Edit tour

Windows Analysis Report
Broker_Service_x64.msi

Overview

General Information

Sample name:	Broker_Service_x64.msi
Analysis ID:	1529042
MD5:	2d8222e63cc0a2d86d80a57d26347c84
SHA1:	8d762e32f294bc971873f031027393520ac0161d
SHA256:	991636b9ba9a4a528e0267de74cad67012fe031dc5b859a9a7a32a1303b90dd8
Infos:

Detection

Score:	30
Range:	0 - 100
Whitelisted:	false
Confidence:	20%

Signatures

Changes security center settings (notifications, updates, antivirus, firewall)

Modifies Internet Explorer zone settings

Modifies Internet Explorer zonemap settings

Query firmware table information (likely to detect VMs)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Stores large binary data to the registry

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 648 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\Broker_Service_x64.msi" MD5: E5DA170027542E25EDE42FC54C929077)

svchost.exe (PID: 3576 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

SgrmBroker.exe (PID: 5640 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

msiexec.exe (PID: 5096 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 6756 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 61840644E35B0012964490F7155C79A4 C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 6596 cmdline: C:\Windows\System32\MsiExec.exe -Embedding F4607A9CFBE627DAA7B1AF4F0A87DD4D C MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 3452 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 7D00F72EBD1F03FE2BA91EB00E79F5F2 MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 4036 cmdline: C:\Windows\System32\MsiExec.exe -Embedding 40FEA25D10AEAC450300A64B6E69AD51 MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 2056 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding E5BAB935B9E62F5EF499449BA355B5C1 E Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)

wevtutil.exe (PID: 2980 cmdline: "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\AlwaysOnTracing.man" MD5: 3C0E48DA02447863279B0FE3CE7FE5E8)

conhost.exe (PID: 1792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wevtutil.exe (PID: 2412 cmdline: "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\AlwaysOnTracing.man" /fromwow64 MD5: 1AAE26BD68B911D0420626A27070EB8D)

wevtutil.exe (PID: 6332 cmdline: "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\BrokerEventsProvider.man" MD5: 3C0E48DA02447863279B0FE3CE7FE5E8)

conhost.exe (PID: 6276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wevtutil.exe (PID: 5580 cmdline: "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\BrokerEventsProvider.man" /fromwow64 MD5: 1AAE26BD68B911D0420626A27070EB8D)

wevtutil.exe (PID: 7080 cmdline: "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\HighAvailabilityEventsProvider.man" MD5: 3C0E48DA02447863279B0FE3CE7FE5E8)

conhost.exe (PID: 1292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wevtutil.exe (PID: 6836 cmdline: "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\HighAvailabilityEventsProvider.man" /fromwow64 MD5: 1AAE26BD68B911D0420626A27070EB8D)

sc.exe (PID: 3256 cmdline: "C:\Windows\SysWOW64\sc.exe" sidtype CitrixBrokerService unrestricted MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 3260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

BrokerService.exe (PID: 5328 cmdline: "C:\Program Files\Citrix\Broker\Service\BrokerService.exe" -Upgrade MD5: CB044A172BFC56F40916FDDFB0381694)

conhost.exe (PID: 6472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegisterPlugins.exe (PID: 3636 cmdline: "C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe" -Pipeline "C:\Program Files\Citrix\Broker\Service\Pipeline\" MD5: 42B1415948404168E021518E8A5EE683)

conhost.exe (PID: 2712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegisterPlugins.exe (PID: 4188 cmdline: "C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe" -PluginsRoot "C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\" MD5: 42B1415948404168E021518E8A5EE683)

conhost.exe (PID: 5964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegisterPlugins.exe (PID: 1792 cmdline: "C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe" -PluginsRoot "C:\Program Files\Common Files\Citrix\HCLPlugins\ManagedMachine\v2.5.0.0\" MD5: 42B1415948404168E021518E8A5EE683)

conhost.exe (PID: 5688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 6468 cmdline: C:\Windows\System32\MsiExec.exe -Embedding B57FEBC80AACA307814E81531C396CA3 E Global\MSI0000 MD5: E5DA170027542E25EDE42FC54C929077)

svchost.exe (PID: 5064 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 5428 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 4340 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MpCmdRun.exe (PID: 2916 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 7044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 5260 cmdline: C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 3924 cmdline: C:\Windows\system32\svchost.exe -k LocalService -s W32Time MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 4260 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

BrokerService.exe (PID: 4456 cmdline: "C:\Program Files\Citrix\Broker\Service\BrokerService.exe" MD5: CB044A172BFC56F40916FDDFB0381694)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Program Files\Citrix\Broker\Service\RestSharp.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files\Citrix\Broker\Service\System.Management.Automation.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files\Citrix\Broker\Service\System.Management.Automation.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Sigma Signatures

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: , EventID: 13, EventType: SetValue, Image: C:\Program Files\Citrix\Broker\Service\BrokerService.exe, ProcessId: 4456, TargetObject: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\(Default)

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, ProcessId: 3576, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: ccauthcpp_dynamic.dll.4.dr

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_16f64683-e

Source: C:\Windows\System32\msiexec.exe

Window detected: WixUI_Bmp_DialogI &accept the terms in the License Agreement&Print&Back&InstallCancelCITRIX LICENSE AGREEMENTUse of this component is subject to the Citrix license or terms of service covering the Citrix product(s) and/or service(s) with which you will be using this component. This component is licensed for use only with such Citrix product(s) and/or service(s).CTX_code EP_R_A10352779Please read the Citrix Broker Service License Agreement

Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddIns	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\UpdateScripts	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\zh-CN	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ImportScripts	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\ManagedMachine	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\ManagedMachine\v2.5.0.0	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\ThirdParty	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\ThirdParty\v2.5.0.0	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\CitrixMachineCreation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\CitrixMachineCreation\v1.0.0.0	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\32	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\32\ccauthcpp_dynamic.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\64	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\64\ccauthcpp_dynamic.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ActiveDirectory.SiteManagement.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ADIdentityInterService.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\AlwaysOnTracing.man	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\AlwaysOnTracing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\amd64	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\amd64\libccauth.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.Utilities.AssemblyResolver.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.Authentication.Models.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Avro.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.Aws.Batcher.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSPlugin.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.EBS.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.EC2.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.IdentityManagement.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.S3.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.SecurityToken.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Azure.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Azure.Identity.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Setup Scripts	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Setup Scripts\BackupDesktopServerKeys.ps1	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BaseDAL.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\BlankVhdTemplate.vhd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\BlankVhdTemplate.vhd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\BlankVhdTemplate.vhd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\BlankVhdTemplate.vhd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\BlankVhdTemplate.vhd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BouncyCastle.Cryptography.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerAdminQuery.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerAdminService.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerCde.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerCdeLibrary.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerComponentCommon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerComponent.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerDAL.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerEnvTests.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerEventsProvider.man	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerFiltering.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerSDKDefinition.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerSDKLogic.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerService.exe.config.orig	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerServiceEventLogResources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerServiceSupport.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\Castle.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Castle.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Castle.Windsor.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\CbpConstants.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\CbpControllerSdk.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\CbpTypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\CdeEvents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\CdeLibrary.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Diagnostics.Tracing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Networking.WebSocket.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Networking.WebSocket.pdb	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.Xaxd.Authentication.Models.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.DistributedTracing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.Xaxd.NgsTunnel.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.Utilities.AssemblyResolver.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.Utilities.EnumCache.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.Utils.Strings.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.ADIdentity.DataModel.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Base.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Broker.CasCommandQueuePayload.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.AgentFoundation.Common.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.AgentFoundation.Common.Classic.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.AgentFoundation.OnPremiseCommon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.AgentFoundation.OnPremiseContracts.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Core.Api.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Diagnostics.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Logging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Monitoring.ApplicationInsights.Shared.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Redis.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Security.CCAuth.Managed.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.ServiceRuntime.ApiClient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.ServiceRuntime.Configuration.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Trust.Api.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Utilities.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.ConfigLogging.Wcf.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.ConfigurationLogging.Rest.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Configuration.Rest.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.DelegatedAdmin.Rest.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Monitor.BrokerCodes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.DelegatedAdminInterfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.DistributedTracing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.ServiceCommon.KeySharingInterfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.ServiceCore.Common.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.Utilities.Sids.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HCL.DistributedTracing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Host.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Common.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.HostView.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Models.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Wcf.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Wcf.Types.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.IconConverter.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.IdentityManagement.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.IdentityManagement.Logging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.IdentityManagement.Utilities.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.MachineCreationAPI.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.MachineCreationAPI.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.ManagedMachineAPI.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.ManagedMachineAPI.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.ManagedMachineAPI.HostView.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.ManagedMachinePluginFinder.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.OperationalEvents.Broker.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.OperationalEvents.Common.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Services.ServiceHosting.WindowsServiceHostingApi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Services.ServiceLocator.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Trust.Library.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.CasConfigClient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.CasEventHubClient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.CasInterfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.Common.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.AspNet.CitrixCloud.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.AspNet.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.CitrixCloudCommon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.Interfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.Models.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.Profiles.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.CasDispatcher.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cdf.Net.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cloud.AclStore.Rest.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cloud.ServiceRegistry.Grpc.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cloud.ServiceRegistry.Rest.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cloud.VirtualSiteRegistry.Rest.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Common.Headers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Compression.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Compression.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Compression.Interfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Exporter.NewRelic.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Exporter.Cas.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.Wcf.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.Tc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.WebSocket.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.Wcf.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.Http.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Exceptions.Common.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Exceptions.Interfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Grpc.Client.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Grpc.Common.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Hostname.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Hostname.Interfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Logging.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Posh.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.RateLimiting.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.RateLimiting.Wcf.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Rest.Client.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Rest.Client.Interfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Retry.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Signer.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Tenancy.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Tenancy.Interfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utilities.AssemblyResolver.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utilities.EnumCache.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Collections.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.DateTime.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Dynamic.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Events.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Minimatch.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Networking.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Objectpool.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Reflection.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Retry.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.SecretBuffer.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Serialization.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Strings.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.Xaxd.Utils.Strings.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.StrongName.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Uri.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Windows.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Wcf.Client.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Wcf.Client.Interfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.XenDesktop.Cloud.DataStore.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.XenDesktop.Cloud.DataStore.Models.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\de	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\de\CloudCommon.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\es	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\es\CloudCommon.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\fr	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\fr\CloudCommon.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\ja	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\ja\CloudCommon.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\zh-CN	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\zh-CN\CloudCommon.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\CloudCommon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ComponentInterface.Constants.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ComponentInterface.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ConfigLoggingSupport.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Setup Scripts\ConfigureHighAvailabilityService.ps1	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ControllerDAL.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ControllerInterfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\CookComputing.XmlRpcV2.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\CredentialSecurity64.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\cs	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\cs\Microsoft.VisualStudio.Threading.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\cs\Microsoft.VisualStudio.Validation.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\CtxAdmin.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\CtxMcp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\CtxSta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\CustomProvisioningCommon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\BrokerServiceSupport.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\Citrix.Base.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\Citrix.CloudServices.Core.Api.Client.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\Citrix.IconConverter.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\ConfigLoggingSupport.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\FmaCommonEnvTests.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\FmaConfigLoggingClient.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\GpAnalyzer.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\GpDocument.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\GpfxSettings.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.Edm.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.OData.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.Services.Client.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.SqlClient.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.SqlServer.Management.SqlParser.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.VisualStudio.Threading.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.VisualStudio.Validation.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\System.Spatial.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ImportScripts\Default.zip	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\DelegatedAdminSupport.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\DiscUtils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\DiscUtils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\DiscUtils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\DiscUtils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\DiscUtils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\DiscUtils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.DistributedTracing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\DnsIpSupport.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\DocumentFormat.OpenXml.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\UpdateScripts\downgrade_site_7.41.1100.0-7.41.100.0.xdu	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\BrokerServiceSupport.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\Citrix.Base.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\Citrix.CloudServices.Core.Api.Client.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\Citrix.IconConverter.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\ConfigLoggingSupport.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\FmaCommonEnvTests.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\FmaConfigLoggingClient.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\GpAnalyzer.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\GpDocument.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\GpfxSettings.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.Data.Edm.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.Data.OData.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.Data.Services.Client.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.Data.SqlClient.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.SqlServer.Management.SqlParser.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.VisualStudio.Threading.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.VisualStudio.Validation.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\System.Spatial.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\EventLogCodeGenHelper.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\EventLog.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaAbstractions.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaActiveDirectory.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaActiveDirectory.Interfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaCommandLine.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaCommandQueues.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaCommonEnvTests.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaConfigLoggingClient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaConfigLoggingClientInterService.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaConfigLoggingShared.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaDalAttributes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaDalExceptions.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaDalRuntime.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaDependencyInjection.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaEnv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaEnv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaEnvTestInterfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaEnv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaEventLog.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaFeature.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaFeature.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaFiltering.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaFilteringSdkSupport.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaIdentity.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaIdentity.Interfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.Interface.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.Models.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaLogging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaLogging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaLogging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaPlugin.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaProductInfo.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaRegistry.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaRegistry.Interface.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaSchemaProbeDal.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaSchemaTools.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaSecretEncryption.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaSecretEncryptionManager.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.DelegatedAdmin.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Features.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Ism.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.KeySharing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Logging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.ServiceControl.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.ServiceDiscovery.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.ServiceRegistration.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Settings.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSite.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSite.Interface.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSiteManager.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSiteProvider.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceControlInterface.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaServiceStatus.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceStatus.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaSiteServices.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaSiteServicesSupport.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaSqlScriptBuilder.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaSqlUtils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaTransactionScope.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FMAUtils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaUtils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaUtils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaWcf.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\BrokerServiceSupport.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\Citrix.Base.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\Citrix.CloudServices.Core.Api.Client.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\Citrix.IconConverter.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\ConfigLoggingSupport.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\FmaCommonEnvTests.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\FmaConfigLoggingClient.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\GpAnalyzer.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\GpDocument.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\GpfxSettings.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.Data.Edm.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.Data.OData.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.Data.Services.Client.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.Data.SqlClient.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.SqlServer.Management.SqlParser.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.VisualStudio.Threading.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.VisualStudio.Validation.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\System.Spatial.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Google.Api.CommonProtos.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Google.Protobuf.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\GpAnalyzer.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\GpContracts.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\GpDocument.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\GpfxSettings.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\GpXmlSchema.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\grpc_csharp_ext.x64.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\grpc_csharp_ext.x86.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Grpc.Core.Api.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Grpc.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Grpc.Net.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Grpc.Net.Common.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HypervisorCommunicationsLibrary.Contracts.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.HCL.DistributedTracing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HCL.DistributedTracing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\Citrix.HCL.DistributedTracing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.HCL.DistributedTracing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\Citrix.HCL.DistributedTracing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HypervisorCommunicationsLibrary.Models.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HCL.Shared.Contracts.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HCL.TlsCertificateVerification.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.HCL.TlsCertificateVerification.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\HighAvailabilityEventsProvider.man	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ControlScripts	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ControlScripts\HighAvailabilityServiceControl.psm1	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\HighAvailabilityServiceEventLogResources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\HostingManagementComponent.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HypervisorCommunicationsLibrary.AddInSideAdapter.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\HostSideAdapters	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\HostSideAdapters\Citrix.HypervisorCommunicationsLibrary.HostSideAdapter.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.Wcf.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.Wcf.Types.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\HypervisorsCommon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\HypervisorsCommon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\HypervisorsCommon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\HypervisorsCommon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\HypervisorsCommon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\HypervisorsCommon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\i386	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\i386\libccauth.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\IBrokerAdminQuery.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\IBrokerDAL.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\IBrokerDALInternal.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\IControllerDAL.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\IControllerDALInternal.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ICwcSupport.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\IDnsIpSupport.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\IEdgeProxySupport.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ILeasingControl.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSConfiguration	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSConfiguration\InstanceTypes.xml	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSConfiguration\InstanceTypes.xsd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Interop.GPMGMTLib.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Interop.NetFwTypeLib.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\iobfuncdll.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ISdkLogic.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ISecondaryBrokerControl.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\it	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.Edm.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.OData.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.Services.Client.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.SqlClient.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.SqlServer.Management.SqlParser.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.VisualStudio.Threading.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.VisualStudio.Validation.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\it\System.Spatial.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\BrokerServiceSupport.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\Citrix.Base.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\Citrix.CloudServices.Core.Api.Client.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\Citrix.IconConverter.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\ConfigLoggingSupport.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\FmaCommonEnvTests.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\FmaConfigLoggingClient.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\GpAnalyzer.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\GpDocument.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\GpfxSettings.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.Edm.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.OData.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.Services.Client.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.SqlClient.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.SqlServer.Management.SqlParser.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.VisualStudio.Threading.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.VisualStudio.Validation.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\System.Spatial.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ko	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.Edm.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.OData.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.Services.Client.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.SqlClient.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.SqlServer.Management.SqlParser.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.VisualStudio.Threading.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.VisualStudio.Validation.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ko\System.Spatial.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\LhcUtils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Licensing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\LicPolEng.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.ManagedMachineAPI.AddInSideAdapter.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.ManagedMachineAPI.Contracts.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\HostSideAdapters\Citrix.ManagedMachineAPI.HostSideAdapter.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Microsoft.Bcl.AsyncInterfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Microsoft.Extensions.Logging.Abstractions.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Microsoft.Extensions.ObjectPool.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Microsoft.Extensions.ObjectPool.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.ApplicationInsights.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.AspNetCore.Http.Abstractions.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.AspNetCore.Http.Features.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.AspNetCore.SystemWebAdapters.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.KeyVault.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.KeyVault.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.KeyVault.WebKey.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.Services.AppAuthentication.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.Storage.Blob.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.Storage.Common.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Bcl.AsyncInterfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Bcl.HashCode.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.Edm.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.OData.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.Services.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.SNI.arm64.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.SNI.x64.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.SNI.x86.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.Tools.Sql.BatchParser.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Deployment.Compression.Cab.dll	Jump to behavior

Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\logging\cdf_sharp\win\anycpu-release__\obj\release\net472\Citrix.Diagnostics.Tracing.pdb source: BrokerService.exe, 0000001D.00000002.1915055457.00000194AB472000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\utils\assembly_resolver\anycpu-release__\obj\release\net472\Citrix.Xaxd.Utilities.AssemblyResolver.pdb source: BrokerService.exe, 0000001D.00000002.1909505618.00000194911D2000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\RemoteHCLClient\anycpu-release__\obj\release\net472\RemoteHCLClient.pdb(} source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Libraries\Cbp\CbpControllerSdk\anycpu-release__\obj\release\net472\CbpControllerSdk.pdb source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Shared\LhcUtils\anycpu-release__\obj\release\net472\LhcUtils.pdb source: BrokerService.exe, 0000001D.00000002.1909945480.0000019491282000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\BrokerComponent\anycpu-release__\obj\release\net472\BrokerComponent.pdb source: BrokerService.exe, 0000001F.00000002.2558857309.0000025451C32000.00000002.00000001.01000000.0000004C.sdmp
Source:	Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.ValueTuple/net47\System.ValueTuple.pdb62P2 B2_CorDllMainmscoree.dll source: BrokerService.exe, 0000001F.00000002.2549401679.000002544F472000.00000002.00000001.01000000.00000036.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaSids\anycpu-release__\obj\release\net472\Citrix.Fma.Sdk.Utilities.Sids.pdb source: BrokerService.exe, 0000001F.00000002.2555275324.0000025451652000.00000002.00000001.01000000.00000046.sdmp
Source:	Binary string: Microsoft.Data.SqlClient.SNI.pdb source: Microsoft.Data.SqlClient.SNI.x64.dll.4.dr, Microsoft.Data.SqlClient.SNI.x86.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\Wpnbr\anycpu-release__\obj\release\net472\Wpnbr.pdbQ source: BrokerService.exe, 0000001D.00000002.1917130914.00000194AB772000.00000002.00000001.01000000.00000030.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\CtxAdmin\anycpu-release__\obj\release\net472\CtxAdmin.pdb source: BrokerService.exe, 0000001D.00000002.1916802918.00000194AB6C2000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.ServiceRegistration\anycpu-release__\obj\release\net472\FmaServiceCommon.ServiceRegistration.pdb source: BrokerService.exe, 0000001F.00000002.2555021751.0000025451632000.00000002.00000001.01000000.00000045.sdmp
Source:	Binary string: /_/artifacts/obj/System.Security.Permissions/Release/net462/System.Security.Permissions.pdbSHA256 source: System.Security.Permissions.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\ICwcSupport\anycpu-release__\obj\release\net472\ICwcSupport.pdbX4r4 d4_CorDllMainmscoree.dll source: ICwcSupport.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\GroupPolicy\GpAnalyzer\Analyzer\anycpu-release__\obj\release\net472\GpAnalyzer.pdbH source: GpAnalyzer.dll.4.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Rest.ClientRuntime\Release\net461\Microsoft.Rest.ClientRuntime.pdbSHA256TS- source: Microsoft.Rest.ClientRuntime.dll.4.dr
Source:	Binary string: X:\src\HelperPackages\Bootstrap\Bootstrap_CA\wh32\retail\vc80\static\bootstrap_ca.pdbH source: MSIDD31.tmp.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\XmlMultiplexer\anycpu-release__\obj\release\net472\XmlMultiplexer.pdb source: BrokerService.exe, 0000001D.00000002.1916476987.00000194AB682000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: /_/obj/src/Microsoft/SqlServer/Management/CollectorEnum/Release/net462/Microsoft.SqlServer.Management.CollectorEnum.pdb source: Microsoft.SqlServer.Management.CollectorEnum.dll.4.dr
Source:	Binary string: Microsoft.Data.SqlClient.SNI.pdbGCTL source: Microsoft.Data.SqlClient.SNI.x64.dll.4.dr, Microsoft.Data.SqlClient.SNI.x86.dll.4.dr
Source:	Binary string: T:\altsrc\github\grpc\workspace_csharp_ext_windows_x64\cmake\build\x64\grpc_csharp_ext.pdb source: grpc_csharp_ext.x64.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaRegistry.Interface\anycpu-release__\obj\release\netstandard2.0\FmaRegistry.Interface.pdbL6f6 X6_CorDllMainmscoree.dll source: BrokerService.exe, 0000001D.00000002.1910001253.0000019491292000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\CtxMcp\anycpu-release__\obj\release\net472\CtxMcp.pdb source: BrokerService.exe, 0000001D.00000002.1917548815.00000194ABA52000.00000002.00000001.01000000.00000032.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\DiscUtils\src\anycpu-release__\obj\release\net472\DiscUtils.pdb source: DiscUtils.dll4.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.VirtualSite\anycpu-release__\obj\release\net472\FmaServiceCommon.VirtualSite.pdb source: BrokerService.exe, 0000001F.00000002.2554388742.00000254515D2000.00000002.00000001.01000000.00000042.sdmp, FmaServiceCommon.VirtualSite.dll.4.dr
Source:	Binary string: c:\projects\nlog\NLog.ManualFlush\obj\Release\NLog.ManualFlush.pdb source: NLog.ManualFlush.dll.4.dr
Source:	Binary string: C:\jenkins\workspace\AuthX\Build-Custom\Build-CCAuthCpp-Master\cmake_windows_32\src\Release\ccauthcpp_dynamic.pdb source: ccauthcpp_dynamic.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaEnv\anycpu-release__\obj\release\netstandard2.0\FmaEnv.pdb source: BrokerService.exe, 0000001D.00000002.1912083012.00000194AB262000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: /_/artifacts/obj/System.Security.Principal.Windows/net461-Windows_NT-Release/System.Security.Principal.Windows.pdb source: BrokerService.exe, 0000001F.00000002.2555493326.0000025451972000.00000002.00000001.01000000.00000047.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\CDE\BrokerCdeLibrary\anycpu-release__\obj\release\net472\BrokerCdeLibrary.pdb source: BrokerService.exe, 0000001D.00000002.1909749981.0000019491232000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: /_/artifacts/obj/System.ServiceProcess.ServiceController/Release/net462/System.ServiceProcess.ServiceController.pdbSHA256) source: BrokerService.exe, 0000001D.00000002.1912129198.00000194AB272000.00000002.00000001.01000000.00000013.sdmp, System.ServiceProcess.ServiceController.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\SDK\BrokerAdminService\anycpu-release__\obj\release\net472\BrokerAdminService.pdb source: BrokerAdminService.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\RemoteHCLClient\anycpu-release__\obj\release\net472\RemoteHCLClient.pdb source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp
Source:	Binary string: Citrix.Networking.WebSocket.pdb.7818E375_CB2C_4E80_99E7_4C40D0D5718B source: Broker_Service_x64.msi
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\distributed_tracing\exporter\newrelic\anycpu-release__\obj\release\net472\Citrix.Xaxd.DistributedTracing.Exporter.NewRelic.pdb source: Citrix.Xaxd.DistributedTracing.Exporter.NewRelic.dll.4.dr
Source:	Binary string: /_/artifacts/obj/System.Security.Principal.Windows/net461-Windows_NT-Release/System.Security.Principal.Windows.pdbSHA256zqXL source: BrokerService.exe, 0000001F.00000002.2555493326.0000025451972000.00000002.00000001.01000000.00000047.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.KeySharingInterfaces\anycpu-release__\obj\release\net472\Citrix.Fma.Sdk.ServiceCommon.KeySharingInterfaces.pdb source: Citrix.Fma.Sdk.ServiceCommon.KeySharingInterfaces.dll.4.dr
Source:	Binary string: C:\jenkins\workspace\CitrixCloud\Build\Src\Logging\obj\Release\netstandard2.0\Citrix.CloudServices.Logging.pdb source: Citrix.CloudServices.Logging.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaRegistry.Interface\anycpu-release__\obj\release\netstandard2.0\FmaRegistry.Interface.pdb source: BrokerService.exe, 0000001D.00000002.1910001253.0000019491292000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\DistributedTracing\anycpu-release__\obj\release\netstandard2.0\Citrix.Fma.Sdk.DistributedTracing.pdb source: BrokerService.exe, 0000001D.00000002.1914666070.00000194AB422000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\DAL\IBrokerDAL\anycpu-release__\obj\release\net472\IBrokerDAL.pdb source: IBrokerDAL.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.ManagedMachineAPI\anycpu-release__\obj\release\net472\Citrix.ManagedMachineAPI.pdb source: BrokerService.exe, 0000001F.00000002.2553794425.0000025450D72000.00000002.00000001.01000000.0000003E.sdmp
Source:	Binary string: D:\a\_work\1\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb source: System.Memory.dll0.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\ICwcSupport\anycpu-release__\obj\release\net472\ICwcSupport.pdb source: ICwcSupport.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaEventLog\anycpu-release__\obj\release\net472\FmaEventLog.pdb< source: BrokerService.exe, 0000001F.00000002.2553006670.00000254506D2000.00000002.00000001.01000000.00000038.sdmp
Source:	Binary string: C:\workspace-analytics\workspace-analytics\Output\AnyCPU\Citrix.WorkspaceAnalytics.CasInterfaces\obj\Debug\Citrix.WorkspaceAnalytics.CasInterfaces.pdb source: Citrix.WorkspaceAnalytics.CasInterfaces.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\ActiveDirectory\FmaActiveDirectory\anycpu-release__\obj\release\netstandard2.0\FmaActiveDirectory.pdb.y source: BrokerService.exe, 0000001F.00000002.2556875287.0000025451A92000.00000002.00000001.01000000.0000004A.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Shared\VirtualSites\anycpu-release__\obj\release\net472\VirtualSites.pdb source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\SDK\BrokerSDKDefinition\anycpu-release__\obj\release\netstandard2.0\BrokerSDKDefinition.pdb source: BrokerService.exe, 0000001F.00000002.2556016980.00000254519F2000.00000002.00000001.01000000.00000049.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\utils\events\anycpu-release__\obj\release\netstandard2.0\Citrix.Xaxd.Utils.Events.pdb source: BrokerService.exe, 0000001F.00000002.2553584343.0000025450D52000.00000002.00000001.01000000.0000003C.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Win32.Registry/net461-Windows_NT-Release/Microsoft.Win32.Registry.pdb source: BrokerService.exe, 0000001D.00000002.1912963441.00000194AB382000.00000002.00000001.01000000.00000014.sdmp, Microsoft.Win32.Registry.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaTransactionScope\anycpu-release__\obj\release\netstandard2.0\FmaTransactionScope.pdb source: BrokerService.exe, 0000001D.00000002.1913930609.00000194AB3E2000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.PluginRegistrationTool\anycpu-release__\obj\release\net472\RegisterPlugins.pdb source: RegisterPlugins.exe, 00000022.00000000.1925697735.000002B30D5F2000.00000002.00000001.01000000.00000035.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\hostname\interfaces\anycpu-release__\obj\release\netstandard2.0\Citrix.Xaxd.Hostname.Interfaces.pdb9,S, E,_CorDllMainmscoree.dll source: Citrix.Xaxd.Hostname.Interfaces.dll.4.dr
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.Logging.Abstractions/Release/net462/Microsoft.Extensions.Logging.Abstractions.pdbSHA256 source: BrokerService.exe, 0000001D.00000002.1914867354.00000194AB442000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\WorkerChannelFactoryLoader\anycpu-release__\obj\release\net472\WorkerChannelFactoryLoader.pdb source: BrokerService.exe, 0000001F.00000002.2553979605.0000025450D82000.00000002.00000001.01000000.0000003F.sdmp
Source:	Binary string: /_/obj/src/Microsoft/SqlServer/Management/CollectorEnum/Release/net462/Microsoft.SqlServer.Management.CollectorEnum.pdb@aZa La_CorDllMainmscoree.dll source: Microsoft.SqlServer.Management.CollectorEnum.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.VirtualSite.Interface\anycpu-release__\obj\release\netstandard2.0\FmaServiceCommon.VirtualSite.Interface.pdb~1 source: BrokerService.exe, 0000001D.00000002.1913698768.00000194AB3D2000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.HCL.DistributedTracing\anycpu-release__\obj\release\net472\Citrix.HCL.DistributedTracing.pdb source: Citrix.HCL.DistributedTracing.dll0.4.dr
Source:	Binary string: /_/artifacts/obj/System.Diagnostics.DiagnosticSource/Release/net462/System.Diagnostics.DiagnosticSource.pdbSHA256h source: BrokerService.exe, 0000001D.00000002.1915939180.00000194AB572000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaInterServiceClients\Runtime\FmaInterServiceManager.Interface\anycpu-release__\obj\release\net472\FmaInterServiceManager.Interface.pdb source: BrokerService.exe, 0000001D.00000002.1914986331.00000194AB462000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\XmsInterfaces\anycpu-release__\obj\release\net472\XmsInterfaces.pdb source: BrokerService.exe, 0000001D.00000002.1916621102.00000194AB692000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.VirtualSiteManager\anycpu-release__\obj\release\net472\FmaServiceCommon.VirtualSiteManager.pdb source: BrokerService.exe, 0000001F.00000002.2554213094.00000254515C2000.00000002.00000001.01000000.00000041.sdmp
Source:	Binary string: Citrix.Networking.WebSocket.pdb.7818E375_CB2C_4E80_99E7_4C40D0D5718BHF source: Broker_Service_x64.msi
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\RegistryCounters\anycpu-release__\obj\release\net472\RegistryCounters.pdb source: BrokerService.exe, 0000001D.00000002.1916301428.00000194AB672000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaSqlUtils\anycpu-release__\obj\release\netstandard2.0\FmaSqlUtils.pdb source: FmaSqlUtils.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaPlugin\anycpu-release__\obj\release\netstandard2.0\FmaPlugin.pdb source: BrokerService.exe, 0000001F.00000002.2553466258.0000025450CB2000.00000002.00000001.01000000.0000003B.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.VirtualSite.Interface\anycpu-release__\obj\release\netstandard2.0\FmaServiceCommon.VirtualSite.Interface.pdb source: BrokerService.exe, 0000001D.00000002.1913698768.00000194AB3D2000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.ValueTuple/net47\System.ValueTuple.pdb source: BrokerService.exe, 0000001F.00000002.2549401679.000002544F472000.00000002.00000001.01000000.00000036.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\DiscUtils\src\anycpu-release__\obj\release\net472\DiscUtils.pdb8> source: DiscUtils.dll4.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaUtils\anycpu-release__\obj\release\net472\FmaUtils.pdbb source: BrokerService.exe, 0000001D.00000002.1909451331.00000194911C2000.00000002.00000001.01000000.00000009.sdmp, FMAUtils.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaEnv\anycpu-release__\obj\release\netstandard2.0\FmaEnv.pdb28L8 >8_CorDllMainmscoree.dll source: BrokerService.exe, 0000001D.00000002.1912083012.00000194AB262000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\ActiveDirectory\FmaActiveDirectory\anycpu-release__\obj\release\netstandard2.0\FmaActiveDirectory.pdb source: BrokerService.exe, 0000001F.00000002.2556875287.0000025451A92000.00000002.00000001.01000000.0000004A.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.HypervisorCommunicationsLibrary\anycpu-release__\obj\release\net472\Citrix.HypervisorCommunicationsLibrary.pdb source: Citrix.HypervisorCommunicationsLibrary.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Libraries\FmaCommandQueues\CasCommandQueuePayload\anycpu-release__\obj\release\netstandard2.0\Citrix.Broker.CasCommandQueuePayload.pdbB5\5 N5_CorDllMainmscoree.dll source: Citrix.Broker.CasCommandQueuePayload.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaFeature\anycpu-release__\obj\release\netstandard2.0\FmaFeature.pdb source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Bcl.HashCode/net461-Release/Microsoft.Bcl.HashCode.pdb source: Microsoft.Bcl.HashCode.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.ManagedMachineAPI\anycpu-release__\obj\release\net472\Citrix.ManagedMachineAPI.pdb> source: BrokerService.exe, 0000001F.00000002.2553794425.0000025450D72000.00000002.00000001.01000000.0000003E.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\logging\cdf_net\core\anycpu-release__\obj\release\net472\Citrix.Xaxd.Cdf.Net.pdb source: BrokerService.exe, 0000001D.00000002.1909850188.0000019491242000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\ProxyCommon\anycpu-release__\obj\release\net472\ProxyCommon.pdb$ source: BrokerService.exe, 0000001D.00000002.1917667880.00000194ABA92000.00000002.00000001.01000000.00000033.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaRegistry\anycpu-release__\obj\release\netstandard2.0\FmaRegistry.pdb source: BrokerService.exe, 0000001D.00000002.1909555493.00000194911E2000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaEventLog\anycpu-release__\obj\release\net472\FmaEventLog.pdb source: BrokerService.exe, 0000001F.00000002.2553006670.00000254506D2000.00000002.00000001.01000000.00000038.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\IDnsIpSupport\anycpu-release__\obj\release\net472\IDnsIpSupport.pdb source: IDnsIpSupport.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\utils\windows\anycpu-release__\obj\release\net472\Citrix.Xaxd.Utils.Windows.pdb source: Citrix.Xaxd.Utils.Windows.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\utils\strings\anycpu-release__\obj\release\netstandard2.0\Citrix.Xaxd.Utils.Strings.pdb source: BrokerService.exe, 0000001D.00000002.1913390576.00000194AB3C2000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaInterServiceClients\Runtime\FmaInterServiceManager\anycpu-release__\obj\release\net472\FmaInterServiceManager.pdb source: BrokerService.exe, 0000001D.00000002.1915578302.00000194AB522000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: /_/artifacts/obj/System.Security.Permissions/Release/net462/System.Security.Permissions.pdb source: System.Security.Permissions.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Libraries\FmaCommandQueues\CasCommandQueuePayload\anycpu-release__\obj\release\netstandard2.0\Citrix.Broker.CasCommandQueuePayload.pdb source: Citrix.Broker.CasCommandQueuePayload.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaDal\Runtime\FmaDalRuntime\anycpu-release__\obj\release\netstandard2.0\FmaDalRuntime.pdb source: BrokerService.exe, 0000001D.00000002.1915242829.00000194AB4C2000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaLogging\anycpu-release__\obj\release\net472\FmaLogging.pdb source: BrokerService.exe, 0000001D.00000002.1911974174.00000194AB232000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaInterServiceClients\Runtime\FmaInterServiceManager.Models\anycpu-release__\obj\release\netstandard2.0\FmaInterServiceManager.Models.pdb source: BrokerService.exe, 0000001D.00000002.1915395701.00000194AB4F2000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: /_/artifacts/obj/System.ServiceProcess.ServiceController/Release/net462/System.ServiceProcess.ServiceController.pdb source: BrokerService.exe, 0000001D.00000002.1912129198.00000194AB272000.00000002.00000001.01000000.00000013.sdmp, System.ServiceProcess.ServiceController.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\CtxSta\anycpu-release__\obj\release\net472\CtxSta.pdbK source: BrokerService.exe, 0000001D.00000002.1916882745.00000194AB6D2000.00000002.00000001.01000000.0000002D.sdmp, CtxSta.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaWcf\anycpu-release__\obj\release\net472\FmaWcf.pdb source: BrokerService.exe, 0000001F.00000002.2552865039.00000254506C2000.00000002.00000001.01000000.00000037.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdbSHA256 source: Microsoft.Bcl.AsyncInterfaces.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\ActiveDirectory\FmaActiveDirectory.Interfaces\anycpu-release__\obj\release\netstandard2.0\FmaActiveDirectory.Interfaces.pdb source: BrokerService.exe, 0000001F.00000002.2554565821.00000254515E2000.00000002.00000001.01000000.00000043.sdmp
Source:	Binary string: /_/obj/src/Microsoft/SqlServer/Management/RegisteredServers/Release/net462/Microsoft.SqlServer.Management.RegisteredServers.pdb source: Microsoft.SqlServer.Management.RegisteredServers.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.HypervisorCommunicationsLibrary.Wcf\anycpu-release__\obj\release\net472\Citrix.HypervisorCommunicationsLibrary.Wcf.pdbnD source: Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr
Source:	Binary string: C:\jenkins\workspace\CitrixCloud\Build\Src\Logging\obj\Release\netstandard2.0\Citrix.CloudServices.Logging.pdbSHA256 source: Citrix.CloudServices.Logging.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\GroupPolicy\GpAnalyzer\Analyzer\anycpu-release__\obj\release\net472\GpAnalyzer.pdb source: GpAnalyzer.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\Licensing\anycpu-release__\obj\release\net472\Licensing.pdb source: BrokerService.exe, 0000001D.00000002.1916686247.00000194AB6A2000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: C:\Jenkins\workspace\CitrixCloud\Build\Src\AgentFoundation\Common\obj\Release\netstandard2.0\Citrix.CloudServices.AgentFoundation.Common.pdb source: Citrix.CloudServices.AgentFoundation.Common.dll.4.dr
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.Logging/Release/net462/Microsoft.Extensions.Logging.pdbSHA256kYf source: Microsoft.Extensions.Logging.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\logging\cdf_sharp\win\anycpu-release__\obj\release\net472\Citrix.Diagnostics.Tracing.pdb~ source: BrokerService.exe, 0000001D.00000002.1915055457.00000194AB472000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\ProxyCommon\anycpu-release__\obj\release\net472\ProxyCommon.pdb source: BrokerService.exe, 0000001D.00000002.1917667880.00000194ABA92000.00000002.00000001.01000000.00000033.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\BrokerComponentCommon\anycpu-release__\obj\release\net472\BrokerComponentCommon.pdb source: BrokerService.exe, 0000001D.00000002.1917029887.00000194AB6F2000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.Logging.Abstractions/Release/net462/Microsoft.Extensions.Logging.Abstractions.pdb source: BrokerService.exe, 0000001D.00000002.1914867354.00000194AB442000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\HostingManagement\HostingManagementComponent\anycpu-release__\obj\release\net472\HostingManagementComponent.pdb source: BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.HypervisorCommunicationsLibrary.HostView\anycpu-release__\obj\release\net472\Citrix.HypervisorCommunicationsLibrary.HostView.pdb source: Citrix.HypervisorCommunicationsLibrary.HostView.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaUtils\anycpu-release__\obj\release\net472\FmaUtils.pdb source: BrokerService.exe, 0000001D.00000002.1909451331.00000194911C2000.00000002.00000001.01000000.00000009.sdmp, FMAUtils.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\UrlAclSupport\anycpu-release__\obj\release\net472\UrlAclSupport.pdb source: BrokerService.exe, 0000001D.00000002.1916166886.00000194AB642000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\authentication\interfaces\anycpu-release__\obj\release\net472\Citrix.Xaxd.Authentication.Interfaces.pdb source: BrokerService.exe, 0000001D.00000002.1915326873.00000194AB4E2000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaInterServiceClients\Runtime\FmaInterServiceManager.Models\anycpu-release__\obj\release\netstandard2.0\FmaInterServiceManager.Models.pdb"Y<Y .Y_CorDllMainmscoree.dll source: BrokerService.exe, 0000001D.00000002.1915395701.00000194AB4F2000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.Settings\anycpu-release__\obj\release\net472\FmaServiceCommon.Settings.pdb source: BrokerService.exe, 0000001D.00000002.1914580532.00000194AB402000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.HCL.DistributedTracing\anycpu-release__\obj\release\net472\Citrix.HCL.DistributedTracing.pdbXCrC dC_CorDllMainmscoree.dll source: Citrix.HCL.DistributedTracing.dll0.4.dr
Source:	Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb source: System.Numerics.Vectors.dll0.4.dr
Source:	Binary string: /_/artifacts/obj/System.Configuration.ConfigurationManager/Release/net462/System.Configuration.ConfigurationManager.pdbSHA256 source: BrokerService.exe, 0000001D.00000002.1913217539.00000194AB3A2000.00000002.00000001.01000000.00000015.sdmp, System.Configuration.ConfigurationManager.dll0.4.dr, System.Configuration.ConfigurationManager.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Shared\VirtualSites\anycpu-release__\obj\release\net472\VirtualSites.pdb: source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\XmsRuntime\anycpu-release__\obj\release\net472\XmsRuntime.pdb source: BrokerService.exe, 0000001D.00000002.1916960617.00000194AB6E2000.00000002.00000001.01000000.0000002E.sdmp
Source:	Binary string: /_/artifacts/obj/System.Diagnostics.DiagnosticSource/Release/net462/System.Diagnostics.DiagnosticSource.pdb source: BrokerService.exe, 0000001D.00000002.1915939180.00000194AB572000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdb source: Microsoft.Bcl.AsyncInterfaces.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\utils\date_time\anycpu-release__\obj\release\netstandard2.0\Citrix.Xaxd.Utils.DateTime.pdb source: BrokerService.exe, 0000001F.00000002.2553129762.0000025450BE2000.00000002.00000001.01000000.00000039.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\CtxSta\anycpu-release__\obj\release\net472\CtxSta.pdb source: BrokerService.exe, 0000001D.00000002.1916882745.00000194AB6D2000.00000002.00000001.01000000.0000002D.sdmp, CtxSta.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.VirtualSiteManager\anycpu-release__\obj\release\net472\FmaServiceCommon.VirtualSiteManager.pdb< source: BrokerService.exe, 0000001F.00000002.2554213094.00000254515C2000.00000002.00000001.01000000.00000041.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\TicketStore\TicketStore\anycpu-release__\obj\release\net472\TicketStore.pdb source: BrokerService.exe, 0000001F.00000002.2553679495.0000025450D62000.00000002.00000001.01000000.0000003D.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\hostname\interfaces\anycpu-release__\obj\release\netstandard2.0\Citrix.Xaxd.Hostname.Interfaces.pdb source: Citrix.Xaxd.Hostname.Interfaces.dll.4.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Rest.ClientRuntime\Release\net461\Microsoft.Rest.ClientRuntime.pdb source: Microsoft.Rest.ClientRuntime.dll.4.dr
Source:	Binary string: /_/artifacts/obj/System.Configuration.ConfigurationManager/Release/net462/System.Configuration.ConfigurationManager.pdb source: BrokerService.exe, 0000001D.00000002.1913217539.00000194AB3A2000.00000002.00000001.01000000.00000015.sdmp, System.Configuration.ConfigurationManager.dll0.4.dr, System.Configuration.ConfigurationManager.dll.4.dr
Source:	Binary string: C:\Jenkins\workspace\CitrixCloud\Build\Src\AgentFoundation\Common\obj\Release\netstandard2.0\Citrix.CloudServices.AgentFoundation.Common.pdbI source: Citrix.CloudServices.AgentFoundation.Common.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\distributed_tracing\core\anycpu-release__\obj\release\net472\Citrix.Xaxd.DistributedTracing.pdb source: BrokerService.exe, 0000001D.00000002.1915459492.00000194AB502000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaCommandLine\anycpu-release__\obj\release\netstandard2.0\FmaCommandLine.pdb source: BrokerService.exe, 0000001D.00000002.1915842117.00000194AB562000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaCommandLine\anycpu-release__\obj\release\netstandard2.0\FmaCommandLine.pdbv\ source: BrokerService.exe, 0000001D.00000002.1915842117.00000194AB562000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\BrokerComponentCommon\anycpu-release__\obj\release\net472\BrokerComponentCommon.pdbp source: BrokerService.exe, 0000001D.00000002.1917029887.00000194AB6F2000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.Logging/Release/net462/Microsoft.Extensions.Logging.pdb source: Microsoft.Extensions.Logging.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\Wpnbr\anycpu-release__\obj\release\net472\Wpnbr.pdb source: BrokerService.exe, 0000001D.00000002.1917130914.00000194AB772000.00000002.00000001.01000000.00000030.sdmp
Source:	Binary string: X:\src\HelperPackages\Bootstrap\Bootstrap_CA\wh32\retail\vc80\static\bootstrap_ca.pdb source: MSIDD31.tmp.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Shared\EventLog\anycpu-release__\obj\release\net472\EventLog.pdb source: BrokerService.exe, 0000001D.00000002.1917745850.00000194ABAD2000.00000002.00000001.01000000.00000034.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaDal\Runtime\SiteServices\FmaSiteServices\anycpu-release__\obj\release\netstandard2.0\FmaSiteServices.pdb source: BrokerService.exe, 0000001F.00000002.2554068226.0000025450DF2000.00000002.00000001.01000000.00000040.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\distributed_tracing\core\anycpu-release__\obj\release\net472\Citrix.Xaxd.DistributedTracing.pdb} source: BrokerService.exe, 0000001D.00000002.1915459492.00000194AB502000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaLogging\anycpu-release__\obj\release\net472\FmaLogging.pdb: source: BrokerService.exe, 0000001D.00000002.1911974174.00000194AB232000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Win32.Registry/net461-Windows_NT-Release/Microsoft.Win32.Registry.pdbSHA256 source: BrokerService.exe, 0000001D.00000002.1912963441.00000194AB382000.00000002.00000001.01000000.00000014.sdmp, Microsoft.Win32.Registry.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.HypervisorCommunicationsLibrary.Wcf\anycpu-release__\obj\release\net472\Citrix.HypervisorCommunicationsLibrary.Wcf.pdb source: Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Controller\ControllerService\x64-release__\obj\x64\release\net472\BrokerService.pdb source: BrokerService.exe, 0000001D.00000000.1835935201.0000019490E52000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaDependencyInjection\anycpu-release__\obj\release\netstandard2.0\FmaDependencyInjection.pdb source: BrokerService.exe, 0000001D.00000002.1915775374.00000194AB542000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaDal\Runtime\SiteServices\FmaSiteServices\anycpu-release__\obj\release\netstandard2.0\FmaSiteServices.pdb' source: BrokerService.exe, 0000001F.00000002.2554068226.0000025450DF2000.00000002.00000001.01000000.00000040.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaTransactionScope\anycpu-release__\obj\release\netstandard2.0\FmaTransactionScope.pdb(/B/ 4/_CorDllMainmscoree.dll source: BrokerService.exe, 0000001D.00000002.1913930609.00000194AB3E2000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Shared\Settings\anycpu-release__\obj\release\net472\Settings.pdb source: BrokerService.exe, 0000001F.00000002.2553217176.0000025450C32000.00000002.00000001.01000000.0000003A.sdmp, Settings.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Controller\ComponentInterface\anycpu-release__\obj\release\net472\ComponentInterface.pdb source: BrokerService.exe, 0000001D.00000002.1909653018.0000019491202000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Plugins\HypervisorsCommon\anycpu-release__\obj\release\net472\HypervisorsCommon.pdb source: HypervisorsCommon.dll0.4.dr

