVirtualMachineCapabilities>b__0
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: <StartVirtualMachinePowerAction>b__0
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: ReplyActionNhttp://tempuri.org/IMachineCreationApi/StartVirtualMachinePowerActionsResponse
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp Binary or memory string: ReplyActionburn:ps/IHypervisorCommunicationsLibraryInterface/ValidateVirtualMachineConfigurationUpdateResponse
Source: Broker_Service_x64.msi Binary or memory string: HypervisorsCommonVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: Broker_Service_x64.msi Binary or memory string: DiscUtilsVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: hC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\VirtualCenter.Operations.dll21
Source: svchost.exe, 00000006.00000002.2539358038.0000016D5DC8C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp Binary or memory string: VmNetworkInterfaceIpAddressAdapter
Source: DiscUtils.dll4.4.dr Binary or memory string: VirtualMachineBuilder
Source: RegisterPlugins.exe, 00000024.00000002.2064004697.000001A1F83B8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\VimService.dll_q-
Source: upgrade_site_7.21.0.0-7.22.0.0.xdu.4.dr Binary or memory string: WxbJVeXVMxCb0ayFcvmqyKhgFsZkNqbzbyTXhzSSzGLv1BvIGhaVJjAEQPOP5qYZN4vfgP7ipDE9
Source: Citrix.HypervisorCommunicationsLibrary.dll.4.dr Binary or memory string: VmwarePluginFactoryName
Source: Broker_Service_x64.msi Binary or memory string: SUx RestSharpVMware.C98D514E_DF5A_4FD6_9A45_A29017538268xC
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: ReplyActionMhttp://tempuri.org/IMachineCreationApi/StartVirtualMachinePowerActionResponse
Source: BrokerService.exe, 0000001F.00000002.2546935378.0000025204A21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicshutdown
Source: Broker_Service_x64.msi Binary or memory string: NewtonsoftJsonVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp Binary or memory string: CreateVmNetworkInterfaceIpAddress
Source: Broker_Service_x64.msi Binary or memory string: FmaLoggingVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268H~H
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: ActionKhttp://tempuri.org/IMachineCreationApi/BeginVirtualMachinePowerStateChangesT
Source: BrokerService.exe, 0000001D.00000002.1909653018.0000019491202000.00000002.00000001.01000000.0000000C.sdmp, BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp Binary or memory string: get_MissingVirtualMachineReportingEnabled
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: <StartResetVirtualMachine>b__0
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VmwarePluginCloudDDC
Source: BrokerService.exe, 0000001F.00000002.2556016980.00000254519F2000.00000002.00000001.01000000.00000049.sdmp Binary or memory string: get_VMToolsState
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmwareFolderPath
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VmwarePluginCloudDDCy
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: VirtualMachinePowerStateResult
Source: BrokerService.exe, 0000001D.00000002.1910073183.0000019492A61000.00000004.00000800.00020000.00000000.sdmp, BrokerService.exe, 0000001F.00000002.2546935378.0000025204A21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Guest Service Interface
Source: BrokerService.exe, 0000001D.00000002.1910073183.0000019492A61000.00000004.00000800.00020000.00000000.sdmp, BrokerService.exe, 0000001F.00000002.2546935378.0000025204A21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: -Hyper-V Remote Desktop Virtualization Service
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: UCitrix.InterServiceApiSpecifications.MachineCreationService.ProvisionedVirtualMachineK
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: ReplyActionMhttp://tempuri.org/IMachineCreationApi/PollVirtualMachineCapabilitiesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: VirtualMachineIdField
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: ActionHhttp://tempuri.org/IMachineCreationApi/GetProvisionedVirtualMachineBySidT
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp, BrokerService.exe, 0000001F.00000002.2553794425.0000025450D72000.00000002.00000001.01000000.0000003E.sdmp, Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr Binary or memory string: VirtualMachinePowerAction
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Citrix.PoolManagement.VMManager.VmmImplementation.Vmware.Interfaces
Source: Broker_Service_x64.msi Binary or memory string: FmaLoggingVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp, BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp Binary or memory string: StartVirtualMachinePowerAction
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: <PollVirtualMachinePowerStates>b__0
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: set_WindowsActivationTypeProvisionedVirtualMachine
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: XC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaUtils.dll
Source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp Binary or memory string: McsUpdateProvSchemeTaskVmwareFactory
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: <CheckVirtualMachineStateChanges>b__0
Source: BrokerService.exe, 0000001D.00000002.1910073183.0000019492A61000.00000004.00000800.00020000.00000000.sdmp, BrokerService.exe, 0000001F.00000002.2546935378.0000025204A21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Guest Shutdown Service
Source: Broker_Service_x64.msi Binary or memory string: RestSharpVMware.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp, BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp Binary or memory string: BeginVirtualMachineStateChanges
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp Binary or memory string: ConvertVirtualMachineIdentifierArrayToWcf
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp Binary or memory string: Action8urn:ps/IHypervisorCallbacks/GetVmNetworkInterfaceDetailsT
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp Binary or memory string: RemoteHCLClient.Hypervisor::ValidateVirtualMachineConfigurationUpdate originalSpecification.Name=9, updatedSpecification.Name=