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: d:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Networking

Yara detected Generic Downloader

Source: Yara match	File source: C:\Program Files\Citrix\Broker\Service\RestSharp.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\Citrix\Broker\Service\System.Management.Automation.dll, type: DROPPED

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: _ldap._tcp.
Source: global traffic	DNS traffic detected: DNS query: _ldap._tcp.
Source: global traffic	DNS traffic detected: DNS query: _ldap._tcp.

Source: BrokerService.exe, 0000001F.00000002.2552865039.00000254506C2000.00000002.00000001.01000000.00000037.sdmp	String found in binary or memory: http://citrix.poshsdk.namespace/
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp, IDnsIpSupport.dll.4.dr	String found in binary or memory: http://schemas.citrix.com/CBP
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IConfiguration/SetFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IConfiguration/SetResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IConfiguration/SetResponses
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IConfiguration/SetT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useAddressHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useAddressHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useCancelLaunchReplyHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useCancelLaunchReplyHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useCancelLaunchRequestHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useCancelLaunchRequestHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useFaultHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useFaultHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useForwardCallToRootOfTrustResultHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useForwardCallToRootOfTrustResultHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useGetReplyHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useGetReplyHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useGetRequestHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useGetRequestHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useIntuneMetadataResultHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useIntuneMetadataResultHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useLogonRequest2HelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useLogonRequestHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useLogonRequestHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useNotifyBrokerReplyHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useNotifyBrokerReplyHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useNotifyReplyHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useNotifyReplyHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useNotifyRequestHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useNotifyRequestHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/usePolicyDefinitionHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/usePolicyDefinitionHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/usePrepareAppReplyHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/usePrepareAppReplyHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/usePrepareAppRequestHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/usePrepareAppRequestHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/usePrepareReplyHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/usePrepareReplyHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/usePrepareRequestHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/usePrepareRequestHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useProtocolSettingsHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useProtocolSettingsHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useQueryExpressionHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useQueryExpressionHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useRendezvousReplyHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useRendezvousReplyHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useRendezvousRequestHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useRendezvousRequestHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useReservationTokenHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useReservationTokenHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useResourceDetailsHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useResourceDetailsHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useReversePrepareSessionResultHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useReversePrepareSessionResultHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useReverseSeamlessAppHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useReverseSeamlessAppHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useReverseSeamlessAppListHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useReverseSeamlessAppListHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useRoTPublicKeysHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useRoTPublicKeysHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useServiceDetailsResultHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useServiceDetailsResultHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useSessionApplicationHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useSessionApplicationHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useSetRequestHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useSetRequestHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useSiteInformationHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useSiteInformationHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useWorkerSettingsHelperResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDummyInterface/useWorkerSettingsHelperT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDynamicDataQuery/GetFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDynamicDataQuery/GetResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDynamicDataQuery/GetResponsev
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IDynamicDataQuery/GetT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/CancelLaunchFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/CancelLaunchResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/CancelLaunchResponseu
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/CancelLaunchT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/PrepareAppSessionFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/PrepareAppSessionResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/PrepareAppSessionResponsez
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/PrepareAppSessionT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/PrepareRendezvousSessionFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/PrepareRendezvousSessionResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/PrepareRendezvousSessionT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/PrepareSessionFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/PrepareSessionResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/PrepareSessionResponsew
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ILaunch/PrepareSessionT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllFtasFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllFtasResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllFtasResponsey
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllFtasT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllSessions2FaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllSessions2Response
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllSessions2Response~
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllSessions2T
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllSessionsFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllSessionsResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllSessionsT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllStartMenuShortcutsFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllStartMenuShortcutsResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryAllStartMenuShortcutsT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryStartMenuShortcutIconFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryStartMenuShortcutIconResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryStartMenuShortcutIconT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryUsersFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryUsersResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryUsersResponsew
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/QueryUsersT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/TestFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/TestResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/TestResponseq
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IQueryAgent/TestT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IServiceDetailsManager/GetServiceDetailsFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IServiceDetailsManager/GetServiceDetailsResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/IServiceDetailsManager/GetServiceDetailsT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/DisconnectFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/DisconnectResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/DisconnectT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/ExecuteCommandsFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/ExecuteCommandsResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/ExecuteCommandsT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/GetRecordingStatusFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/GetRecordingStatusResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/GetRecordingStatusT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/LogOffFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/LogOffResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/LogOffResponsew
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/LogOffT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/ReRegisterNowFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/ReRegisterNowResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/ReRegisterNowResponse~
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/ReRegisterNowT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/RebootFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/RebootResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/RebootResponsew
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/RebootT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/SendMessageFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/SendMessageResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/SendMessageT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/StartRecordingFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/StartRecordingResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/StartRecordingT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/StopRecordingFaultFaultT
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/StopRecordingResponse
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/StopRecordingResponse~
Source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://schemas.citrix.com/CBP/ISessionManager/StopRecordingT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.ADIdentity.DataModel
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.ADIdentity.DataModelf
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.ADIdentity.DataModell
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.ADIdentity.DataModelm
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.ADIdentity.DataModelp
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.ADIdentity.DataModelu
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AdIdentity.Definitions
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AdIdentity.Definitionse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AdIdentity.Definitionsf
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AdIdentity.Definitionsm
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AdIdentity.Definitionsp
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AdIdentity.Definitionst
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AdIdentity.Definitionsu
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AdIdentity.Definitionsz
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AppLibrary.DataModel
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AppLibrary.DataModela
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AppLibrary.DataModele
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AppLibrary.DataModeli
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AppLibrary.DataModelq
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.AppLibrary.DataModelv
Source: BrokerService.exe, 0000001F.00000002.2558857309.0000025451C32000.00000002.00000001.01000000.0000004C.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Cds.BrokerU
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.CloudServices.Trust.Api.Modelsi
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.DelegatedAdmin.Logick
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Fma.Sdk.ServiceCore_
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Fma.Sdk.ServiceCoreg
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Fma.Sdk.ServiceCorer
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Host.DataModel
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Host.DataModelY
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Host.DataModel_
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Host.DataModela
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Host.DataModeld
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Host.DataModelf
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Host.DataModelg
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Host.DataModelr
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Host.DataModels
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Host.DataModelu
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Host.DataModelx
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.HypervisorCommunicationsLibrary.Wcf.Types
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.HypervisorCommunicationsLibrary.Wcf.TypesN
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.HypervisorCommunicationsLibrary.Wcf.Typesb
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.HypervisorCommunicationsLibrary.Wcf.Typesm
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.HypervisorCommunicationsLibrary.Wcf.Typeso
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.HypervisorCommunicationsLibrary.Wcf.Typesq
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.HypervisorCommunicationsLibrary.Wcf.Typess
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.HypervisorCommunicationsLibrary.Wcf.Typesu
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.HypervisorCommunicationsLibrary.Wcf.Typesw
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.HypervisorCommunicationsLibrary.Wcf.Typesy
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.DataModel
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.DataModeli
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.DataModell
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.DataModeln
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.DataModelr
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.DataModelu
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.DataModelv
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.DataModelx
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.DataModelz
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.Definitions
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.Definitionsc
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.Definitionsm
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.Definitionst
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.Definitionsv
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.MachineCreation.Definitionsx
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Trust.DataModelW
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Trust.DataModela
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Trust.Logic
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Trust.LogicX
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.Trust.Logicw
Source: BrokerService.exe, 0000001D.00000002.1915395701.00000194AB4F2000.00000002.00000001.01000000.00000021.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.XDInterServiceTypes
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.XDInterServiceTypesf
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Citrix.XDInterServiceTypeso
Source: BrokerService.exe, 0000001F.00000002.2558857309.0000025451C32000.00000002.00000001.01000000.0000004C.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/System
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/System.Workflow.Runtime
Source: wevtutil.exe, 00000014.00000003.1791925447.0000027FB5F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.m
Source: BrokerService.exe, 0000001D.00000002.1910073183.0000019492A61000.00000004.00000800.00020000.00000000.sdmp, BrokerService.exe, 0000001D.00000002.1910073183.0000019492F6E000.00000004.00000800.00020000.00000000.sdmp, BrokerService.exe, 0000001F.00000002.2547476641.0000025304A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: svchost.exe, 0000000A.00000002.2538923261.00000196A3C87000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2539402260.00000196A4502000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://standards.iso.org/iso/19770/-2/2009/schema.xsd
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IADIdentityApi/GetIdentityByNameResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IADIdentityApi/GetIdentityByNameT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IADIdentityApi/GetIdentityBySidResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IADIdentityApi/GetIdentityBySidT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IADIdentityApi/GetIdentityContentInIdentityPoolByIdResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IADIdentityApi/GetIdentityContentInIdentityPoolByIdT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IADIdentityApi/GetIdentityContentInIdentityPoolByNameResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IADIdentityApi/GetIdentityContentInIdentityPoolByNameT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IADIdentityApi/GetIdentityPoolByIdResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IADIdentityApi/GetIdentityPoolByIdT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IADIdentityApi/GetIdentityPoolByNameResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IADIdentityApi/GetIdentityPoolByNameT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IADIdentityApi/GetUserCertExpirationDateResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IADIdentityApi/GetUserCertExpirationDateT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IADIdentityApi/SetLockStateForADAccountResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IADIdentityApi/SetLockStateForADAccountT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IADIdentityApi/SetServiceAccountHealthStatusByUidResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IADIdentityApi/SetServiceAccountHealthStatusByUidT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IADIdentityApi/TaintADAccountResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IADIdentityApi/TaintADAccountT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IADIdentityApi/ValidateAndLockIdentitiesForPoolBySidResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IADIdentityApi/ValidateAndLockIdentitiesForPoolBySidT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IADIdentityApi/ValidateAndLockIdentitiesForPoolResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IADIdentityApi/ValidateAndLockIdentitiesForPoolT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IAppLibApi/FetchAppVTelemetryResponse&
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IAppLibApi/FetchAppVTelemetryT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IAppLibApi/GetObjectsFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IAppLibApi/GetObjectsResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IAppLibApi/GetObjectsT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApi/DummyOperationResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApi/DummyOperationT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV1/CheckGlobalAccessResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV1/CheckGlobalAccessT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV1/CheckScopeAccessMultipleResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV1/CheckScopeAccessMultipleT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV1/CheckScopeAccessResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV1/CheckScopeAccessT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV1/LookupScopeResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV1/LookupScopeT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV1/RetrieveScopesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV1/RetrieveScopesT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV2/CheckGlobalAccessUsingBearerTokenResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV2/CheckGlobalAccessUsingBearerTokenT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV2/CheckScopeAccessMultipleUsingBearerTokenResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV2/CheckScopeAccessMultipleUsingBearerTokenT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV2/CheckScopeAccessUsingBearerTokenResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV2/CheckScopeAccessUsingBearerTokenT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV3/GetCloudAdminDetailsAsDictionaryResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV3/GetCloudAdminDetailsAsDictionaryT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV3/GetUserAdminTypeResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV3/GetUserAdminTypeT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV3/GetUserAdminTypeWithBearerTokenResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV3/GetUserAdminTypeWithBearerTokenT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV4/CheckScopeAccessMultipleUsingBearerTokenWithExcludedResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV4/CheckScopeAccessMultipleUsingBearerTokenWithExcludedT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV4/CheckScopeAccessMultipleWithExcludedResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV4/CheckScopeAccessMultipleWithExcludedT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV4/CheckScopeAccessUsingBearerTokenWithExcludedResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV4/CheckScopeAccessUsingBearerTokenWithExcludedT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV4/CheckScopeAccessWithExcludedResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IDelegatedAdminApiV4/CheckScopeAccessWithExcludedT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetDefinedFeaturesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetDefinedFeaturesT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetEnabledFeaturesForConfigurationResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetEnabledFeaturesForConfigurationT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetEnabledFeaturesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetEnabledFeaturesT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetLicenseInfoResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetLicenseInfoT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetLicenseServerDetailsResponseu
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetLicenseServerDetailsT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetSiteInfoResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetSiteInfoT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetValidProductAndModelsResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IFeatureChecksApi/GetValidProductAndModelsT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IFeatureChecksApi/IsFeatureDefinedResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IFeatureChecksApi/IsFeatureDefinedT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IFeatureChecksApi/IsFeatureEnabledResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IFeatureChecksApi/IsFeatureEnabledT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IFeatureChecksApi/UpdateSiteLicenseSaaSEnabledResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IFeatureChecksApi/UpdateSiteLicenseSaaSEnabledT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IFeatureChecksApi/ZoneExistsResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IFeatureChecksApi/ZoneExistsT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/AddPvsCollectionResponseu
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/AddPvsCollectionT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/AddPvsDeviceResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/AddPvsDeviceT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/AddVolumeServiceBootstrappedTemplateResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/AddVolumeServiceBootstrappedTemplateT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/ConfirmPvsCollectionNameAvailableResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/ConfirmPvsCollectionNameAvailableT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/DeletePvsCollectionResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/DeletePvsCollectionT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/DeletePvsDeviceResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/DeletePvsDeviceT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/GetHostingUnitByIdResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/GetHostingUnitByIdT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/GetHostingUnitByNameResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/GetHostingUnitByNameT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/GetHostingUnitsAllResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/GetHostingUnitsAllT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/GetHypervisorConnectionByIdResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/GetHypervisorConnectionByIdT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/GetHypervisorConnectionRevByIdResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/GetHypervisorConnectionRevByIdT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/GetHypervisorConnectionsAllResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/GetHypervisorConnectionsAllT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/GetPvsDiskInfoByIdResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/GetPvsDiskInfoByIdT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/GetPvsServersBySiteIdResponsey
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/GetPvsServersBySiteIdT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/GetPvsSiteByIdResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/GetPvsSiteByIdT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/GetVolumeServiceBootstrappedTemplatesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/GetVolumeServiceBootstrappedTemplatesT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/IsZoneEmptyResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/IsZoneEmptyT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/MoveResourcesToNewZoneResponses
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/MoveResourcesToNewZoneT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/RemoveVolumeServiceBootstrappedTemplateResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/RemoveVolumeServiceBootstrappedTemplateT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/SetHypervisorConnectionMetadataResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IHostApi/SetHypervisorConnectionMetadataT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/BeginVirtualMachinePowerStateChangesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/BeginVirtualMachinePowerStateChangesT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/BeginVirtualMachineStateChangesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/BeginVirtualMachineStateChangesT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/CheckResetVirtualMachineOperationsResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/CheckResetVirtualMachineOperationsT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/CheckResetVmOperationsResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/CheckResetVmOperationsT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/CheckVirtualMachinePowerActionsResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/CheckVirtualMachinePowerActionsT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/CheckVirtualMachinePowerStateChangesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/CheckVirtualMachinePowerStateChangesT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/CheckVirtualMachineStateChangesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/CheckVirtualMachineStateChangesT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/GetMaximumMachineCapabilitiesQuerySizeResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/GetMaximumMachineCapabilitiesQuerySizeT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/GetMaximumPowerStateQuerySizeResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/GetMaximumPowerStateQuerySizeT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/GetProvisionedVirtualMachineBySidResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/GetProvisionedVirtualMachineBySidT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/GetProvisioningSchemeByIdResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/GetProvisioningSchemeByIdT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/GetTaskResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/GetTaskT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/PollVirtualMachineCapabilitiesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/PollVirtualMachineCapabilitiesT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/PollVirtualMachinePowerStatesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/PollVirtualMachinePowerStatesT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/StartResetVirtualMachineResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/StartResetVirtualMachineT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/StartVirtualMachinePowerActionResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/StartVirtualMachinePowerActionT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/StartVirtualMachinePowerActionsResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/StartVirtualMachinePowerActionsT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/TerminateTaskResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/TerminateTaskT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/UpdateProvVmHostVmIdResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IMachineCreationApi/UpdateProvVmHostVmIdT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/FilterServiceAccountByIdentityProviderTypeNoSuchServiceAccount
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/FilterServiceAccountByIdentityProviderTypeResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/FilterServiceAccountByIdentityProviderTypeT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/GetAzureADAccessTokenByUidNoSuchServiceAccountFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/GetAzureADAccessTokenByUidResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/GetAzureADAccessTokenByUidT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/InterfaceIsActiveResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/InterfaceIsActiveT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/RetrieveAdAccountNoSuchAdAccountFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/RetrieveAdAccountResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/RetrieveAdAccountT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/SetAdAccountInUseAndClearPasswordNoSuchAdAccountFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/SetAdAccountInUseAndClearPasswordResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/IRetrieveAdAccount/SetAdAccountInUseAndClearPasswordT
Source: BrokerService.exe, 0000001F.00000002.2558857309.0000025451C32000.00000002.00000001.01000000.0000004C.sdmp	String found in binary or memory: http://tempuri.org/ISecondaryBrokerControl/GetAllConnectionLeaseRevocationDateTimesInUtcResponseQ
Source: BrokerService.exe, 0000001F.00000002.2558857309.0000025451C32000.00000002.00000001.01000000.0000004C.sdmp	String found in binary or memory: http://tempuri.org/ISecondaryBrokerControl/GetAllConnectionLeaseRevocationDateTimesInUtcT
Source: BrokerService.exe, 0000001F.00000002.2558857309.0000025451C32000.00000002.00000001.01000000.0000004C.sdmp	String found in binary or memory: http://tempuri.org/ISecondaryBrokerControl/StartBrokeringResponse
Source: BrokerService.exe, 0000001F.00000002.2558857309.0000025451C32000.00000002.00000001.01000000.0000004C.sdmp	String found in binary or memory: http://tempuri.org/ISecondaryBrokerControl/StartBrokeringT
Source: BrokerService.exe, 0000001F.00000002.2558857309.0000025451C32000.00000002.00000001.01000000.0000004C.sdmp	String found in binary or memory: http://tempuri.org/ISecondaryBrokerControl/StopBrokeringResponse
Source: BrokerService.exe, 0000001F.00000002.2558857309.0000025451C32000.00000002.00000001.01000000.0000004C.sdmp	String found in binary or memory: http://tempuri.org/ISecondaryBrokerControl/StopBrokeringT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustAdminQuery/GetRegisteredServiceByNameResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustAdminQuery/GetRegisteredServiceByNameT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustAdminQuery/GetServiceKeyNamesFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustAdminQuery/GetServiceKeyNamesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustAdminQuery/GetServiceKeyNamesT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustAdminQuery/GetServicesInstancesByNameResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustAdminQuery/GetServicesInstancesByNameT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustAdminQuery/RegisterServiceInstanceFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustAdminQuery/RegisterServiceInstanceResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustAdminQuery/RegisterServiceInstanceT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustAdminQuery/SetServiceInstanceKeyFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustAdminQuery/SetServiceInstanceKeyResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustAdminQuery/SetServiceInstanceKeyT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustAdminQuery/UnregisterServiceInstancesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustAdminQuery/UnregisterServiceInstancesT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustAdminQuery/UpdateServiceKeyFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustAdminQuery/UpdateServiceKeyResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustAdminQuery/UpdateServiceKeyT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/AuthenticateAndExtractSidsFromBearerTokenResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/AuthenticateAndExtractSidsFromBearerTokenT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/AuthenticateHeaderResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/AuthenticateHeaderT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/CreateServiceKeyResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/CreateServiceKeyT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/DeleteVdaEnrollmentTokenByIdFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/DeleteVdaEnrollmentTokenByIdResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/DeleteVdaEnrollmentTokenByIdT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/GetRegisteredServiceResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/GetRegisteredServiceT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/GetRegisteredServicesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/GetRegisteredServicesT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/GetTrustVdaEnrollmentTokensFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/GetTrustVdaEnrollmentTokensResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/GetTrustVdaEnrollmentTokensT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/NewBearerTokenForCurrentUserResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/NewBearerTokenForCurrentUserT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/NewBearerTokenResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/NewBearerTokenT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/NewTrustVdaEnrollmentTokenFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/NewTrustVdaEnrollmentTokenResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/NewTrustVdaEnrollmentTokenT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/RevokeTrustVdaEnrollmentTokenFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/RevokeTrustVdaEnrollmentTokenResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/RevokeTrustVdaEnrollmentTokenT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/UnregisterConnectorsResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/UnregisterConnectorsT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/UnregisterServiceInstanceResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/UnregisterServiceInstanceT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/ValidateTrustVdaEnrollmentTokenFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/ValidateTrustVdaEnrollmentTokenResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: http://tempuri.org/ITrustApi/ValidateTrustVdaEnrollmentTokenT
Source: svchost.exe, 00000002.00000002.1368957735.0000020960E13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: BrokerService.exe, 0000001F.00000002.2552865039.00000254506C2000.00000002.00000001.01000000.00000037.sdmp	String found in binary or memory: http://www.citrix.com/fmaplatform/CitrixTransactionId
Source: BrokerService.exe, 0000001D.00000002.1915578302.00000194AB522000.00000002.00000001.01000000.00000023.sdmp	String found in binary or memory: http://www.citrix.com/fmaplatform/VirtualSiteId
Source: BrokerService.exe, 0000001F.00000002.2554213094.00000254515C2000.00000002.00000001.01000000.00000041.sdmp	String found in binary or memory: http://www.citrix.com/fmaplatform/VirtualSiteIdeVirtualSiteManager.GetVirtualSites
Source: BrokerService.exe, 0000001F.00000002.2552865039.00000254506C2000.00000002.00000001.01000000.00000037.sdmp	String found in binary or memory: http://www.citrix.com/fmaplatform/trust
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	String found in binary or memory: http://www.citrix.com/hcl/connectorList%GetConnectorStatus
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp, Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr	String found in binary or memory: http://www.citrix.com/hcl/opId#SourceMachineNameWhttp://www.citrix.com/hcl/sourceMachineName
Source: svchost.exe, 00000002.00000002.1369147638.0000020960E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367792280.0000020960E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000002.00000002.1369147638.0000020960E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367792280.0000020960E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000002.00000003.1367443151.0000020960E62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367764046.0000020960E41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369075101.0000020960E42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367226026.0000020960E6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369410476.0000020960E70000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367707880.0000020960E5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369233575.0000020960E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000002.00000003.1367226026.0000020960E6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369410476.0000020960E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000002.00000002.1369147638.0000020960E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367792280.0000020960E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000002.00000003.1367422163.0000020960E67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369388884.0000020960E68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000002.00000003.1367143308.0000020960E75000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369431890.0000020960E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000002.00000002.1369147638.0000020960E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367792280.0000020960E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000002.00000003.1367443151.0000020960E62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1368998929.0000020960E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367707880.0000020960E5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369233575.0000020960E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000002.00000002.1369147638.0000020960E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367792280.0000020960E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000002.00000002.1368998929.0000020960E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367422163.0000020960E67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369388884.0000020960E68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000002.00000002.1369147638.0000020960E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367792280.0000020960E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000002.00000002.1369147638.0000020960E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367792280.0000020960E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000002.00000002.1369147638.0000020960E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367792280.0000020960E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000002.00000003.1367443151.0000020960E62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1368998929.0000020960E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369233575.0000020960E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000002.00000003.1367764046.0000020960E41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369075101.0000020960E42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000002.00000002.1369147638.0000020960E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367792280.0000020960E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000002.00000003.1367443151.0000020960E62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367764046.0000020960E41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369075101.0000020960E42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369233575.0000020960E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000002.00000003.1367764046.0000020960E41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367924924.0000020960E46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tilep
Source: svchost.exe, 00000002.00000002.1369233575.0000020960E63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367942743.0000020960E54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000002.00000002.1369075101.0000020960E42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000002.00000003.1367443151.0000020960E62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369233575.0000020960E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000002.00000003.1367764046.0000020960E41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369075101.0000020960E42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367532446.0000020960E5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
Source: svchost.exe, 00000002.00000003.1367942743.0000020960E54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000002.00000002.1369147638.0000020960E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367792280.0000020960E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000002.00000003.1265423425.0000020960E36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000002.00000002.1368998929.0000020960E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367422163.0000020960E67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369388884.0000020960E68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: BrokerService.exe, 0000001D.00000002.1913217539.00000194AB3A2000.00000002.00000001.01000000.00000015.sdmp, BrokerService.exe, 0000001D.00000002.1912129198.00000194AB272000.00000002.00000001.01000000.00000013.sdmp, BrokerService.exe, 0000001D.00000002.1915939180.00000194AB572000.00000002.00000001.01000000.00000026.sdmp, BrokerService.exe, 0000001D.00000002.1914867354.00000194AB442000.00000002.00000001.01000000.0000001C.sdmp, System.Configuration.ConfigurationManager.dll0.4.dr, System.Security.Permissions.dll.4.dr, Microsoft.Bcl.AsyncInterfaces.dll.4.dr, Microsoft.Extensions.Logging.dll.4.dr, System.ServiceProcess.ServiceController.dll.4.dr, System.Configuration.ConfigurationManager.dll.4.dr	String found in binary or memory: https://github.com/dotnet/runtime
Source: BrokerService.exe, 0000001D.00000002.1913217539.00000194AB3A2000.00000002.00000001.01000000.00000015.sdmp, BrokerService.exe, 0000001D.00000002.1912129198.00000194AB272000.00000002.00000001.01000000.00000013.sdmp, System.Configuration.ConfigurationManager.dll0.4.dr, System.Security.Permissions.dll.4.dr, System.ServiceProcess.ServiceController.dll.4.dr, System.Configuration.ConfigurationManager.dll.4.dr	String found in binary or memory: https://github.com/dotnet/runtime&
Source: BrokerService.exe, 0000001D.00000002.1915055457.00000194AB472000.00000002.00000001.01000000.0000001E.sdmp	String found in binary or memory: https://mindtouch.eng.citrite.net/Technologies/Citrix.Diagnostics.Tracing)
Source: BrokerService.exe, 0000001D.00000002.1915180152.00000194AB4BC000.00000002.00000001.01000000.0000001E.sdmp	String found in binary or memory: https://mindtouch.eng.citrite.net/Technologies/Citrix.Diagnostics.Tracing)J
Source: svchost.exe, 00000002.00000003.1367764046.0000020960E41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000002.00000003.1367738942.0000020960E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000002.00000003.1367738942.0000020960E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000002.00000002.1368998929.0000020960E2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000002.00000002.1369147638.0000020960E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367792280.0000020960E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000002.00000002.1369147638.0000020960E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367792280.0000020960E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\52b9fa.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC535.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC5C3.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC641.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICB14.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICB82.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{16FBB4F8-8C17-4AD9-93A4-B3F2C57666D7}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICE62.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICEEF.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICF8D.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICFCC.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID0F6.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID1E1.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID211.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID28F.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID2EE.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID31E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDD31.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6212.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6242.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI62CF.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI630F.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI660D.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6DDE.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI736D.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7459.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7469.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI747A.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI747B.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI75E3.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI75F4.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\52b9fc.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\52b9fc.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI98BF.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI98EF.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBA05.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICFDF.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID2FD.tmp	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\inf\Citrix XML Service\	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\inf\Citrix XML Service\wixperf.h	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\inf\Citrix XML Service\wixperf.ini	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\inf\Citrix XML Service\0009\	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\SysWOW64\PerfStringBackup.TMP	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\SysWOW64\PerfStringBackup.INI	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\inf\Citrix Broker Service\	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\inf\Citrix Broker Service\wixperf.h	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\inf\Citrix Broker Service\wixperf.ini	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\inf\Citrix Broker Service\0009\	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\SysWOW64\PerfStringBackup.TMP	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Installer\wix{16FBB4F8-8C17-4AD9-93A4-B3F2C57666D7}.SchedServiceConfig.rmi	Jump to behavior
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	File created: C:\Windows\ServiceProfiles\NetworkService\Licensing

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSIC535.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\wevtutil.exe

Process token adjusted: Security

Source: PvsVmTemplate.vhd0.4.dr	Binary string: \Device\HarddiskVolume2\System Volume Information\_restore{D42FEF58-E684-4725-B180-37A6578E0AE8}\RP44\change.log
Source: PvsVmTemplate.vhd0.4.dr	Binary string: \Device\HarddiskVolume3\$Extend\$RmMetadata\$TxfLog\$TxfLog.blf

Source: classification engine

Classification label: sus30.phis.troj.evad.winMSI@56/744@4/0

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files\Citrix

Jump to behavior

Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BrokerService.exe.log

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6276:120:WilError_03
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5964:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1792:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3260:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2712:120:WilError_03
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Mutant created: \BaseNamedObjects\Global\.net memory cache 4.0
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1292:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5688:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7044:120:WilError_03

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user~1\AppData\Local\Temp\MSI9878.tmp

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: MSIDD31.tmp.4.dr

Binary or memory string: SELECT * FROM `Component` WHERE `Component`=?SELECT * FROM `File` WHERE `File`=?SELECT * FROM `Registry` WHERE `Registry`=?IsLegacySecurityModelGetFileHandleForDACLGetDirectoryHandleForDACLGetRegistryHandleForDACLGetFilePathFromMSIGetDirectoryPathFromMSI%i%sGetRegistryPathFromMSICanonicalizeSDCTXGetNativeNameWAccessPermission}APPID\{APPID\ChangeAppIDAccessACLLaunchPermissionChangeAppIDLaunchACLConvertSidToStringSid failedGetUserNameSidFindCtxUserDefaultUserSetupCtxUsersSecDesc>CTX)CTX_InstallACLs.2FC063C6_B4B7_4E0E_B5A1_DD207D00E9C7%u2%u1%u1|%s1|%u2|%s2|%S: The string '%s' in the Desc column for the row '%s' of the CtxAddACL table is invalid.SELECT * FROM `CtxAddACL`CTX_SetupACLsGetUserNameSid failed - the user may not existUpdateCtxUsersSecDescD:AIARD:AISetDaclHelperReg64<null>SetDaclHelperCreateWellKnownSidadvapi32.dllCtxGetNativeNameD:P(A;OICI;GA;;;SY)(A;OICI;GA;;;BA)(A;OICI;GA;;;CO)(A;OICI;GR;;;WD)SetDacl, StartSetDaclCustomActionDataCTX_InstallACLsWorkerGetUsersScheduledForRemovalCTX_RemoveACLs.2FC063C6_B4B7_4E0E_B5A1_DD207D00E9C7CtxAddACLPermCTX_SetupRemoveACLsUser_ExitFatal_ErrorExit_Dialog

Source: Broker_Service_x64.msi

Static file information: TRID: Microsoft Windows Installer (60509/1) 57.88%

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\Broker_Service_x64.msi"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 61840644E35B0012964490F7155C79A4 C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding F4607A9CFBE627DAA7B1AF4F0A87DD4D C
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 7D00F72EBD1F03FE2BA91EB00E79F5F2
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 40FEA25D10AEAC450300A64B6E69AD51
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding E5BAB935B9E62F5EF499449BA355B5C1 E Global\MSI0000
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding B57FEBC80AACA307814E81531C396CA3 E Global\MSI0000
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\AlwaysOnTracing.man"
Source: C:\Windows\SysWOW64\wevtutil.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wevtutil.exe	Process created: C:\Windows\System32\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\AlwaysOnTracing.man" /fromwow64
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\BrokerEventsProvider.man"
Source: C:\Windows\SysWOW64\wevtutil.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wevtutil.exe	Process created: C:\Windows\System32\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\BrokerEventsProvider.man" /fromwow64
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\HighAvailabilityEventsProvider.man"
Source: C:\Windows\SysWOW64\wevtutil.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wevtutil.exe	Process created: C:\Windows\System32\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\HighAvailabilityEventsProvider.man" /fromwow64
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\SysWOW64\sc.exe" sidtype CitrixBrokerService unrestricted
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\Citrix\Broker\Service\BrokerService.exe "C:\Program Files\Citrix\Broker\Service\BrokerService.exe" -Upgrade
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files\Citrix\Broker\Service\BrokerService.exe "C:\Program Files\Citrix\Broker\Service\BrokerService.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe "C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe" -Pipeline "C:\Program Files\Citrix\Broker\Service\Pipeline\"
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe "C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe" -PluginsRoot "C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\"
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe "C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe" -PluginsRoot "C:\Program Files\Common Files\Citrix\HCLPlugins\ManagedMachine\v2.5.0.0\"
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 61840644E35B0012964490F7155C79A4 C	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding F4607A9CFBE627DAA7B1AF4F0A87DD4D C	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 7D00F72EBD1F03FE2BA91EB00E79F5F2	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 40FEA25D10AEAC450300A64B6E69AD51	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding E5BAB935B9E62F5EF499449BA355B5C1 E Global\MSI0000	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding B57FEBC80AACA307814E81531C396CA3 E Global\MSI0000	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\AlwaysOnTracing.man"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\BrokerEventsProvider.man"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\HighAvailabilityEventsProvider.man"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\SysWOW64\sc.exe" sidtype CitrixBrokerService unrestricted	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\Citrix\Broker\Service\BrokerService.exe "C:\Program Files\Citrix\Broker\Service\BrokerService.exe" -Upgrade	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe "C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe" -Pipeline "C:\Program Files\Citrix\Broker\Service\Pipeline\"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe "C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe" -PluginsRoot "C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\SysWOW64\wevtutil.exe	Process created: C:\Windows\System32\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\AlwaysOnTracing.man" /fromwow64
Source: C:\Windows\SysWOW64\wevtutil.exe	Process created: C:\Windows\System32\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\BrokerEventsProvider.man" /fromwow64
Source: C:\Windows\SysWOW64\wevtutil.exe	Process created: C:\Windows\System32\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\HighAvailabilityEventsProvider.man" /fromwow64