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp, BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp Binary or memory string: CheckResetVirtualMachineOperations
Source: Broker_Service_x64.msi Binary or memory string: FmaUtilsVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr Binary or memory string: <GetVmNetworkInterfaceDetails>b__1
Source: Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr Binary or memory string: <GetVmNetworkInterfaceDetails>b__0
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware\VirtualCenter.dll-
Source: svchost.exe, 00000006.00000002.2538142000.0000016D5DC02000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: BeginVirtualMachinePowerStateChanges
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: mC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.HCL.DistributedTracing.dll153_0<>@{3
Source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp Binary or memory string: VmwareCloudOnGcpEnabled
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: YC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\RestSharp.dll
Source: RegisterPlugins.exe, 00000024.00000002.2064004697.000001A1F83B8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.Xaxd.Authentication.Models.dll
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp, Citrix.HypervisorCommunicationsLibrary.dll.4.dr, Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr Binary or memory string: virtualMachineUid
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp Binary or memory string: ConvertVirtualMachineStateToHcl
Source: Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr Binary or memory string: MachineManagerFactoryMaximumOperationsInProgressAbsoluteDefaultkMachineManagerFactoryMaximumOperationIssueRateDefaultEMachineManagerFactoryLocalizedNameSMachineManagerFactoryLocalizedDescription[MachineManagerFactoryExampleConnectionAddressiMachineManagerFactoryValidateConnectionAddressFormat!EnumerateRegions'CreateSecurityGroup'DeleteSecurityGroup;AuthorizeSecurityGroupIngress9AuthorizeSecurityGroupEgress5RevokeSecurityGroupIngress3RevokeSecurityGroupEgress-SerializeSecurityGroup1DeserializeSecurityGroup9DiskImageToInfrastructureUid+ChangeDiskPersistence/PrepareDiskIdForDisplay!GetMachineStates?GetMaximumMachineStateQuerySize3GetFullMachineDescriptionGGetUpdateMachineCustomDataBatchSize/UpdateMachineCustomData;ValidateSetProvisioningSchemeSValidateVirtualMachineConfigurationUpdate-ValidateNewImageScheme3ValidateProvInventoryItem;SetMachineCatalogResourceTagsAGetProvOrphanedResourceUnmanaged=GetProvOrphanedResourceManagedISetMachineResourceTagsWithCustomData9GetVmNetworkInterfaceDetails)IsPageFileRedirected5GetWriteBackCacheDiskIndexCValidateProvMetadataConfiguration#configurationName%configurationValue+MergeCustomProperties+DisposeMachineManagerMGetMaximumMachineCapabilitiesQuerySize#connectionDetails-GetMachineCapabilities+machineIdToCustomData
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp Binary or memory string: CreateVmNetworkInterfaceDetails
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: Action?http://tempuri.org/IMachineCreationApi/StartResetVirtualMachineT
Source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp Binary or memory string: OrchVMWareResetProvVMDisk
Source: Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr Binary or memory string: VmNetworkInterfaceDetailsAdapter
Source: Broker_Service_x64.msi Binary or memory string: Microsoft.Extensions.ObjectPoolVmWare.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: ReplyActionShttp://tempuri.org/IMachineCreationApi/CheckVirtualMachinePowerStateChangesResponse
Source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp Binary or memory string: VmwarePluginSupportsDataDisk
Source: DiscUtils.dll4.4.dr Binary or memory string: -DiscUtils.Xva.VirtualMachine+<get_Disks>d__11>
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp, BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp Binary or memory string: PollVirtualMachinePowerStates
Source: Broker_Service_x64.msi Binary or memory string: TemplateDiskForPvsBdmVMware.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: }8Citrix.PoolManagement.VMManager.VmmImplementation.Vmware
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp Binary or memory string: IsDumSupported=IsLocalStorageCachingAvailable9InfrastructureUidToDiskImage9DiskImageToInfrastructureUid+ChangeDiskPersistence/PrepareDiskIdForDisplay?GetMaximumMachineStateQuerySize3GetFullMachineDescription/UpdateMachineCustomData;ValidateSetProvisioningSchemeSValidateVirtualMachineConfigurationUpdate-ValidateNewImageScheme)IsPageFileRedirected+MergeCustomProperties9GetVmNetworkInterfaceDetailsAGetProvOrphanedResourceUnmanaged=GetProvOrphanedResourceManaged;SetMachineCatalogResourceTagsISetMachineResourceTagsWithCustomData5GetWriteBackCacheDiskIndexMGetMaximumMachineCapabilitiesQuerySize-GetMachineCapabilitiesCValidateProvMetadataConfiguration5RunStorageEnvironmentTests5RunNetworkEnvironmentTestsCRunInfrastructureEnvironmentTests;RunConnectionEnvironmentTests+RunVmEnvironmentTests%GetLocalizedStringAReadVMMetadataFromMachineProfile3ValidateProvInventoryItemYMaximumOperationsInProgressPercentageDefault_GetMaximumOperationsInProgressPercentageDefaultUMaximumOperationsInProgressAbsoluteDefault[GetMaximumOperationsInProgressAbsoluteDefaultAMaximumOperationIssueRateDefaultGGetMaximumOperationIssueRateDefault
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: <StartVirtualMachinePowerActions>b__0
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp, Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr Binary or memory string: Citrix.ManagedMachineAPI.VirtualMachinePowerAction, Citrix.ManagedMachineAPI, Version=2.5.0.0, Culture=neutral, PublicKeyToken=a80ce61cfbf8b47a
Source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp Binary or memory string: StudioVMwareMachineProfile
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: IVmwareOperations
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp, BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp Binary or memory string: StartResetVirtualMachine