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: moshost.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapsbtsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mosstorage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapconfiguration.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: w32time.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vmictimeprovider.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: loadperf.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: wevtapi.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: version.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: wldp.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: profapi.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: urlmon.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: iertutil.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: srvcli.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: netutils.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: propsys.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: winnsi.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: httpapi.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: version.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: wldp.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: profapi.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: urlmon.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: iertutil.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: srvcli.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: netutils.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: ieadvpack.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: devrtl.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: spinf.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: drvstore.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: spfileq.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: ieadvpack.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: devrtl.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: spinf.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: drvstore.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: spfileq.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: ieadvpack.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: devrtl.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: spinf.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: drvstore.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: spfileq.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: ieadvpack.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: devrtl.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: spinf.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: drvstore.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: spfileq.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: ieadvpack.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: devrtl.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: spinf.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: drvstore.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: spfileq.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: propsys.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: winnsi.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: secur32.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: activeds.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: adsldpc.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: adsldp.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: sxs.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: ntdsapi.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: netapi32.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: logoncli.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: mswsock.dll
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll

Source: C:\Windows\System32\wevtutil.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88d96a05-f192-11d4-a65f-0040963251e5}\InProcServer32

Source: C:\Windows\SysWOW64\msiexec.exe

File written: C:\Users\user\AppData\Local\Temp\WIXPF001\wixperf.ini

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Automated click: I accept the terms in the License Agreement
Source: C:\Windows\System32\msiexec.exe	Automated click: Install

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\msiexec.exe

Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddIns	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\UpdateScripts	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\zh-CN	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ImportScripts	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\ManagedMachine	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\ManagedMachine\v2.5.0.0	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\ThirdParty	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\ThirdParty\v2.5.0.0	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\CitrixMachineCreation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\CitrixMachineCreation\v1.0.0.0	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\32	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\32\ccauthcpp_dynamic.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\64	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\64\ccauthcpp_dynamic.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ActiveDirectory.SiteManagement.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ADIdentityInterService.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\AlwaysOnTracing.man	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\AlwaysOnTracing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\amd64	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\amd64\libccauth.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.Utilities.AssemblyResolver.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.Authentication.Models.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Avro.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.Aws.Batcher.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSPlugin.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.EBS.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.EC2.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.IdentityManagement.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.S3.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.SecurityToken.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Azure.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Azure.Identity.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Setup Scripts	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Setup Scripts\BackupDesktopServerKeys.ps1	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BaseDAL.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\BlankVhdTemplate.vhd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\BlankVhdTemplate.vhd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\BlankVhdTemplate.vhd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\BlankVhdTemplate.vhd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\BlankVhdTemplate.vhd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BouncyCastle.Cryptography.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerAdminQuery.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerAdminService.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerCde.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerCdeLibrary.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerComponentCommon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerComponent.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerDAL.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerEnvTests.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerEventsProvider.man	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerFiltering.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerSDKDefinition.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerSDKLogic.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerService.exe.config.orig	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerServiceEventLogResources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\BrokerServiceSupport.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\Castle.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Castle.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Castle.Windsor.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\CbpConstants.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\CbpControllerSdk.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\CbpTypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\CdeEvents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\CdeLibrary.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Diagnostics.Tracing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Networking.WebSocket.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Networking.WebSocket.pdb	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.Xaxd.Authentication.Models.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.DistributedTracing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.Xaxd.NgsTunnel.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.Utilities.AssemblyResolver.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.Utilities.EnumCache.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.Utils.Strings.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.ADIdentity.DataModel.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Base.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Broker.CasCommandQueuePayload.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.AgentFoundation.Common.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.AgentFoundation.Common.Classic.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.AgentFoundation.OnPremiseCommon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.AgentFoundation.OnPremiseContracts.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Core.Api.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Diagnostics.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Logging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Monitoring.ApplicationInsights.Shared.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Redis.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Security.CCAuth.Managed.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.ServiceRuntime.ApiClient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.ServiceRuntime.Configuration.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Trust.Api.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Utilities.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.ConfigLogging.Wcf.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.ConfigurationLogging.Rest.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Configuration.Rest.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.DelegatedAdmin.Rest.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Monitor.BrokerCodes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.DelegatedAdminInterfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.DistributedTracing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.ServiceCommon.KeySharingInterfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.ServiceCore.Common.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.Utilities.Sids.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HCL.DistributedTracing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Host.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Common.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.HostView.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Models.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Wcf.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Wcf.Types.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.IconConverter.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.IdentityManagement.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.IdentityManagement.Logging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.IdentityManagement.Utilities.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.MachineCreationAPI.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.MachineCreationAPI.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.ManagedMachineAPI.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.ManagedMachineAPI.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.ManagedMachineAPI.HostView.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.ManagedMachinePluginFinder.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.OperationalEvents.Broker.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.OperationalEvents.Common.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Services.ServiceHosting.WindowsServiceHostingApi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Services.ServiceLocator.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Trust.Library.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.CasConfigClient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.CasEventHubClient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.CasInterfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.Common.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.AspNet.CitrixCloud.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.AspNet.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.CitrixCloudCommon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.Interfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.Models.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.Profiles.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.CasDispatcher.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cdf.Net.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cloud.AclStore.Rest.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cloud.ServiceRegistry.Grpc.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cloud.ServiceRegistry.Rest.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cloud.VirtualSiteRegistry.Rest.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Common.Headers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Compression.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Compression.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Compression.Interfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Exporter.NewRelic.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Exporter.Cas.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.Wcf.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.Tc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.WebSocket.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.Wcf.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.Http.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Exceptions.Common.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Exceptions.Interfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Grpc.Client.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Grpc.Common.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Hostname.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Hostname.Interfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Logging.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Posh.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.RateLimiting.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.RateLimiting.Wcf.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Rest.Client.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Rest.Client.Interfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Retry.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Signer.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Tenancy.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Tenancy.Interfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utilities.AssemblyResolver.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utilities.EnumCache.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Collections.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.DateTime.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Dynamic.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Events.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Minimatch.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Networking.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Objectpool.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Reflection.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Retry.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.SecretBuffer.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Serialization.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Strings.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.Xaxd.Utils.Strings.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.StrongName.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Uri.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Windows.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Wcf.Client.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Wcf.Client.Interfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.XenDesktop.Cloud.DataStore.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Citrix.XenDesktop.Cloud.DataStore.Models.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\de	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\de\CloudCommon.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\es	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\es\CloudCommon.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\fr	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\fr\CloudCommon.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\ja	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\ja\CloudCommon.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\zh-CN	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\zh-CN\CloudCommon.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\CloudCommon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ComponentInterface.Constants.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ComponentInterface.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ConfigLoggingSupport.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Setup Scripts\ConfigureHighAvailabilityService.ps1	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ControllerDAL.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ControllerInterfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\CookComputing.XmlRpcV2.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\CredentialSecurity64.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\cs	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\cs\Microsoft.VisualStudio.Threading.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\cs\Microsoft.VisualStudio.Validation.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\CtxAdmin.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\CtxMcp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\CtxSta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\CustomProvisioningCommon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\BrokerServiceSupport.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\Citrix.Base.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\Citrix.CloudServices.Core.Api.Client.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\Citrix.IconConverter.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\ConfigLoggingSupport.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\FmaCommonEnvTests.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\FmaConfigLoggingClient.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\GpAnalyzer.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\GpDocument.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\GpfxSettings.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.Edm.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.OData.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.Services.Client.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.SqlClient.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.SqlServer.Management.SqlParser.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.VisualStudio.Threading.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.VisualStudio.Validation.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\de\System.Spatial.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ImportScripts\Default.zip	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\DelegatedAdminSupport.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\DiscUtils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\DiscUtils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\DiscUtils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\DiscUtils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\DiscUtils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\DiscUtils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.DistributedTracing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\DnsIpSupport.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\DocumentFormat.OpenXml.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\UpdateScripts\downgrade_site_7.41.1100.0-7.41.100.0.xdu	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\BrokerServiceSupport.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\Citrix.Base.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\Citrix.CloudServices.Core.Api.Client.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\Citrix.IconConverter.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\ConfigLoggingSupport.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\FmaCommonEnvTests.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\FmaConfigLoggingClient.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\GpAnalyzer.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\GpDocument.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\GpfxSettings.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.Data.Edm.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.Data.OData.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.Data.Services.Client.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.Data.SqlClient.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.SqlServer.Management.SqlParser.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.VisualStudio.Threading.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\Microsoft.VisualStudio.Validation.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\es\System.Spatial.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\EventLogCodeGenHelper.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\EventLog.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaAbstractions.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaActiveDirectory.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaActiveDirectory.Interfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaCommandLine.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaCommandQueues.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaCommonEnvTests.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaConfigLoggingClient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaConfigLoggingClientInterService.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaConfigLoggingShared.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaDalAttributes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaDalExceptions.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaDalRuntime.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaDependencyInjection.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaEnv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaEnv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaEnvTestInterfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaEnv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaEventLog.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaFeature.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaFeature.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaFiltering.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaFilteringSdkSupport.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaIdentity.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaIdentity.Interfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.Interface.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.Models.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaLogging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaLogging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaLogging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaPlugin.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaProductInfo.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaRegistry.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaRegistry.Interface.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaSchemaProbeDal.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaSchemaTools.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaSecretEncryption.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaSecretEncryptionManager.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.DelegatedAdmin.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Features.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Ism.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.KeySharing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Logging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.ServiceControl.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.ServiceDiscovery.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.ServiceRegistration.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Settings.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSite.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSite.Interface.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSiteManager.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSiteProvider.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceControlInterface.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaServiceStatus.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaServiceStatus.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaSiteServices.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaSiteServicesSupport.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaSqlScriptBuilder.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaSqlUtils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaTransactionScope.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FMAUtils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaUtils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaUtils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\FmaWcf.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\BrokerServiceSupport.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\Citrix.Base.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\Citrix.CloudServices.Core.Api.Client.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\Citrix.IconConverter.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\ConfigLoggingSupport.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\FmaCommonEnvTests.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\FmaConfigLoggingClient.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\GpAnalyzer.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\GpDocument.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\GpfxSettings.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.Data.Edm.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.Data.OData.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.Data.Services.Client.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.Data.SqlClient.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.SqlServer.Management.SqlParser.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.VisualStudio.Threading.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.VisualStudio.Validation.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\fr\System.Spatial.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Google.Api.CommonProtos.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Google.Protobuf.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\GpAnalyzer.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\GpContracts.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\GpDocument.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\GpfxSettings.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\GpXmlSchema.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\grpc_csharp_ext.x64.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\grpc_csharp_ext.x86.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Grpc.Core.Api.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Grpc.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Grpc.Net.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Grpc.Net.Common.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HypervisorCommunicationsLibrary.Contracts.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.HCL.DistributedTracing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HCL.DistributedTracing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\Citrix.HCL.DistributedTracing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.HCL.DistributedTracing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\Citrix.HCL.DistributedTracing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HypervisorCommunicationsLibrary.Models.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HCL.Shared.Contracts.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HCL.TlsCertificateVerification.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.HCL.TlsCertificateVerification.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\HighAvailabilityEventsProvider.man	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ControlScripts	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ControlScripts\HighAvailabilityServiceControl.psm1	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\HighAvailabilityServiceEventLogResources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\HostingManagementComponent.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HypervisorCommunicationsLibrary.AddInSideAdapter.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\HostSideAdapters	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\HostSideAdapters\Citrix.HypervisorCommunicationsLibrary.HostSideAdapter.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.Wcf.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.Wcf.Types.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\HypervisorsCommon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\HypervisorsCommon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\HypervisorsCommon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\HypervisorsCommon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\HypervisorsCommon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\HypervisorsCommon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\i386	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\i386\libccauth.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\IBrokerAdminQuery.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\IBrokerDAL.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\IBrokerDALInternal.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\IControllerDAL.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\IControllerDALInternal.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ICwcSupport.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\IDnsIpSupport.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\IEdgeProxySupport.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ILeasingControl.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSConfiguration	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSConfiguration\InstanceTypes.xml	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSConfiguration\InstanceTypes.xsd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Interop.GPMGMTLib.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Interop.NetFwTypeLib.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\iobfuncdll.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ISdkLogic.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ISecondaryBrokerControl.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\it	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.Edm.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.OData.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.Services.Client.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.SqlClient.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.SqlServer.Management.SqlParser.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.VisualStudio.Threading.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.VisualStudio.Validation.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\it\System.Spatial.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\BrokerServiceSupport.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\Citrix.Base.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\Citrix.CloudServices.Core.Api.Client.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\Citrix.IconConverter.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\ConfigLoggingSupport.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\FmaCommonEnvTests.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\FmaConfigLoggingClient.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\GpAnalyzer.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\GpDocument.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\GpfxSettings.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.Edm.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.OData.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.Services.Client.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.SqlClient.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.SqlServer.Management.SqlParser.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.VisualStudio.Threading.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.VisualStudio.Validation.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ja\System.Spatial.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ko	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.Edm.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.OData.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.Services.Client.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.SqlClient.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.SqlServer.Management.SqlParser.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.VisualStudio.Threading.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.VisualStudio.Validation.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\ko\System.Spatial.resources.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\LhcUtils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Licensing.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\LicPolEng.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.ManagedMachineAPI.AddInSideAdapter.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.ManagedMachineAPI.Contracts.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\HostSideAdapters\Citrix.ManagedMachineAPI.HostSideAdapter.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Microsoft.Bcl.AsyncInterfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Microsoft.Extensions.Logging.Abstractions.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Microsoft.Extensions.ObjectPool.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Microsoft.Extensions.ObjectPool.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.ApplicationInsights.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.AspNetCore.Http.Abstractions.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.AspNetCore.Http.Features.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.AspNetCore.SystemWebAdapters.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.KeyVault.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.KeyVault.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.KeyVault.WebKey.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.Services.AppAuthentication.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.Storage.Blob.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.Storage.Common.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Bcl.AsyncInterfaces.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Bcl.HashCode.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.Edm.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.OData.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.Services.Client.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.SNI.arm64.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.SNI.x64.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.SNI.x86.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.Tools.Sql.BatchParser.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Citrix\Broker\Service\Microsoft.Deployment.Compression.Cab.dll	Jump to behavior

Source: Broker_Service_x64.msi

Static file information: File size 72298496 > 1048576

Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\logging\cdf_sharp\win\anycpu-release__\obj\release\net472\Citrix.Diagnostics.Tracing.pdb source: BrokerService.exe, 0000001D.00000002.1915055457.00000194AB472000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\utils\assembly_resolver\anycpu-release__\obj\release\net472\Citrix.Xaxd.Utilities.AssemblyResolver.pdb source: BrokerService.exe, 0000001D.00000002.1909505618.00000194911D2000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\RemoteHCLClient\anycpu-release__\obj\release\net472\RemoteHCLClient.pdb(} source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Libraries\Cbp\CbpControllerSdk\anycpu-release__\obj\release\net472\CbpControllerSdk.pdb source: BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Shared\LhcUtils\anycpu-release__\obj\release\net472\LhcUtils.pdb source: BrokerService.exe, 0000001D.00000002.1909945480.0000019491282000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\BrokerComponent\anycpu-release__\obj\release\net472\BrokerComponent.pdb source: BrokerService.exe, 0000001F.00000002.2558857309.0000025451C32000.00000002.00000001.01000000.0000004C.sdmp
Source:	Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.ValueTuple/net47\System.ValueTuple.pdb62P2 B2_CorDllMainmscoree.dll source: BrokerService.exe, 0000001F.00000002.2549401679.000002544F472000.00000002.00000001.01000000.00000036.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaSids\anycpu-release__\obj\release\net472\Citrix.Fma.Sdk.Utilities.Sids.pdb source: BrokerService.exe, 0000001F.00000002.2555275324.0000025451652000.00000002.00000001.01000000.00000046.sdmp
Source:	Binary string: Microsoft.Data.SqlClient.SNI.pdb source: Microsoft.Data.SqlClient.SNI.x64.dll.4.dr, Microsoft.Data.SqlClient.SNI.x86.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\Wpnbr\anycpu-release__\obj\release\net472\Wpnbr.pdbQ source: BrokerService.exe, 0000001D.00000002.1917130914.00000194AB772000.00000002.00000001.01000000.00000030.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\CtxAdmin\anycpu-release__\obj\release\net472\CtxAdmin.pdb source: BrokerService.exe, 0000001D.00000002.1916802918.00000194AB6C2000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.ServiceRegistration\anycpu-release__\obj\release\net472\FmaServiceCommon.ServiceRegistration.pdb source: BrokerService.exe, 0000001F.00000002.2555021751.0000025451632000.00000002.00000001.01000000.00000045.sdmp
Source:	Binary string: /_/artifacts/obj/System.Security.Permissions/Release/net462/System.Security.Permissions.pdbSHA256 source: System.Security.Permissions.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\ICwcSupport\anycpu-release__\obj\release\net472\ICwcSupport.pdbX4r4 d4_CorDllMainmscoree.dll source: ICwcSupport.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\GroupPolicy\GpAnalyzer\Analyzer\anycpu-release__\obj\release\net472\GpAnalyzer.pdbH source: GpAnalyzer.dll.4.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Rest.ClientRuntime\Release\net461\Microsoft.Rest.ClientRuntime.pdbSHA256TS- source: Microsoft.Rest.ClientRuntime.dll.4.dr
Source:	Binary string: X:\src\HelperPackages\Bootstrap\Bootstrap_CA\wh32\retail\vc80\static\bootstrap_ca.pdbH source: MSIDD31.tmp.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\XmlMultiplexer\anycpu-release__\obj\release\net472\XmlMultiplexer.pdb source: BrokerService.exe, 0000001D.00000002.1916476987.00000194AB682000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: /_/obj/src/Microsoft/SqlServer/Management/CollectorEnum/Release/net462/Microsoft.SqlServer.Management.CollectorEnum.pdb source: Microsoft.SqlServer.Management.CollectorEnum.dll.4.dr
Source:	Binary string: Microsoft.Data.SqlClient.SNI.pdbGCTL source: Microsoft.Data.SqlClient.SNI.x64.dll.4.dr, Microsoft.Data.SqlClient.SNI.x86.dll.4.dr
Source:	Binary string: T:\altsrc\github\grpc\workspace_csharp_ext_windows_x64\cmake\build\x64\grpc_csharp_ext.pdb source: grpc_csharp_ext.x64.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaRegistry.Interface\anycpu-release__\obj\release\netstandard2.0\FmaRegistry.Interface.pdbL6f6 X6_CorDllMainmscoree.dll source: BrokerService.exe, 0000001D.00000002.1910001253.0000019491292000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\CtxMcp\anycpu-release__\obj\release\net472\CtxMcp.pdb source: BrokerService.exe, 0000001D.00000002.1917548815.00000194ABA52000.00000002.00000001.01000000.00000032.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\DiscUtils\src\anycpu-release__\obj\release\net472\DiscUtils.pdb source: DiscUtils.dll4.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.VirtualSite\anycpu-release__\obj\release\net472\FmaServiceCommon.VirtualSite.pdb source: BrokerService.exe, 0000001F.00000002.2554388742.00000254515D2000.00000002.00000001.01000000.00000042.sdmp, FmaServiceCommon.VirtualSite.dll.4.dr
Source:	Binary string: c:\projects\nlog\NLog.ManualFlush\obj\Release\NLog.ManualFlush.pdb source: NLog.ManualFlush.dll.4.dr
Source:	Binary string: C:\jenkins\workspace\AuthX\Build-Custom\Build-CCAuthCpp-Master\cmake_windows_32\src\Release\ccauthcpp_dynamic.pdb source: ccauthcpp_dynamic.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaEnv\anycpu-release__\obj\release\netstandard2.0\FmaEnv.pdb source: BrokerService.exe, 0000001D.00000002.1912083012.00000194AB262000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: /_/artifacts/obj/System.Security.Principal.Windows/net461-Windows_NT-Release/System.Security.Principal.Windows.pdb source: BrokerService.exe, 0000001F.00000002.2555493326.0000025451972000.00000002.00000001.01000000.00000047.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\CDE\BrokerCdeLibrary\anycpu-release__\obj\release\net472\BrokerCdeLibrary.pdb source: BrokerService.exe, 0000001D.00000002.1909749981.0000019491232000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: /_/artifacts/obj/System.ServiceProcess.ServiceController/Release/net462/System.ServiceProcess.ServiceController.pdbSHA256) source: BrokerService.exe, 0000001D.00000002.1912129198.00000194AB272000.00000002.00000001.01000000.00000013.sdmp, System.ServiceProcess.ServiceController.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\SDK\BrokerAdminService\anycpu-release__\obj\release\net472\BrokerAdminService.pdb source: BrokerAdminService.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\RemoteHCLClient\anycpu-release__\obj\release\net472\RemoteHCLClient.pdb source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp
Source:	Binary string: Citrix.Networking.WebSocket.pdb.7818E375_CB2C_4E80_99E7_4C40D0D5718B source: Broker_Service_x64.msi
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\distributed_tracing\exporter\newrelic\anycpu-release__\obj\release\net472\Citrix.Xaxd.DistributedTracing.Exporter.NewRelic.pdb source: Citrix.Xaxd.DistributedTracing.Exporter.NewRelic.dll.4.dr
Source:	Binary string: /_/artifacts/obj/System.Security.Principal.Windows/net461-Windows_NT-Release/System.Security.Principal.Windows.pdbSHA256zqXL source: BrokerService.exe, 0000001F.00000002.2555493326.0000025451972000.00000002.00000001.01000000.00000047.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.KeySharingInterfaces\anycpu-release__\obj\release\net472\Citrix.Fma.Sdk.ServiceCommon.KeySharingInterfaces.pdb source: Citrix.Fma.Sdk.ServiceCommon.KeySharingInterfaces.dll.4.dr
Source:	Binary string: C:\jenkins\workspace\CitrixCloud\Build\Src\Logging\obj\Release\netstandard2.0\Citrix.CloudServices.Logging.pdb source: Citrix.CloudServices.Logging.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaRegistry.Interface\anycpu-release__\obj\release\netstandard2.0\FmaRegistry.Interface.pdb source: BrokerService.exe, 0000001D.00000002.1910001253.0000019491292000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\DistributedTracing\anycpu-release__\obj\release\netstandard2.0\Citrix.Fma.Sdk.DistributedTracing.pdb source: BrokerService.exe, 0000001D.00000002.1914666070.00000194AB422000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\DAL\IBrokerDAL\anycpu-release__\obj\release\net472\IBrokerDAL.pdb source: IBrokerDAL.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.ManagedMachineAPI\anycpu-release__\obj\release\net472\Citrix.ManagedMachineAPI.pdb source: BrokerService.exe, 0000001F.00000002.2553794425.0000025450D72000.00000002.00000001.01000000.0000003E.sdmp
Source:	Binary string: D:\a\_work\1\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb source: System.Memory.dll0.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\ICwcSupport\anycpu-release__\obj\release\net472\ICwcSupport.pdb source: ICwcSupport.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaEventLog\anycpu-release__\obj\release\net472\FmaEventLog.pdb< source: BrokerService.exe, 0000001F.00000002.2553006670.00000254506D2000.00000002.00000001.01000000.00000038.sdmp
Source:	Binary string: C:\workspace-analytics\workspace-analytics\Output\AnyCPU\Citrix.WorkspaceAnalytics.CasInterfaces\obj\Debug\Citrix.WorkspaceAnalytics.CasInterfaces.pdb source: Citrix.WorkspaceAnalytics.CasInterfaces.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\ActiveDirectory\FmaActiveDirectory\anycpu-release__\obj\release\netstandard2.0\FmaActiveDirectory.pdb.y source: BrokerService.exe, 0000001F.00000002.2556875287.0000025451A92000.00000002.00000001.01000000.0000004A.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Shared\VirtualSites\anycpu-release__\obj\release\net472\VirtualSites.pdb source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\SDK\BrokerSDKDefinition\anycpu-release__\obj\release\netstandard2.0\BrokerSDKDefinition.pdb source: BrokerService.exe, 0000001F.00000002.2556016980.00000254519F2000.00000002.00000001.01000000.00000049.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\utils\events\anycpu-release__\obj\release\netstandard2.0\Citrix.Xaxd.Utils.Events.pdb source: BrokerService.exe, 0000001F.00000002.2553584343.0000025450D52000.00000002.00000001.01000000.0000003C.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Win32.Registry/net461-Windows_NT-Release/Microsoft.Win32.Registry.pdb source: BrokerService.exe, 0000001D.00000002.1912963441.00000194AB382000.00000002.00000001.01000000.00000014.sdmp, Microsoft.Win32.Registry.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaTransactionScope\anycpu-release__\obj\release\netstandard2.0\FmaTransactionScope.pdb source: BrokerService.exe, 0000001D.00000002.1913930609.00000194AB3E2000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.PluginRegistrationTool\anycpu-release__\obj\release\net472\RegisterPlugins.pdb source: RegisterPlugins.exe, 00000022.00000000.1925697735.000002B30D5F2000.00000002.00000001.01000000.00000035.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\hostname\interfaces\anycpu-release__\obj\release\netstandard2.0\Citrix.Xaxd.Hostname.Interfaces.pdb9,S, E,_CorDllMainmscoree.dll source: Citrix.Xaxd.Hostname.Interfaces.dll.4.dr
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.Logging.Abstractions/Release/net462/Microsoft.Extensions.Logging.Abstractions.pdbSHA256 source: BrokerService.exe, 0000001D.00000002.1914867354.00000194AB442000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\WorkerChannelFactoryLoader\anycpu-release__\obj\release\net472\WorkerChannelFactoryLoader.pdb source: BrokerService.exe, 0000001F.00000002.2553979605.0000025450D82000.00000002.00000001.01000000.0000003F.sdmp
Source:	Binary string: /_/obj/src/Microsoft/SqlServer/Management/CollectorEnum/Release/net462/Microsoft.SqlServer.Management.CollectorEnum.pdb@aZa La_CorDllMainmscoree.dll source: Microsoft.SqlServer.Management.CollectorEnum.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.VirtualSite.Interface\anycpu-release__\obj\release\netstandard2.0\FmaServiceCommon.VirtualSite.Interface.pdb~1 source: BrokerService.exe, 0000001D.00000002.1913698768.00000194AB3D2000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.HCL.DistributedTracing\anycpu-release__\obj\release\net472\Citrix.HCL.DistributedTracing.pdb source: Citrix.HCL.DistributedTracing.dll0.4.dr
Source:	Binary string: /_/artifacts/obj/System.Diagnostics.DiagnosticSource/Release/net462/System.Diagnostics.DiagnosticSource.pdbSHA256h source: BrokerService.exe, 0000001D.00000002.1915939180.00000194AB572000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaInterServiceClients\Runtime\FmaInterServiceManager.Interface\anycpu-release__\obj\release\net472\FmaInterServiceManager.Interface.pdb source: BrokerService.exe, 0000001D.00000002.1914986331.00000194AB462000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\XmsInterfaces\anycpu-release__\obj\release\net472\XmsInterfaces.pdb source: BrokerService.exe, 0000001D.00000002.1916621102.00000194AB692000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.VirtualSiteManager\anycpu-release__\obj\release\net472\FmaServiceCommon.VirtualSiteManager.pdb source: BrokerService.exe, 0000001F.00000002.2554213094.00000254515C2000.00000002.00000001.01000000.00000041.sdmp
Source:	Binary string: Citrix.Networking.WebSocket.pdb.7818E375_CB2C_4E80_99E7_4C40D0D5718BHF source: Broker_Service_x64.msi
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\RegistryCounters\anycpu-release__\obj\release\net472\RegistryCounters.pdb source: BrokerService.exe, 0000001D.00000002.1916301428.00000194AB672000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaSqlUtils\anycpu-release__\obj\release\netstandard2.0\FmaSqlUtils.pdb source: FmaSqlUtils.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaPlugin\anycpu-release__\obj\release\netstandard2.0\FmaPlugin.pdb source: BrokerService.exe, 0000001F.00000002.2553466258.0000025450CB2000.00000002.00000001.01000000.0000003B.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.VirtualSite.Interface\anycpu-release__\obj\release\netstandard2.0\FmaServiceCommon.VirtualSite.Interface.pdb source: BrokerService.exe, 0000001D.00000002.1913698768.00000194AB3D2000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.ValueTuple/net47\System.ValueTuple.pdb source: BrokerService.exe, 0000001F.00000002.2549401679.000002544F472000.00000002.00000001.01000000.00000036.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\DiscUtils\src\anycpu-release__\obj\release\net472\DiscUtils.pdb8> source: DiscUtils.dll4.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaUtils\anycpu-release__\obj\release\net472\FmaUtils.pdbb source: BrokerService.exe, 0000001D.00000002.1909451331.00000194911C2000.00000002.00000001.01000000.00000009.sdmp, FMAUtils.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaEnv\anycpu-release__\obj\release\netstandard2.0\FmaEnv.pdb28L8 >8_CorDllMainmscoree.dll source: BrokerService.exe, 0000001D.00000002.1912083012.00000194AB262000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\ActiveDirectory\FmaActiveDirectory\anycpu-release__\obj\release\netstandard2.0\FmaActiveDirectory.pdb source: BrokerService.exe, 0000001F.00000002.2556875287.0000025451A92000.00000002.00000001.01000000.0000004A.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.HypervisorCommunicationsLibrary\anycpu-release__\obj\release\net472\Citrix.HypervisorCommunicationsLibrary.pdb source: Citrix.HypervisorCommunicationsLibrary.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Libraries\FmaCommandQueues\CasCommandQueuePayload\anycpu-release__\obj\release\netstandard2.0\Citrix.Broker.CasCommandQueuePayload.pdbB5\5 N5_CorDllMainmscoree.dll source: Citrix.Broker.CasCommandQueuePayload.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaFeature\anycpu-release__\obj\release\netstandard2.0\FmaFeature.pdb source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Bcl.HashCode/net461-Release/Microsoft.Bcl.HashCode.pdb source: Microsoft.Bcl.HashCode.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.ManagedMachineAPI\anycpu-release__\obj\release\net472\Citrix.ManagedMachineAPI.pdb> source: BrokerService.exe, 0000001F.00000002.2553794425.0000025450D72000.00000002.00000001.01000000.0000003E.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\logging\cdf_net\core\anycpu-release__\obj\release\net472\Citrix.Xaxd.Cdf.Net.pdb source: BrokerService.exe, 0000001D.00000002.1909850188.0000019491242000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\ProxyCommon\anycpu-release__\obj\release\net472\ProxyCommon.pdb$ source: BrokerService.exe, 0000001D.00000002.1917667880.00000194ABA92000.00000002.00000001.01000000.00000033.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaRegistry\anycpu-release__\obj\release\netstandard2.0\FmaRegistry.pdb source: BrokerService.exe, 0000001D.00000002.1909555493.00000194911E2000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaEventLog\anycpu-release__\obj\release\net472\FmaEventLog.pdb source: BrokerService.exe, 0000001F.00000002.2553006670.00000254506D2000.00000002.00000001.01000000.00000038.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\IDnsIpSupport\anycpu-release__\obj\release\net472\IDnsIpSupport.pdb source: IDnsIpSupport.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\utils\windows\anycpu-release__\obj\release\net472\Citrix.Xaxd.Utils.Windows.pdb source: Citrix.Xaxd.Utils.Windows.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\utils\strings\anycpu-release__\obj\release\netstandard2.0\Citrix.Xaxd.Utils.Strings.pdb source: BrokerService.exe, 0000001D.00000002.1913390576.00000194AB3C2000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaInterServiceClients\Runtime\FmaInterServiceManager\anycpu-release__\obj\release\net472\FmaInterServiceManager.pdb source: BrokerService.exe, 0000001D.00000002.1915578302.00000194AB522000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: /_/artifacts/obj/System.Security.Permissions/Release/net462/System.Security.Permissions.pdb source: System.Security.Permissions.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Libraries\FmaCommandQueues\CasCommandQueuePayload\anycpu-release__\obj\release\netstandard2.0\Citrix.Broker.CasCommandQueuePayload.pdb source: Citrix.Broker.CasCommandQueuePayload.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaDal\Runtime\FmaDalRuntime\anycpu-release__\obj\release\netstandard2.0\FmaDalRuntime.pdb source: BrokerService.exe, 0000001D.00000002.1915242829.00000194AB4C2000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaLogging\anycpu-release__\obj\release\net472\FmaLogging.pdb source: BrokerService.exe, 0000001D.00000002.1911974174.00000194AB232000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaInterServiceClients\Runtime\FmaInterServiceManager.Models\anycpu-release__\obj\release\netstandard2.0\FmaInterServiceManager.Models.pdb source: BrokerService.exe, 0000001D.00000002.1915395701.00000194AB4F2000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: /_/artifacts/obj/System.ServiceProcess.ServiceController/Release/net462/System.ServiceProcess.ServiceController.pdb source: BrokerService.exe, 0000001D.00000002.1912129198.00000194AB272000.00000002.00000001.01000000.00000013.sdmp, System.ServiceProcess.ServiceController.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\CtxSta\anycpu-release__\obj\release\net472\CtxSta.pdbK source: BrokerService.exe, 0000001D.00000002.1916882745.00000194AB6D2000.00000002.00000001.01000000.0000002D.sdmp, CtxSta.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaWcf\anycpu-release__\obj\release\net472\FmaWcf.pdb source: BrokerService.exe, 0000001F.00000002.2552865039.00000254506C2000.00000002.00000001.01000000.00000037.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdbSHA256 source: Microsoft.Bcl.AsyncInterfaces.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\ActiveDirectory\FmaActiveDirectory.Interfaces\anycpu-release__\obj\release\netstandard2.0\FmaActiveDirectory.Interfaces.pdb source: BrokerService.exe, 0000001F.00000002.2554565821.00000254515E2000.00000002.00000001.01000000.00000043.sdmp
Source:	Binary string: /_/obj/src/Microsoft/SqlServer/Management/RegisteredServers/Release/net462/Microsoft.SqlServer.Management.RegisteredServers.pdb source: Microsoft.SqlServer.Management.RegisteredServers.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.HypervisorCommunicationsLibrary.Wcf\anycpu-release__\obj\release\net472\Citrix.HypervisorCommunicationsLibrary.Wcf.pdbnD source: Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr
Source:	Binary string: C:\jenkins\workspace\CitrixCloud\Build\Src\Logging\obj\Release\netstandard2.0\Citrix.CloudServices.Logging.pdbSHA256 source: Citrix.CloudServices.Logging.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\GroupPolicy\GpAnalyzer\Analyzer\anycpu-release__\obj\release\net472\GpAnalyzer.pdb source: GpAnalyzer.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\Licensing\anycpu-release__\obj\release\net472\Licensing.pdb source: BrokerService.exe, 0000001D.00000002.1916686247.00000194AB6A2000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: C:\Jenkins\workspace\CitrixCloud\Build\Src\AgentFoundation\Common\obj\Release\netstandard2.0\Citrix.CloudServices.AgentFoundation.Common.pdb source: Citrix.CloudServices.AgentFoundation.Common.dll.4.dr
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.Logging/Release/net462/Microsoft.Extensions.Logging.pdbSHA256kYf source: Microsoft.Extensions.Logging.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\logging\cdf_sharp\win\anycpu-release__\obj\release\net472\Citrix.Diagnostics.Tracing.pdb~ source: BrokerService.exe, 0000001D.00000002.1915055457.00000194AB472000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\ProxyCommon\anycpu-release__\obj\release\net472\ProxyCommon.pdb source: BrokerService.exe, 0000001D.00000002.1917667880.00000194ABA92000.00000002.00000001.01000000.00000033.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\BrokerComponentCommon\anycpu-release__\obj\release\net472\BrokerComponentCommon.pdb source: BrokerService.exe, 0000001D.00000002.1917029887.00000194AB6F2000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.Logging.Abstractions/Release/net462/Microsoft.Extensions.Logging.Abstractions.pdb source: BrokerService.exe, 0000001D.00000002.1914867354.00000194AB442000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\HostingManagement\HostingManagementComponent\anycpu-release__\obj\release\net472\HostingManagementComponent.pdb source: BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.HypervisorCommunicationsLibrary.HostView\anycpu-release__\obj\release\net472\Citrix.HypervisorCommunicationsLibrary.HostView.pdb source: Citrix.HypervisorCommunicationsLibrary.HostView.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaUtils\anycpu-release__\obj\release\net472\FmaUtils.pdb source: BrokerService.exe, 0000001D.00000002.1909451331.00000194911C2000.00000002.00000001.01000000.00000009.sdmp, FMAUtils.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Cloud\XAXDProxy\Components\UrlAclSupport\anycpu-release__\obj\release\net472\UrlAclSupport.pdb source: BrokerService.exe, 0000001D.00000002.1916166886.00000194AB642000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\authentication\interfaces\anycpu-release__\obj\release\net472\Citrix.Xaxd.Authentication.Interfaces.pdb source: BrokerService.exe, 0000001D.00000002.1915326873.00000194AB4E2000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaInterServiceClients\Runtime\FmaInterServiceManager.Models\anycpu-release__\obj\release\netstandard2.0\FmaInterServiceManager.Models.pdb"Y<Y .Y_CorDllMainmscoree.dll source: BrokerService.exe, 0000001D.00000002.1915395701.00000194AB4F2000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.Settings\anycpu-release__\obj\release\net472\FmaServiceCommon.Settings.pdb source: BrokerService.exe, 0000001D.00000002.1914580532.00000194AB402000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.HCL.DistributedTracing\anycpu-release__\obj\release\net472\Citrix.HCL.DistributedTracing.pdbXCrC dC_CorDllMainmscoree.dll source: Citrix.HCL.DistributedTracing.dll0.4.dr
Source:	Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb source: System.Numerics.Vectors.dll0.4.dr
Source:	Binary string: /_/artifacts/obj/System.Configuration.ConfigurationManager/Release/net462/System.Configuration.ConfigurationManager.pdbSHA256 source: BrokerService.exe, 0000001D.00000002.1913217539.00000194AB3A2000.00000002.00000001.01000000.00000015.sdmp, System.Configuration.ConfigurationManager.dll0.4.dr, System.Configuration.ConfigurationManager.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Shared\VirtualSites\anycpu-release__\obj\release\net472\VirtualSites.pdb: source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\XmsRuntime\anycpu-release__\obj\release\net472\XmsRuntime.pdb source: BrokerService.exe, 0000001D.00000002.1916960617.00000194AB6E2000.00000002.00000001.01000000.0000002E.sdmp
Source:	Binary string: /_/artifacts/obj/System.Diagnostics.DiagnosticSource/Release/net462/System.Diagnostics.DiagnosticSource.pdb source: BrokerService.exe, 0000001D.00000002.1915939180.00000194AB572000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdb source: Microsoft.Bcl.AsyncInterfaces.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\utils\date_time\anycpu-release__\obj\release\netstandard2.0\Citrix.Xaxd.Utils.DateTime.pdb source: BrokerService.exe, 0000001F.00000002.2553129762.0000025450BE2000.00000002.00000001.01000000.00000039.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\CtxSta\anycpu-release__\obj\release\net472\CtxSta.pdb source: BrokerService.exe, 0000001D.00000002.1916882745.00000194AB6D2000.00000002.00000001.01000000.0000002D.sdmp, CtxSta.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaServiceCommon\Runtime\FmaServiceCommon.VirtualSiteManager\anycpu-release__\obj\release\net472\FmaServiceCommon.VirtualSiteManager.pdb< source: BrokerService.exe, 0000001F.00000002.2554213094.00000254515C2000.00000002.00000001.01000000.00000041.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\TicketStore\TicketStore\anycpu-release__\obj\release\net472\TicketStore.pdb source: BrokerService.exe, 0000001F.00000002.2553679495.0000025450D62000.00000002.00000001.01000000.0000003D.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\hostname\interfaces\anycpu-release__\obj\release\netstandard2.0\Citrix.Xaxd.Hostname.Interfaces.pdb source: Citrix.Xaxd.Hostname.Interfaces.dll.4.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Rest.ClientRuntime\Release\net461\Microsoft.Rest.ClientRuntime.pdb source: Microsoft.Rest.ClientRuntime.dll.4.dr
Source:	Binary string: /_/artifacts/obj/System.Configuration.ConfigurationManager/Release/net462/System.Configuration.ConfigurationManager.pdb source: BrokerService.exe, 0000001D.00000002.1913217539.00000194AB3A2000.00000002.00000001.01000000.00000015.sdmp, System.Configuration.ConfigurationManager.dll0.4.dr, System.Configuration.ConfigurationManager.dll.4.dr
Source:	Binary string: C:\Jenkins\workspace\CitrixCloud\Build\Src\AgentFoundation\Common\obj\Release\netstandard2.0\Citrix.CloudServices.AgentFoundation.Common.pdbI source: Citrix.CloudServices.AgentFoundation.Common.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\distributed_tracing\core\anycpu-release__\obj\release\net472\Citrix.Xaxd.DistributedTracing.pdb source: BrokerService.exe, 0000001D.00000002.1915459492.00000194AB502000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaCommandLine\anycpu-release__\obj\release\netstandard2.0\FmaCommandLine.pdb source: BrokerService.exe, 0000001D.00000002.1915842117.00000194AB562000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaCommandLine\anycpu-release__\obj\release\netstandard2.0\FmaCommandLine.pdbv\ source: BrokerService.exe, 0000001D.00000002.1915842117.00000194AB562000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Broker\BrokerComponentCommon\anycpu-release__\obj\release\net472\BrokerComponentCommon.pdbp source: BrokerService.exe, 0000001D.00000002.1917029887.00000194AB6F2000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.Logging/Release/net462/Microsoft.Extensions.Logging.pdb source: Microsoft.Extensions.Logging.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\XmlServices\Wpnbr\anycpu-release__\obj\release\net472\Wpnbr.pdb source: BrokerService.exe, 0000001D.00000002.1917130914.00000194AB772000.00000002.00000001.01000000.00000030.sdmp
Source:	Binary string: X:\src\HelperPackages\Bootstrap\Bootstrap_CA\wh32\retail\vc80\static\bootstrap_ca.pdb source: MSIDD31.tmp.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Shared\EventLog\anycpu-release__\obj\release\net472\EventLog.pdb source: BrokerService.exe, 0000001D.00000002.1917745850.00000194ABAD2000.00000002.00000001.01000000.00000034.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaDal\Runtime\SiteServices\FmaSiteServices\anycpu-release__\obj\release\netstandard2.0\FmaSiteServices.pdb source: BrokerService.exe, 0000001F.00000002.2554068226.0000025450DF2000.00000002.00000001.01000000.00000040.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\libs\csharp\distributed_tracing\core\anycpu-release__\obj\release\net472\Citrix.Xaxd.DistributedTracing.pdb} source: BrokerService.exe, 0000001D.00000002.1915459492.00000194AB502000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaLogging\anycpu-release__\obj\release\net472\FmaLogging.pdb: source: BrokerService.exe, 0000001D.00000002.1911974174.00000194AB232000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Win32.Registry/net461-Windows_NT-Release/Microsoft.Win32.Registry.pdbSHA256 source: BrokerService.exe, 0000001D.00000002.1912963441.00000194AB382000.00000002.00000001.01000000.00000014.sdmp, Microsoft.Win32.Registry.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Citrix.HypervisorCommunicationsLibrary.Wcf\anycpu-release__\obj\release\net472\Citrix.HypervisorCommunicationsLibrary.Wcf.pdb source: Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Controller\ControllerService\x64-release__\obj\x64\release\net472\BrokerService.pdb source: BrokerService.exe, 0000001D.00000000.1835935201.0000019490E52000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaDependencyInjection\anycpu-release__\obj\release\netstandard2.0\FmaDependencyInjection.pdb source: BrokerService.exe, 0000001D.00000002.1915775374.00000194AB542000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaDal\Runtime\SiteServices\FmaSiteServices\anycpu-release__\obj\release\netstandard2.0\FmaSiteServices.pdb' source: BrokerService.exe, 0000001F.00000002.2554068226.0000025450DF2000.00000002.00000001.01000000.00000040.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\FmaServiceSdk\FmaUtilities\Runtime\FmaTransactionScope\anycpu-release__\obj\release\netstandard2.0\FmaTransactionScope.pdb(/B/ 4/_CorDllMainmscoree.dll source: BrokerService.exe, 0000001D.00000002.1913930609.00000194AB3E2000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Shared\Settings\anycpu-release__\obj\release\net472\Settings.pdb source: BrokerService.exe, 0000001F.00000002.2553217176.0000025450C32000.00000002.00000001.01000000.0000003A.sdmp, Settings.dll.4.dr
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Brokering\Broker\Components\Controller\ComponentInterface\anycpu-release__\obj\release\net472\ComponentInterface.pdb source: BrokerService.exe, 0000001D.00000002.1909653018.0000019491202000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\tc\work\9fabd0850cbc8cb6\buck-out\gen-obj\Provisioning\Libraries\HCL\Plugins\HypervisorsCommon\anycpu-release__\obj\release\net472\HypervisorsCommon.pdb source: HypervisorsCommon.dll0.4.dr