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmwareVersion
Source: BrokerService.exe, 0000001D.00000002.1910073183.0000019492A61000.00000004.00000800.00020000.00000000.sdmp, BrokerService.exe, 0000001F.00000002.2546935378.0000025204A21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: $Hyper-V Volume Shadow Copy Requestor
Source: Broker_Service_x64.msi Binary or memory string: TemplateDiskForPreparationVMVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VirtualMachineMovePriority
Source: DiscUtils.dll4.4.dr Binary or memory string: -DiscUtils.Xva.VirtualMachine+<get_Disks>d__11
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp, BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp Binary or memory string: CheckVirtualMachinePowerActions
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp Binary or memory string: ActionZurn:ps/IHypervisorCommunicationsLibraryInterface/ValidateVirtualMachineConfigurationUpdateT
Source: Broker_Service_x64.msi Binary or memory string: NewtonsoftJsonVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268H
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp, BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp Binary or memory string: PollVirtualMachineCapabilities
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: ReplyActionShttp://tempuri.org/IMachineCreationApi/BeginVirtualMachinePowerStateChangesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp, BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp, Citrix.HypervisorCommunicationsLibrary.HostView.dll.4.dr Binary or memory string: set_VirtualMachineId
Source: svchost.exe, 00000006.00000002.2539358038.0000016D5DC8F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: (@\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: BrokerService.exe, 0000001F.00000002.2546935378.0000025204A21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicheartbeat
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: VirtualMachinePowerStateResultT
Source: BrokerService.exe, 0000001F.00000002.2553794425.0000025450D72000.00000002.00000001.01000000.0000003E.sdmp, DiscUtils.dll4.4.dr Binary or memory string: VirtualMachine
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: aC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\HypervisorsCommon.dll
Source: BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp Binary or memory string: get_MissingVirtualMachineReporting
Source: svchost.exe, 00000006.00000002.2538849833.0000016D5DC4C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: olume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D: @
Source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp Binary or memory string: McsTaskNewProvSchemeVmwareFactory
Source: svchost.exe, 00000006.00000002.2539213847.0000016D5DC80000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: RegisterPlugins.exe, 00000024.00000002.2064004697.000001A1F83B8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\VirtualCenter.dllql
Source: DiscUtils.dll4.4.dr Binary or memory string: VMware Swap
Source: Broker_Service_x64.msi Binary or memory string: FmaEnvVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: UCitrix.InterServiceApiSpecifications.MachineCreationService.ProvisionedVirtualMachine
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\bdm.vhd
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: YC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\DiscUtils.dll
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: virtualMachineIds
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: <CheckVirtualMachinePowerActions>b__0
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: ReplyActionNhttp://tempuri.org/IMachineCreationApi/CheckVirtualMachineStateChangesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: ActionFhttp://tempuri.org/IMachineCreationApi/StartVirtualMachinePowerActionsT
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: KC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware
Source: upgrade_site_7.21.0.0-7.22.0.0.xdu.4.dr Binary or memory string: OSjCVivmCi4A1SwxtCrF70RKNYwt9M4Mw+haRQv1ZSqCZy24UIN9k81sw0+HD77S/b5fuas5w5W8
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: CheckVirtualMachinePowerStateChanges
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ]C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\PvsVmTemplate.vhd
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: ZCitrix.InterServiceApiSpecifications.MachineCreationService.VirtualMachinePowerStateResultZ
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: ReplyActionQhttp://tempuri.org/IMachineCreationApi/CheckResetVirtualMachineOperationsResponse
Source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp Binary or memory string: RemoteVmwareSDKOnly
Source: svchost.exe, 00000006.00000002.2539213847.0000016D5DC64000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: $@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000e1}
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: KC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware21
Source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp Binary or memory string: McsTaskNewProvVMVmwareFactory
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp, Citrix.HypervisorCommunicationsLibrary.dll.4.dr, Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr Binary or memory string: VirtualMachineIdentifier
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: virtualMachineId
Source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp Binary or memory string: MissingVirtualMachineReporting
Source: svchost.exe, 00000006.00000002.2539358038.0000016D5DC8F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: "@\??\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp Binary or memory string: Actionpurn:ps/IHypervisorCommunicationsLibraryInterface/ValidateVirtualMachineConfigurationUpdateRemotePluginFaultFaultT
Source: HypervisorsCommon.dll0.4.dr Binary or memory string: HCL-VMware: EncodeUTF8AndBase64: Decoding failed because the input byte sequence cannot be mapped to Unicode.