Source: SCVMM.dll.4.dr

Static PE information: 0xD15B71CF [Mon Apr 21 03:17:35 2081 UTC]

Source: MSI99A3.tmp.0.dr

Static PE information: section name: _RDATA

Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\HypervisorsCommon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.OData.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FMAUtils.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\de\Citrix.Base.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Http.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Unity.Container.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Grpc.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HypervisorCommunicationsLibrary.Contracts.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.AspNetCore.Http.Abstractions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.ServiceCommon.KeySharingInterfaces.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\es\SCVMM.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ja\FmaConfigLoggingClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\tr\Microsoft.VisualStudio.Validation.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\IControllerDAL.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.SqlClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ja\GpAnalyzer.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.SqlServer.Management.SqlParser.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Drawing.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\fr\System.Spatial.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\NLog.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Primitives.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\GpAnalyzer.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID0F6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\ja\SCVMM.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Net.Http.WinHttpHandler.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Settings.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.ManagedMachineAPI.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.Edm.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ko\System.Spatial.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\fr\GpDocument.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaSchemaProbeDal.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\LhcUtils.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.SqlScriptPublish.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\LicPolEng.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\de\GpfxSettings.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaServiceStatus.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.SqlServer.Management.SqlParser.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Management.Automation.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\CredentialSecurity64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Microsoft.Bcl.AsyncInterfaces.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC5C3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Polly.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\System.Memory.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.Edm.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ru\Microsoft.Data.OData.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.VisualStudio.Validation.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Logging.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\RemoteHCLCLient.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ProxyCommon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaServiceStatus.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Text.Json.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\protobuf-net.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.SqlClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ADIdentityInterService.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Ism.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\SdkAttributes.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.Aws.Batcher.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.Assessment.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\fr\Citrix.IconConverter.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.IdentityModel.Logging.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC535.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\fr\FmaCommonEnvTests.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\iobfuncdll.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.Data.Services.Client.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Security.Cryptography.Xml.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.OperationalEvents.Broker.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.WmiEnum.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.OData.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Utilities.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ru\Microsoft.Data.Edm.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\zh-CN\SCVMM.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.DelegatedAdmin.Rest.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Text.Encoding.CodePages.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.CasEventHubClient.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\fr\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.VisualStudio.Validation.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HypervisorCommunicationsLibrary.Models.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaLogging.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ja\ConfigLoggingSupport.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Identity.Client.Extensions.Msal.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.Storage.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ICwcSupport.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI9878.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\fr\Citrix.CloudServices.Core.Api.Client.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.SqlEnum.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ja\BrokerServiceSupport.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\SCVMM.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Smo.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.VisualStudio.Validation.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.Services.ServiceLocator.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\de\GpAnalyzer.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Interop.GPMGMTLib.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ComponentInterface.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Models.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HCL.DistributedTracing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ILeasingControl.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.Services.Client.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Net.Http.Formatting.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\cs\Microsoft.VisualStudio.Threading.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Bcl.HashCode.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\fr\ConfigLoggingSupport.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Configuration.Abstractions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Options.ConfigurationExtensions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Security.Cryptography.ProtectedData.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.CasConfigClient.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.XenDesktop.Cloud.DataStore.Models.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.SmoExtended.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\System.Buffers.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\IEdgeProxySupport.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\it\System.Spatial.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.ServiceCore.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\es\FmaCommonEnvTests.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Rest.ClientRuntime.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.ServiceControl.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaSchemaTools.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaSecretEncryption.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Google.Protobuf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.ServiceRuntime.Configuration.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Security.Permissions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\GpContracts.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Microsoft.WindowsAzure.Configuration.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\amd64\libccauth.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.SqlServer.Management.SqlParser.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Assessment.Types.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Wcf.Client.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.SqlWmiManagement.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\NLog.ManualFlush.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ja\GpDocument.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.IdentityManagement.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.DelegatedAdminInterfaces.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Deployment.Compression.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.DependencyInjection.Abstractions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Diagnostics.Tracing.EventSource.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaFeature.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Text.Encodings.Web.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.ApplicationInsights.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.HCL.DistributedTracing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.SqlClrProvider.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.Collector.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\IBrokerDAL.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Diagnostics.EventLog.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.ValueTuple.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\DnsIpSupport.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Dmf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\pt-BR\Microsoft.VisualStudio.Threading.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\de\BrokerServiceSupport.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\GpDocument.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.VisualStudio.Threading.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\IDnsIpSupport.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\HypervisorsCommon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ru\System.Spatial.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Microsoft.Extensions.ObjectPool.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\IBrokerDALInternal.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.ServiceBrokerEnum.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Wcf.Client.Interfaces.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.SNI.arm64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.ConnectionInfo.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Win32.Registry.AccessControl.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.AspNetCore.Http.Features.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.SNI.x64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Microsoft.Extensions.ObjectPool.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\de\CloudCommon.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\SchemaFeatures.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\System.Configuration.ConfigurationManager.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Settings.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.ServiceRegistration.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\SchemaFeature.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaWcf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\de\SCVMM.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\64\ccauthcpp_dynamic.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\RebootSchedules.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ja\System.Spatial.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\pl\Microsoft.VisualStudio.Threading.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Uri.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.Models.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.Edm.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\ja\CloudCommon.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Unity.Abstractions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICEEF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Options.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaSiteServicesSupport.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\Citrix.HCL.DistributedTracing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ja\GpfxSettings.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSID34D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\CtxSta.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ru\Microsoft.VisualStudio.Threading.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.ServiceModel.Security.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaTransactionScope.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\de\Citrix.CloudServices.Core.Api.Client.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.Edm.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\System.Memory.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Numerics.Vectors.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.VisualStudio.Threading.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\DiscUtils.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.RegSvrEnum.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.XEventDbScopedEnum.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaFiltering.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\fr\GpfxSettings.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ja\Citrix.IconConverter.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\NewRelic.Api.Agent.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Microsoft.Extensions.Logging.Abstractions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\DelegatedAdminSupport.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\pl\Microsoft.VisualStudio.Validation.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Serilog.Sinks.File.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Serilog.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\SDKUtils.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC641.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\de\Citrix.IconConverter.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.WindowsAzure.Storage.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.IdentityModel.Tokens.Jwt.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HCL.Shared.Adapters.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.ManagedMachinePluginFinder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Configuration.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.Tools.Sql.BatchParser.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.VisualStudio.Validation.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSite.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.RegisteredServers.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.CodeDom.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDD31.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.EBS.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.IdentityManagement.Logging.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaIdentity.Interfaces.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.IdentityModel.Protocols.OpenIdConnect.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ConfigLoggingSupport.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Monitoring.ApplicationInsights.Shared.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\es\BrokerServiceSupport.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.NgsTunnel.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.XEventDbScoped.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ComponentInterface.Constants.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\CookComputing.XmlRpcV2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\tr\Microsoft.VisualStudio.Threading.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\CtxAdmin.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.DistributedTracing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ja\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\grpc_csharp_ext.x86.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Security.AccessControl.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID31E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.IdentityModel.JsonWebTokens.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.XEventEnum.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\es\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.IdentityModel.Abstractions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Google.Api.CommonProtos.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.AspNetCore.SystemWebAdapters.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\de\FmaConfigLoggingClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Grpc.Core.Api.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.Edm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\fr\GpAnalyzer.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Threading.Channels.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.KeySharing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Data.SqlClient.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\de\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.MachineCreationAPI.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\System.Numerics.Vectors.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ActiveDirectory.SiteManagement.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Threading.Tasks.Extensions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\OpenIddict.Abstractions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ja\Citrix.CloudServices.Core.Api.Client.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\i386\libccauth.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\es\Citrix.IconConverter.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\OpenTelemetry.Api.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\grpc_csharp_ext.x64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Logging.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.Services.Client.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.ServiceModel.NetTcp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Wcf.Types.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID28F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Threading.AccessControl.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Redis.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Configuration.ConfigurationManager.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.Xaxd.Utils.Strings.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Win32.Registry.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Features.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.ObjectPool.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\de\ConfigLoggingSupport.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Diagnostics.DiagnosticSource.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.XEvent.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.ServiceModel.Duplex.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\DiscUtils.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Net.Http.Json.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\StackExchange.Redis.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaSecretEncryptionManager.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.ManagedMachineAPI.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ISdkLogic.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Polly.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.SqlServer.Management.SqlParser.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\DiscUtils.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.OData.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.Host.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.HadrData.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\es\CloudCommon.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\HostSideAdapters\Citrix.ManagedMachineAPI.HostSideAdapter.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Licensing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaSqlScriptBuilder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.SqlServer.Management.SqlParser.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Avro.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Identity.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID1E1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaSqlUtils.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSPlugin.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ru\Microsoft.SqlServer.Management.SqlParser.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\StandardSocketsHttpHandler.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.HCL.DistributedTracing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Grpc.Net.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HCL.TlsCertificateVerification.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ControllerInterfaces.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.PolicyEnum.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\IControllerDALInternal.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.DependencyInjection.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Strings.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ru\Microsoft.Data.Services.Client.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\System.Diagnostics.DiagnosticSource.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Logging.Configuration.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSiteProvider.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.IdentityModel.Tokens.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.MachineCreationAPI.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.KeyVault.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\System.Text.Json.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.SqlClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.ManagedMachineAPI.Contracts.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.Authentication.Models.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.KeyVault.WebKey.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.VisualStudio.Validation.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ISecondaryBrokerControl.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.DistributedTracing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ja\Citrix.Base.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.ServiceModel.Primitives.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.IO.FileSystem.AccessControl.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.Sdk.Sfc.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\32\ccauthcpp_dynamic.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.ComponentModel.Annotations.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaSiteServices.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\zh-CN\CloudCommon.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.EC2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.ConfigLogging.Wcf.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\fr\BrokerServiceSupport.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICB14.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Diagnostics.PerformanceCounter.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.HadrModel.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICF8D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID2EE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.OData.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Windows.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaFilteringSdkSupport.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipelines.Sockets.Unofficial.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\GpfxSettings.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\CloudCommon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.HostView.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Memory.Data.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Buffers.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Interop.NetFwTypeLib.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Web.Http.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.CollectorEnum.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Wcf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\OpenTelemetry.Exporter.OpenTelemetryProtocol.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\fr\Citrix.Base.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.XenDesktop.Cloud.DataStore.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.ManagedMachineAPI.AddInSideAdapter.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID211.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.ServiceBus.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\cs\Microsoft.VisualStudio.Validation.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.DelegatedAdmin.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.Utilities.AssemblyResolver.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.ConfigurationLogging.Rest.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Monitor.BrokerCodes.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ru\Microsoft.VisualStudio.Validation.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Deployment.Compression.Cab.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\AlwaysOnTracing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaProductInfo.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\DiscUtils.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.SNI.x86.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\System.Buffers.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI99A3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\pt-BR\Microsoft.VisualStudio.Validation.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\OperationalEvents.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.KeyVault.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\es\Citrix.Base.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaRegistry.Interface.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaLogging.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaLogging.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.IdentityModel.Clients.ActiveDirectory.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICFCC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\PluginUtilities.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.Services.AppAuthentication.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Memory.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.SqlClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.Services.Client.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ru\Microsoft.Data.SqlClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\CustomProvisioningCommon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.HCL.TlsCertificateVerification.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\fr\CloudCommon.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\de\System.Spatial.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.VisualStudio.Threading.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Logging.Abstractions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.Storage.Blob.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ProxyFmaSupport.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaPlugin.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.VisualStudio.Validation.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.VisualStudio.Threading.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.WindowsAzure.Configuration.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\DiscUtils.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSiteManager.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Bcl.AsyncInterfaces.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.OData.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Assessment.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Rest.ClientRuntime.Azure.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Smo.Notebook.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.ServiceRuntime.ApiClient.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.IdentityModel.Protocols.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.CasInterfaces.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Configuration.Binder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.Data.OData.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.Trust.Library.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.IO.Pipelines.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaUtils.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.Interface.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.SqlParser.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Spatial.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\TicketStore.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ControllerDAL.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.Data.SqlClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\Citrix.HCL.DistributedTracing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.ServiceModel.Http.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\es\Citrix.CloudServices.Core.Api.Client.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\NetLicWrapper.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Grpc.Net.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\System.Diagnostics.DiagnosticSource.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\RestSharp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaServiceControlInterface.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\CtxMcp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\pt-BR\Microsoft.Data.SqlClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.IdentityManagement.Utilities.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Security.CCAuth.Managed.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\GpXmlSchema.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\de\GpDocument.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICB82.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\RestSharp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\OpenTelemetry.Api.ProviderBuilderExtensions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.HCL.DistributedTracing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ja\FmaCommonEnvTests.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.ServiceDiscovery.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\HostSideAdapters\Citrix.HCL.Shared.Adapters.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\OpenTelemetry.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\System.ValueTuple.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.ManagedMachineAPI.HostView.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.Data.Edm.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\PluginUtilities.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HCL.Shared.Contracts.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaIdentity.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\StandardSocketsHttpHandler.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\StackExchange.Redis.StrongName.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaRegistry.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.ServiceProcess.ServiceController.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\pt-BR\Microsoft.SqlServer.Management.SqlParser.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Security.Principal.Windows.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Dmf.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.StrongName.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\es\ConfigLoggingSupport.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\RemoteHCLClient.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.OperationalEvents.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\StandardSocketsHttpHandler.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\DiscUtils.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\fr\SCVMM.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.Services.Client.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\RegistryCounters.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\protobuf-net.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.Configuration.Rest.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\SdkDalAttributes.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\System.Collections.Immutable.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.Services.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\fr\FmaConfigLoggingClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.IconConverter.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Trust.Api.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\Newtonsoft.Json.CH.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI9983.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaUtils.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\IBrokerAdminQuery.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.Services.ServiceHosting.WindowsServiceHostingApi.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\de\FmaCommonEnvTests.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\SdkInterfaces.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\it\Microsoft.VisualStudio.Threading.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSite.Interface.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\System.Text.Encodings.Web.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\System.Threading.Tasks.Extensions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.VisualStudio.Threading.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.Utilities.Sids.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Citrix\Broker\Service\DocumentFormat.OpenXml.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID211.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICFCC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC641.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICB14.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICF8D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID2EE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID0F6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC5C3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC535.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICEEF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID28F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID1E1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID31E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDD31.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICB82.tmp	Jump to dropped file