Source: Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr Binary or memory string: <ValidateVirtualMachineConfigurationUpdate>b__1
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp, Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr Binary or memory string: <ValidateVirtualMachineConfigurationUpdate>b__0
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: ReplyActionLhttp://tempuri.org/IMachineCreationApi/PollVirtualMachinePowerStatesResponse
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaEnv.dll
Source: Broker_Service_x64.msi Binary or memory string: TemplateDiskVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: ActionDhttp://tempuri.org/IMachineCreationApi/PollVirtualMachinePowerStatesT
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: 8Citrix.PoolManagement.VMManager.VmmImplementation.Vmware
Source: HypervisorsCommon.dll0.4.dr Binary or memory string: IVmNetworkInterfaceDetails
Source: Broker_Service_x64.msi Binary or memory string: w TemplateDiskForPvsBdmVMware.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: GetProvisionedVirtualMachineBySid
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwareHypervisorFactory
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ZC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaLogging.dll
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp, BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp Binary or memory string: CheckVirtualMachineStateChanges
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp Binary or memory string: ReplyActionUurn:ps/IHypervisorCommunicationsLibraryInterface/GetVmNetworkInterfaceDetailsResponse
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp Binary or memory string: ReplyActionMurn:ps/IHypervisorCallbacks/ValidateVirtualMachineConfigurationUpdateResponse
Source: upgrade_site_7.16.0.0-7.17.0.0.xdu.4.dr Binary or memory string: uP2HZilPzw/PtjT+pwt3WpPeQhaOjiP7XDzAcFFOHAFhgFsMIDLHJXfmQeFJhhQWMDTSCVMhWEUb
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: <CheckVirtualMachinePowerStateChanges>b__0
Source: BrokerAdminService.dll.4.dr Binary or memory string: Citrix.Broker.Admin.SDK.VMToolsState, BrokerSDKDefinition, Version=7.41.1100.0, Culture=neutral, PublicKeyToken=a80ce61cfbf8b47a
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp Binary or memory string: ActionXurn:ps/IHypervisorCallbacks/GetVmNetworkInterfaceDetailsRemoteHclCommunicationFaultFaultT
Source: Broker_Service_x64.msi Binary or memory string: HypervisorsCommonVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268H
Source: Broker_Service_x64.msi Binary or memory string: HCLTlsCertificateVerificationVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: IBrokerDAL.dll.4.dr Binary or memory string: MachineToolStateToVMToolState
Source: Citrix.HypervisorCommunicationsLibrary.dll.4.dr Binary or memory string: VmwareFactory
Source: BrokerService.exe, 0000001D.00000002.1910073183.0000019492A61000.00000004.00000800.00020000.00000000.sdmp, BrokerService.exe, 0000001F.00000002.2546935378.0000025204A21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: $Hyper-V Time Synchronization Service
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp Binary or memory string: <ConvertVirtualMachineIdentifierArrayToWcf>b__28_0
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: ActionFhttp://tempuri.org/IMachineCreationApi/CheckVirtualMachinePowerActionsT
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp, Citrix.HypervisorCommunicationsLibrary.dll.4.dr, Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr Binary or memory string: ValidateVirtualMachineConfigurationUpdate
Source: BrokerService.exe, 0000001F.00000002.2546935378.0000025204A21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicvss
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VmwareFactoryq]G
Source: upgrade_site_5.1.0.0-5.6.0.0.xdu.4.dr Binary or memory string: rtJP7ypXLZDwYd9APdcFLaHw+hXl3GbFbPkxMRlyzJQXoClmFwuQEMu7OUX+sJ871LnfUex2NbOp
Source: BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp Binary or memory string: QueryMcsForCompletedResetActions: CheckResetVirtualMachineOperations returned {0} completed operations
Source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp Binary or memory string: VmwarePluginMCSPowerManaged
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: <BeginVirtualMachineStateChanges>b__0
Source: upgrade_site_7.24.2000.0-7.24.0.0.xdu.4.dr Binary or memory string: fcbqcue5k5xmk8DvRfOiM2CgvtxZp44KipdW1TOpZVVHgfs9U3YJEuT329ELtQnpvZB+uNUAWR/X
Source: BrokerService.exe, 0000001D.00000002.1910073183.0000019492A61000.00000004.00000800.00020000.00000000.sdmp, BrokerService.exe, 0000001F.00000002.2546935378.0000025204A21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Data Exchange Service
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: ReplyActionPhttp://tempuri.org/IMachineCreationApi/GetProvisionedVirtualMachineBySidResponse
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp Binary or memory string: numberOfVMs-primaryStorageLocation3secondaryStorageLocations#virtualMachineUid!storageLocations9allSecondaryStorageLocations
Source: RegisterPlugins.exe, 00000024.00000002.2064004697.000001A1F83B8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Newtonsoft.Json.dllfqv
Source: Broker_Service_x64.msi Binary or memory string: FmaUtilsVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268H
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Citrix.PoolManagement.VMManager.VmmImplementation.Vmware.VmwareFactory, VirtualCenter, Version=7.41.1100.0, Culture=neutral, PublicKeyToken=a80ce61cfbf8b47a
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp Binary or memory string: <ConvertVirtualMachineStateToHcl>b__21_0
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp Binary or memory string: Actioncurn:ps/IHypervisorCommunicationsLibraryInterface/GetVmNetworkInterfaceDetailsRemotePluginFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: <BeginVirtualMachinePowerStateChanges>b__0
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Citrix.PoolManagement.VMManager.VmmImplementation.Vmware.VMwareHypervisorFactory, VirtualCenter, Version=7.41.1100.0, Culture=neutral, PublicKeyToken=a80ce61cfbf8b47a
Source: BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp Binary or memory string: MapToMachineState: Could not parse MCS's VirtualMachinePowerState '{0}' to an HCL MachineState for machine ID '{1}'
Source: RegisterPlugins.exe, 00000024.00000002.2064004697.000001A1F83B8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.HCL.TlsCertificateVerification.dll
Source: Broker_Service_x64.msi Binary or memory string: FmaEnvVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268H
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Citrix.PoolManagement.VMManager.VmmImplementation.Vmware.VMwareHypervisorFactory, VirtualCenter, Version=7.41.1100.0, Culture=neutral, PublicKeyToken=a80ce61cfbf8b47aCategory@{3
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: ActionKhttp://tempuri.org/IMachineCreationApi/CheckVirtualMachinePowerStateChangesT
Source: Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr Binary or memory string: GetVmNetworkInterfaceDetails
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp Binary or memory string: Actioneurn:ps/IHypervisorCallbacks/ValidateVirtualMachineConfigurationUpdateRemoteHclCommunicationFaultFaultT
Source: svchost.exe, 0000000B.00000002.2538332592.0000025BF022B000.00000004.00000020.00020000.00000000.sdmp, BrokerService.exe, 0000001F.00000002.2551474492.00000254503FB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: HypervisorsCommon.dll0.4.dr Binary or memory string: IVmNetworkInterfaceIpAddress
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp Binary or memory string: ReplyAction@urn:ps/IHypervisorCallbacks/GetVmNetworkInterfaceDetailsResponse
Source: Broker_Service_x64.msi Binary or memory string: TemplateDiskVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: Broker_Service_x64.msi Binary or memory string: BlankDiskVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OperationContractAttributeAssemblyProductAttributeAssemblyCopyrightAttributeCLSCompliantAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributemetadataValuevalueAddCustomFieldDefPrivilegePolicyDefserviceRefovfRefresourcePoolRefvmRefmachineFolderReffolderRefcustomFieldsManagerRefhostRefSystem.Runtime.VersioningimageDiskPathvmwareFolderPathdatacenterPathpathVimApiUriDiscUtils.VmdkSuspendVM_TaskCloneVM_TaskRelocateVM_TaskCreateVM_TaskPowerOffVM_TaskReconfigVM_TaskPowerOnVM_TaskResetVM_TaskDeleteDatastoreFile_TaskMoveDatastoreFile_TaskRename_TaskSearchDatastore_TaskCheckRelocate_TaskCreateVirtualDisk_TaskDeleteVirtualDisk_TaskCopyVirtualDisk_TaskRemoveAllSnapshots_TaskCreateSnapshot_TaskRevertToSnapshot_TaskDestroy_TaskReadDiskUploadDiskIVirtualDiskSystem.ServiceModelVirtualCenter.Interfaces.dllSystemsuppressPowerOnTimeSpancurrentStateVersionCheckStorageLocationSystem.ReflectionIFileDiskDefinitiondiskDefinitionsnapshotDescriptioncdpdestinationFolderconnectionPeerserviceContentFileManagerserviceContentVirtualDiskManagerserviceContentSessionManagerserviceContentProvisioningCheckerRemoveSslHandlerCreateFiltersourceDatacenterdestinationDatacenterdatacenterConnectionDetailsAddInViewAdapter.ctorserviceContentPropertyCollectorCreateDescriptorpropertyFilterSpecsSystem.DiagnosticscloudConnectorIdsCitrix.PoolManagement.VMManager.VmmImplementation.Vmware.InterfacesVirtualCenter.InterfacesSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesSystem.ResourcesDebuggingModescreateParentDirectoriesRetrievePropertiesCitrix.HypervisorCommunicationsLibrary.Wcf.TypespartialUpdatesMicrosoft.CodeAnalysisIConnectionDetailsconnectionDetailsDiscUtilsOvfCreateDescriptorParamsIVmwareOperationsWaitOptionswaitOptionsconnectionAddressaddressAttributeTargetsObjectSystem.NetUpdateSetCertificateValidationResultOvfCreateDescriptorResultRetrieveServiceContentObjectContentget_Thumbprintset_ThumbprintAddAllowedThumbprintsslThumbprintconnectionThumbprintmaxUploadRetryCountmaxCheckStorageRetryCountbaseSnapshotShutdownGuestRebootGuesthostdiskUploadResponseTimeoutdiskUploadReadWriteTimeoutconnectionTimeoutLogoutWaitForUpdatesExfieldPolicyfieldDefPolicykeyCitrix.HypervisorCommunicationsLibrarymemoryMakeDirectorydirectoryVirtualMachineMovePrioritypriorityIWebProxyproxyav
Source: Broker_Service_x64.msi Binary or memory string: k Microsoft.Extensions.ObjectPoolVmWare.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: Citrix.HypervisorCommunicationsLibrary.dll.4.dr Binary or memory string: SupportsGetVmNetworkInterfaceDetails
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: iC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\VimService.XmlSerializers.dll
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: %VMware\StandardSocketsHttpHandler.dll
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp Binary or memory string: ActionFhttp://tempuri.org/IMachineCreationApi/BeginVirtualMachineStateChangesT
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware\VirtualCenter.dll
Source: Broker_Service_x64.msi Binary or memory string: HCLDistributedTracingVmwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268HV
Source: Broker_Service_x64.msi Binary or memory string: HCLDistributedTracingVmwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Process information queried: ProcessInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Memory allocated: page read and write | page guard
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\AlwaysOnTracing.man" Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\BrokerEventsProvider.man" Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\HighAvailabilityEventsProvider.man" Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\SysWOW64\sc.exe" sidtype CitrixBrokerService unrestricted Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Program Files\Citrix\Broker\Service\BrokerService.exe "C:\Program Files\Citrix\Broker\Service\BrokerService.exe" -Upgrade Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe "C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe" -Pipeline "C:\Program Files\Citrix\Broker\Service\Pipeline\" Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe "C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe" -PluginsRoot "C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\" Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C: VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C: VolumeInformation Jump to behavior
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\BrokerService.exe VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\ComponentInterface.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaUtils.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utilities.AssemblyResolver.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaRegistry.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaLogging.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\BrokerCdeLibrary.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cdf.Net.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\LhcUtils.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaEnv.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\System.ServiceProcess.ServiceController.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\System.Configuration.ConfigurationManager.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.InteropServices.RuntimeInformation\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.InteropServices.RuntimeInformation.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Strings.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaRegistry.Interface.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Microsoft.Win32.Registry.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Settings.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSite.Interface.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Diagnostics.Tracing.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Logging.Abstractions.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaDalRuntime.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaTransactionScope.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.DistributedTracing.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaFeature.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.Interface.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.Interfaces.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.Models.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\System.Diagnostics.DiagnosticSource.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaDependencyInjection.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\System.Diagnostics.DiagnosticSource.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaCommandLine.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\UrlAclSupport.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\RegistryCounters.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Licensing.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Channels\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Channels.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Web\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Web.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\XmlMultiplexer.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\XmsInterfaces.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Wpnbr.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\VirtualSites.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\CtxAdmin.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\XmsRuntime.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\ProxyCommon.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\BrokerComponentCommon.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\EventLog.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\BrokerService.exe VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\ComponentInterface.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaUtils.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utilities.AssemblyResolver.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaRegistry.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Common\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Data.Common.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.StackTrace\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Diagnostics.StackTrace.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.Tracing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Diagnostics.Tracing.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Globalization.Extensions\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Globalization.Extensions.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Composition\v4.0_4.0.0.0__b77a5c561934e089\System.ComponentModel.Composition.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Sockets\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Sockets.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\System.ValueTuple.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.InteropServices.RuntimeInformation\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.InteropServices.RuntimeInformation.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Xml\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Xml.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Primitives.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.Cryptography.Algorithms\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.Cryptography.Algorithms.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.SecureString\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.SecureString.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.XPath.XDocument\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Xml.XPath.XDocument.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Caching\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Caching.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.RegularExpressions\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Design.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.ApplicationServices\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.ApplicationServices.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\v4.0_4.0.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Utilities.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.v4.0.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.v4.0.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaLogging.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\BrokerCdeLibrary.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cdf.Net.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\LhcUtils.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaEnv.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\System.ServiceProcess.ServiceController.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\System.Configuration.ConfigurationManager.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Strings.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaRegistry.Interface.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Microsoft.Win32.Registry.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Settings.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSite.Interface.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Diagnostics.Tracing.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Logging.Abstractions.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaDalRuntime.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaTransactionScope.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.DistributedTracing.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaFeature.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.Interface.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Messaging\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.DurableInstancing\v4.0_4.0.0.0__31bf3856ad364e35\System.Runtime.DurableInstancing.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel.Selectors\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.Selectors.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activation\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Activation.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Activities.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xaml.Hosting\v4.0_4.0.0.0__31bf3856ad364e35\System.Xaml.Hosting.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.DurableInstancing\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.DurableInstancing.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Activities.Compiler.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.Interfaces.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.Models.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\System.Diagnostics.DiagnosticSource.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaDependencyInjection.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Settings.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\EventLog.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaWcf.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaEventLog.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaPlugin.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.DateTime.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Events.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Channels\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Channels.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Design\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Services.Design.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Linq.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Entity.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\BrokerComponentCommon.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\TicketStore.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\HostingManagementComponent.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaSiteServices.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\RemoteHCLClient.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\BrokerSDKDefinition.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.ManagedMachineAPI.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\BrokerComponent.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\WorkerChannelFactoryLoader.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\CbpControllerSdk.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.ServiceRegistration.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSiteManager.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSite.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\VirtualSites.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.Utilities.Sids.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaActiveDirectory.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaActiveDirectory.Interfaces.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\System.Security.Principal.Windows.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn\v4.0_4.0.0.0__b77a5c561934e089\System.AddIn.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn.Contract\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.AddIn.Contract.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HCL.Shared.Contracts.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HypervisorCommunicationsLibrary.Contracts.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HypervisorCommunicationsLibrary.Models.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.ManagedMachineAPI.Contracts.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.Xaxd.Utils.Strings.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaEnv.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaFeature.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaLogging.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaServiceStatus.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FMAUtils.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Microsoft.Extensions.Logging.Abstractions.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Microsoft.Extensions.ObjectPool.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\PluginUtilities.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\System.Buffers.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\System.Memory.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HCL.DistributedTracing.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.DistributedTracing.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HCL.Shared.Adapters.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HCL.Shared.Contracts.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HCL.TlsCertificateVerification.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Http\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Http.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HypervisorCommunicationsLibrary.AddInSideAdapter.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HypervisorCommunicationsLibrary.Contracts.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.ManagedMachineAPI.Contracts.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.MachineCreationAPI.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.ManagedMachineAPI.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HCL.Shared.Contracts.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.ManagedMachineAPI.AddInSideAdapter.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.ManagedMachineAPI.Contracts.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.MachineCreationAPI.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HCL.Shared.Contracts.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\CustomProvisioningCommon.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.ManagedMachineAPI.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HypervisorCommunicationsLibrary.Models.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.MachineCreationAPI.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\DiscUtils.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\HypervisorsCommon.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.ManagedMachineAPI.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\System.Diagnostics.DiagnosticSource.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Microsoft.Extensions.Logging.Abstractions.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.ManagedMachineAPI.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.Wcf.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.ManagedMachineAPI.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.Wcf.Types.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.ManagedMachineAPI.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.MachineCreationAPI.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.ManagedMachineAPI.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.ManagedMachineAPI.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.DistributedTracing.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.Utilities.AssemblyResolver.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.Utilities.EnumCache.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.Utils.Strings.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Microsoft.WindowsAzure.Configuration.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\RemoteHCLCLient.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.ManagedMachineAPI.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\System.Configuration.ConfigurationManager.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\System.Diagnostics.DiagnosticSource.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\System.Memory.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\System.Memory.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\System.Runtime.CompilerServices.Unsafe.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn\v4.0_4.0.0.0__b77a5c561934e089\System.AddIn.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn.Contract\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.AddIn.Contract.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn\v4.0_4.0.0.0__b77a5c561934e089\System.AddIn.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Changes security center settings (notifications, updates, antivirus, firewall)
Source: C:\Windows\System32\svchost.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{D68DDC3A-831F-4fae-9E44-DA132C1ACF46} STATE Jump to behavior
Modifies Internet Explorer zone settings
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones NULL
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 DisplayName
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 PMDisplayName
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 Description
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 Icon
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 LowIcon
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 CurrentLevel
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 Flags
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 DisplayName
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 PMDisplayName
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 Description
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 Icon
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 LowIcon
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 CurrentLevel
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 Flags
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 DisplayName
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 PMDisplayName
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 Description
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 Icon
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 LowIcon
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 CurrentLevel
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 Flags
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 DisplayName
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 PMDisplayName
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Description
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Icon
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 LowIcon
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 CurrentLevel
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Flags
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 DisplayName
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 PMDisplayName
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Description
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Icon
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 LowIcon
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 CurrentLevel
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Flags
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 1200
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 1200
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 1400
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 1400
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 2500
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones SelfHealCount
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 DisplayName
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 PMDisplayName
Modifies Internet Explorer zonemap settings
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap ProxyByPass
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap IntranetName
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap UNCAsIntranet
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap AutoDetect
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults http
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults https
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults ftp
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults file
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults @ivt
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults shell
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults knownfolder
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap ProxyBypass
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap IntranetName
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap UNCAsIntranet
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap AutoDetect
AV process strings found (often used to terminate AV products)
Source: svchost.exe, 00000009.00000002.2539757321.000001C94C702000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000009.00000002.2539757321.000001C94C702000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Adds / modifies Windows certificates
Source: C:\Windows\SysWOW64\msiexec.exe Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7613BA1FFF7E3EEF6E1BD42237A9A3D68FC2EE7E Blob Jump to behavior
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\System32\svchost.exe WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA &apos;AntiVirusProduct&apos; OR TargetInstance ISA &apos;FirewallProduct&apos; OR TargetInstance ISA &apos;AntiSpywareProduct&apos;
Source: C:\Program Files\Windows Defender\MpCmdRun.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1529042 Sample: Broker_Service_x64.msi Startdate: 08/10/2024 Architecture: WINDOWS Score: 30 76 time.windows.com 2->76 78 _ldap._tcp. 2->78 80 Yara detected Generic Downloader 2->80 9 msiexec.exe 501 892 2->9         started        12 BrokerService.exe 2->12         started        15 svchost.exe 2->15         started        17 8 other processes 2->17 signatures3 process4 file5 60 C:\...\System.Management.Automation.dll, PE32 9->60 dropped 62 C:\Program Files\Citrix\...\RestSharp.dll, PE32 9->62 dropped 64 C:\Program Files\Citrix\...\BrokerService.exe, PE32+ 9->64 dropped 74 639 other files (1 malicious) 9->74 dropped 19 msiexec.exe 15 19 9->19         started        21 msiexec.exe 1 2 9->21         started        24 msiexec.exe 9->24         started        28 3 other processes 9->28 82 Modifies Internet Explorer zone settings 12->82 84 Modifies Internet Explorer zonemap settings 12->84 86 Changes security center settings (notifications, updates, antivirus, firewall) 15->86 26 MpCmdRun.exe 15->26         started        66 C:\Users\user\AppData\Local\...\MSID34D.tmp, PE32 17->66 dropped 68 C:\Users\user\AppData\Local\...\MSI99A3.tmp, PE32+ 17->68 dropped 70 C:\Users\user\AppData\Local\...\MSI9983.tmp, PE32 17->70 dropped 72 C:\Users\user\AppData\Local\...\MSI9878.tmp, PE32 17->72 dropped 88 Query firmware table information (likely to detect VMs) 17->88 signatures6 process7 file8 30 wevtutil.exe 19->30         started        32 wevtutil.exe 19->32         started        34 wevtutil.exe 19->34         started        38 5 other processes 19->38 58 C:\Program Files\...\BrokerService.exe.config, XML 21->58 dropped 36 conhost.exe 26->36         started        process9 process10 40 conhost.exe 30->40         started        42 wevtutil.exe 30->42         started        44 conhost.exe 32->44         started        46 wevtutil.exe 32->46         started        48 conhost.exe 34->48         started        50 wevtutil.exe 34->50         started        52 conhost.exe 38->52         started        54 conhost.exe 38->54         started        56 3 other processes 38->56
⊘No contacted IP infos

Contacted Domains

Name IP Active
_ldap._tcp. unknown unknown
_ldap._tcp. unknown unknown
_ldap._tcp. unknown unknown
time.windows.com unknown unknown