Source: C:\Windows\SysWOW64\msiexec.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Citrix XML Service\Performance

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\Config

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\SysWOW64\sc.exe" sidtype CitrixBrokerService unrestricted

Source: C:\Windows\SysWOW64\msiexec.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7613BA1FFF7E3EEF6E1BD42237A9A3D68FC2EE7E Blob

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\svchost.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Memory allocated: 194911A0000 memory reserve \| memory write watch
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Memory allocated: 194AAA60000 memory reserve \| memory write watch
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Memory allocated: 25004750000 memory reserve \| memory write watch
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Memory allocated: 25444A20000 memory reserve \| memory write watch
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Memory allocated: 2B30D930000 memory reserve \| memory write watch
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Memory allocated: 2B327270000 memory reserve \| memory write watch
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Memory allocated: 1A1F8310000 memory reserve \| memory write watch
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Memory allocated: 1A1F9C50000 memory reserve \| memory write watch
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Memory allocated: 21FD5900000 memory reserve \| memory write watch
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Memory allocated: 21FEF320000 memory reserve \| memory write watch

Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Microsoft.Extensions.ObjectPool.dll
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\RestSharp.dll
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\HypervisorsCommon.dll
Source: C:\Windows\System32\msiexec.exe	File opened / queried: C:\Windows\WinSxS\FileMaps\program_files_common_files_citrix_hclplugins_hypervisor_v2.73.0.0_vmware_fr_9475cb40c2be071a.cdf-ms	Jump to behavior
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.HCL.DistributedTracing.dll
Source: C:\Windows\System32\msiexec.exe	File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\de\	Jump to behavior
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.Xaxd.NgsTunnel.dll
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\DiscUtils.dll
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\VimService.dll
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaLogging.dll
Source: C:\Windows\System32\svchost.exe	File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}	Jump to behavior
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\VirtualCenter.Interfaces.dll
Source: C:\Windows\System32\msiexec.exe	File opened / queried: C:\Windows\WinSxS\FileMaps\program_files_common_files_citrix_hclplugins_hypervisor_v2.73.0.0_vmware_es_9475cb66c2be06c0.cdf-ms	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\ja\	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened / queried: C:\Windows\WinSxS\FileMaps\program_files_common_files_citrix_hclplugins_hypervisor_v2.73.0.0_vmware_faedd1614d3ab39e.cdf-ms	Jump to behavior
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.HCL.TlsCertificateVerification.dll
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\VirtualCenter.Operations.dll
Source: C:\Windows\System32\msiexec.exe	File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\fr\	Jump to behavior
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\VirtualCenter.dll
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Newtonsoft.Json.dll
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaUtils.dll
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.Xaxd.Authentication.Models.dll
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\StandardSocketsHttpHandler.dll
Source: C:\Windows\System32\msiexec.exe	File opened / queried: C:\Windows\WinSxS\FileMaps\program_files_common_files_citrix_hclplugins_hypervisor_v2.73.0.0_vmware_zh-cn_f2c0c926ac359074.cdf-ms	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\zh-CN\	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened / queried: C:\Windows\WinSxS\FileMaps\program_files_common_files_citrix_hclplugins_hypervisor_v2.73.0.0_vmware_de_9475cb6ec2be06ed.cdf-ms	Jump to behavior
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\VimService.XmlSerializers.dll
Source: C:\Windows\System32\msiexec.exe	File opened / queried: C:\Windows\WinSxS\FileMaps\program_files_common_files_citrix_hclplugins_hypervisor_v2.73.0.0_vmware_ja_9475ca8ec2be08f7.cdf-ms	Jump to behavior
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaEnv.dll
Source: C:\Windows\System32\msiexec.exe	File opened / queried: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\es\	Jump to behavior

Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Thread delayed: delay time: 7200000
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Thread delayed: delay time: 7199888
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Thread delayed: delay time: 7200000
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Thread delayed: delay time: 922337203685477

Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Window / User API: threadDelayed 379
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Window / User API: threadDelayed 4214
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Window / User API: threadDelayed 5625
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Window / User API: threadDelayed 424

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\HypervisorsCommon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\HypervisorsCommon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.OData.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FMAUtils.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\Citrix.Base.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cloud.VirtualSiteRegistry.Rest.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Http.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\BrokerAdminQuery.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Unity.Container.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Grpc.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HypervisorCommunicationsLibrary.Contracts.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Dynamic.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.AspNetCore.Http.Abstractions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.ServiceCommon.KeySharingInterfaces.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\BrokerFiltering.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\es\SCVMM.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\FmaConfigLoggingClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\tr\Microsoft.VisualStudio.Validation.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\IControllerDAL.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.SqlClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\GpAnalyzer.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\Microsoft.SqlServer.Management.SqlParser.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.Tc.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\System.Spatial.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Drawing.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\NLog.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Primitives.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\GpAnalyzer.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID0F6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\ja\SCVMM.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Net.Http.WinHttpHandler.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.AspNet.CitrixCloud.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Settings.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.ManagedMachineAPI.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.Edm.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ko\System.Spatial.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\GpDocument.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaSchemaProbeDal.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\LhcUtils.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.SqlScriptPublish.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\GpfxSettings.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\LicPolEng.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaServiceStatus.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.SqlServer.Management.SqlParser.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\BouncyCastle.Cryptography.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Management.Automation.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\CredentialSecurity64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\BrokerDAL.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Microsoft.Bcl.AsyncInterfaces.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\FmaConfigLoggingClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Polly.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC5C3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\System.Memory.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ru\Microsoft.Data.OData.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.Edm.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Logging.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\it\Microsoft.VisualStudio.Validation.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.Interfaces.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\RemoteHCLCLient.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaServiceStatus.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ProxyCommon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Text.Json.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\protobuf-net.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.SqlClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Compression.Interfaces.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ADIdentityInterService.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaConfigLoggingClient.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\SdkAttributes.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Ism.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.Aws.Batcher.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.Utilities.AssemblyResolver.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.Assessment.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\Citrix.IconConverter.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.IdentityModel.Logging.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\FmaCommonEnvTests.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC535.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\iobfuncdll.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.WebSocket.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.Data.Services.Client.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.DistributedTracing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Security.Cryptography.Xml.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.OperationalEvents.Broker.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.WmiEnum.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.OData.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Utilities.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ru\Microsoft.Data.Edm.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\zh-CN\SCVMM.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.DelegatedAdmin.Rest.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaEnvTestInterfaces.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Text.Encoding.CodePages.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.CasEventHubClient.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\Microsoft.VisualStudio.Validation.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\BrokerSDKLogic.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\Microsoft.VisualStudio.Validation.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HypervisorCommunicationsLibrary.Models.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Posh.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaLogging.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\ConfigLoggingSupport.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Identity.Client.Extensions.Msal.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.Storage.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.Wcf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ICwcSupport.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Grpc.Client.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI9878.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\Citrix.CloudServices.Core.Api.Client.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.SqlEnum.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Networking.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\BrokerServiceSupport.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\SCVMM.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.Xaxd.Authentication.Models.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Smo.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Services.ServiceLocator.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.VisualStudio.Validation.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\GpAnalyzer.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\BrokerSDKDefinition.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ComponentInterface.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Interop.GPMGMTLib.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utilities.AssemblyResolver.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaEnv.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Models.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaEnv.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HCL.DistributedTracing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ILeasingControl.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.Data.Services.Client.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Net.Http.Formatting.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\cs\Microsoft.VisualStudio.Threading.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Azure.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Bcl.HashCode.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\ConfigLoggingSupport.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Configuration.Abstractions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HypervisorCommunicationsLibrary.AddInSideAdapter.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Options.ConfigurationExtensions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Security.Cryptography.ProtectedData.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.CasConfigClient.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\BrokerComponent.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.XenDesktop.Cloud.DataStore.Models.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.SmoExtended.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\Microsoft.Data.Services.Client.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\System.Buffers.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\HostSideAdapters\Citrix.HypervisorCommunicationsLibrary.HostSideAdapter.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\IEdgeProxySupport.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\Castle.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cdf.Net.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.ServiceCore.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\it\System.Spatial.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\FmaCommonEnvTests.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.ServiceControl.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Rest.ClientRuntime.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaSchemaTools.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaSecretEncryption.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Google.Protobuf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.ServiceRuntime.Configuration.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.Wcf.Types.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Security.Permissions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaDalRuntime.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\GpContracts.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaDependencyInjection.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Microsoft.WindowsAzure.Configuration.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\amd64\libccauth.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\Microsoft.Data.SqlClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.ADIdentity.DataModel.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\HostingManagementComponent.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ko\Microsoft.SqlServer.Management.SqlParser.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Assessment.Types.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.CasDispatcher.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Wcf.Client.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.SqlWmiManagement.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\NLog.ManualFlush.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\GpDocument.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.IdentityManagement.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.RateLimiting.Wcf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Serialization.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.DelegatedAdminInterfaces.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Logging.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Deployment.Compression.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.DependencyInjection.Abstractions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaConfigLoggingShared.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Diagnostics.Tracing.EventSource.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaFeature.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.ApplicationInsights.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.HCL.DistributedTracing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Text.Encodings.Web.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.SqlClrProvider.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Broker.CasCommandQueuePayload.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.Collector.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Diagnostics.Tracing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\IBrokerDAL.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Diagnostics.EventLog.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.ValueTuple.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaActiveDirectory.Interfaces.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.Utilities.EnumCache.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cloud.ServiceRegistry.Grpc.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\DnsIpSupport.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\pt-BR\Microsoft.VisualStudio.Threading.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\BrokerServiceSupport.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Dmf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\GpDocument.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.VisualStudio.Threading.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaConfigLoggingClientInterService.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Exporter.Cas.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\IDnsIpSupport.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\HypervisorsCommon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Rest.Client.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ru\System.Spatial.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Microsoft.Extensions.ObjectPool.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\IBrokerDALInternal.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.SNI.arm64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.ServiceBrokerEnum.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Wcf.Client.Interfaces.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.ConnectionInfo.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Win32.Registry.AccessControl.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.Wcf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaActiveDirectory.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.AspNetCore.Http.Features.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.RateLimiting.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.SNI.x64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Microsoft.Extensions.ObjectPool.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\de\CloudCommon.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\SchemaFeatures.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\System.Configuration.ConfigurationManager.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.ServiceRegistration.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Settings.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\SchemaFeature.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\de\SCVMM.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaWcf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\64\ccauthcpp_dynamic.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\RebootSchedules.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\System.Spatial.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Uri.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\pl\Microsoft.VisualStudio.Threading.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.Models.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.Edm.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\HypervisorsCommon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\ja\CloudCommon.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Unity.Abstractions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSICEEF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Options.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.AgentFoundation.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\HypervisorsCommon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaSiteServicesSupport.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\SCVMM\Citrix.HCL.DistributedTracing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\GpfxSettings.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSID34D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ru\Microsoft.VisualStudio.Threading.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\CtxSta.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.ServiceModel.Security.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaTransactionScope.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\Citrix.CloudServices.Core.Api.Client.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\System.Memory.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\it\Microsoft.Data.Edm.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Numerics.Vectors.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.S3.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cloud.ServiceRegistry.Rest.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\DiscUtils.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\Microsoft.VisualStudio.Threading.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.RegSvrEnum.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.XEventDbScopedEnum.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\GpfxSettings.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaFiltering.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\Citrix.IconConverter.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Grpc.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Microsoft.Extensions.Logging.Abstractions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\NewRelic.Api.Agent.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaEventLog.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\DelegatedAdminSupport.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\pl\Microsoft.VisualStudio.Validation.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Serilog.Sinks.File.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Serilog.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\Microsoft.SqlServer.Management.SqlParser.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\SDKUtils.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\Citrix.IconConverter.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC641.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.WindowsAzure.Storage.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.IdentityModel.Tokens.Jwt.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HCL.Shared.Adapters.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.Instrumentation.Wcf.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\System.Spatial.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.ManagedMachinePluginFinder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaDalAttributes.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Configuration.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.Tools.Sql.BatchParser.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utilities.EnumCache.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaCommonEnvTests.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.VisualStudio.Validation.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSite.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIDD31.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.CodeDom.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.EBS.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.RegisteredServers.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.IdentityManagement.Logging.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.IdentityModel.Protocols.OpenIdConnect.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaIdentity.Interfaces.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ConfigLoggingSupport.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Monitoring.ApplicationInsights.Shared.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\BrokerServiceSupport.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.NgsTunnel.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.XEventDbScoped.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ComponentInterface.Constants.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\XenServer\CookComputing.XmlRpcV2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaAbstractions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\tr\Microsoft.VisualStudio.Threading.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.DistributedTracing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\CtxAdmin.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\grpc_csharp_ext.x86.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Security.AccessControl.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Castle.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.SecurityToken.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID31E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.XEventEnum.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.IdentityModel.JsonWebTokens.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Google.Api.CommonProtos.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.IdentityModel.Abstractions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\Microsoft.VisualStudio.Threading.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.AspNetCore.SystemWebAdapters.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Grpc.Core.Api.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\FmaConfigLoggingClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.Edm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\CbpConstants.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\GpAnalyzer.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Threading.Channels.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.KeySharing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Data.SqlClient.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.MachineCreationAPI.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\System.Numerics.Vectors.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ActiveDirectory.SiteManagement.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Threading.Tasks.Extensions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\OpenIddict.Abstractions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\Citrix.CloudServices.Core.Api.Client.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\i386\libccauth.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\Citrix.IconConverter.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaDalExceptions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\grpc_csharp_ext.x64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\OpenTelemetry.Api.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Logging.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Wcf.Types.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.ServiceModel.NetTcp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.Services.Client.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID28F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\Microsoft.Data.OData.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Threading.AccessControl.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Redis.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Configuration.ConfigurationManager.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.AgentFoundation.OnPremiseCommon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.Xaxd.Utils.Strings.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Win32.Registry.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.ObjectPool.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Features.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Tenancy.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\ConfigLoggingSupport.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Diagnostics.DiagnosticSource.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\BrokerServiceSupport.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.XEvent.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Exceptions.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.ServiceModel.Duplex.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\DiscUtils.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Net.Http.Json.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Hostname.Interfaces.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\StackExchange.Redis.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaSecretEncryptionManager.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.ManagedMachineAPI.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ISdkLogic.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Polly.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\it\Microsoft.SqlServer.Management.SqlParser.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\DiscUtils.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.OData.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Host.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Signer.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Compression.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.HadrData.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\es\CloudCommon.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\HostSideAdapters\Citrix.ManagedMachineAPI.HostSideAdapter.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Licensing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaSqlScriptBuilder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.SqlServer.Management.SqlParser.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Avro.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Identity.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\CbpControllerSdk.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID1E1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaSqlUtils.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSPlugin.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ru\Microsoft.SqlServer.Management.SqlParser.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.IdentityManagement.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\StandardSocketsHttpHandler.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.HCL.DistributedTracing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\CdeEvents.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Grpc.Net.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\HighAvailabilityServiceEventLogResources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HCL.TlsCertificateVerification.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ControllerInterfaces.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.PolicyEnum.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\IControllerDALInternal.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.DependencyInjection.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\BrokerCdeLibrary.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Strings.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ru\Microsoft.Data.Services.Client.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\System.Diagnostics.DiagnosticSource.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Logging.Configuration.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\HypervisorsCommon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\EventLogCodeGenHelper.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSiteProvider.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.IdentityModel.Tokens.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.MachineCreationAPI.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.KeyVault.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Azure.Identity.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Reflection.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\System.Text.Json.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\de\Microsoft.Data.SqlClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.ManagedMachineAPI.Contracts.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.Models.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Retry.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.Authentication.Models.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\Microsoft.VisualStudio.Validation.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.KeyVault.WebKey.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ISecondaryBrokerControl.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.DistributedTracing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\Citrix.Base.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\BrokerEnvTests.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.ServiceModel.Primitives.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.IO.FileSystem.AccessControl.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Exceptions.Interfaces.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\32\ccauthcpp_dynamic.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaCommandLine.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\BrokerComponentCommon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.ComponentModel.Annotations.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaSiteServices.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\AWSSDK.EC2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\zh-CN\CloudCommon.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.ConfigLogging.Wcf.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\BrokerServiceSupport.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.HadrModel.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Diagnostics.PerformanceCounter.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSICF8D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSICB14.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID2EE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Hostname.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ja\Microsoft.Data.OData.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Windows.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\Microsoft.Data.Edm.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaFilteringSdkSupport.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\BrokerServiceEventLogResources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipelines.Sockets.Unofficial.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\GpfxSettings.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.WorkspaceAnalytics.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\CloudCommon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.HostView.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Memory.Data.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Buffers.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\System.Web.Http.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Interop.NetFwTypeLib.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.SqlServer.Management.CollectorEnum.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.Wcf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\OpenTelemetry.Exporter.OpenTelemetryProtocol.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Retry.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\fr\Citrix.Base.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.XenDesktop.Cloud.DataStore.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.ManagedMachineAPI.AddInSideAdapter.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID211.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.ServiceBus.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.HypervisorCommunicationsLibrary.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\cs\Microsoft.VisualStudio.Validation.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.DelegatedAdmin.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Core.Api.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\Citrix.Xaxd.Utilities.AssemblyResolver.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Rest.Client.Interfaces.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.ConfigurationLogging.Rest.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Monitor.BrokerCodes.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\ru\Microsoft.VisualStudio.Validation.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Deployment.Compression.Cab.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\AlwaysOnTracing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\GpAnalyzer.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaProductInfo.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\DiscUtils.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Data.SqlClient.SNI.x86.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\AWS\System.Buffers.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\pt-BR\Microsoft.VisualStudio.Validation.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI99A3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\OperationalEvents.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.Azure.KeyVault.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\es\Citrix.Base.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaRegistry.Interface.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Common.Headers.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaLogging.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\FmaLogging.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Citrix\Broker\Service\Microsoft.IdentityModel.Clients.ActiveDirectory.dll	Jump to dropped file

Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe TID: 5832	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe TID: 5832	Thread sleep time: -7200000s >= -30000s
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe TID: 6196	Thread sleep count: 379 > 30
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe TID: 6196	Thread sleep count: 97 > 30
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe TID: 5832	Thread sleep time: -7199888s >= -30000s
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe TID: 2380	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe TID: 2436	Thread sleep count: 34 > 30
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe TID: 2436	Thread sleep time: -31359464925306218s >= -30000s
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe TID: 2436	Thread sleep time: -7200000s >= -30000s
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe TID: 7132	Thread sleep count: 4214 > 30
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe TID: 2044	Thread sleep count: 5625 > 30
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe TID: 2468	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe TID: 2468	Thread sleep time: -100000s >= -30000s
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe TID: 6240	Thread sleep count: 424 > 30
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe TID: 6240	Thread sleep count: 199 > 30
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe TID: 6924	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe TID: 6936	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe TID: 4704	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Thread delayed: delay time: 7200000
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Thread delayed: delay time: 7199888
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Thread delayed: delay time: 7200000
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Thread delayed: delay time: 922337203685477

Source: DiscUtils.dll4.4.dr	Binary or memory string: EFI%VMware File System
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp, Citrix.HypervisorCommunicationsLibrary.dll.4.dr, Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr	Binary or memory string: VirtualMachineState
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	Binary or memory string: ActionEurn:ps/IHypervisorCallbacks/ValidateVirtualMachineConfigurationUpdateT
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	Binary or memory string: Actionmurn:ps/IHypervisorCommunicationsLibraryInterface/GetVmNetworkInterfaceDetailsRemoteHclCommunicationFaultFaultT
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: `C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\BlankVhdTemplate.vhd
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CallerMemberNameAttributeTargetFrameworkAttributeAssemblyDelaySignAttributeAssemblyFileVersionAttributeAssemblyInformationalVersionAttributeAssemblyConfigurationAttributeAssemblyDescriptionAttributeInternalsVisibleToAttributeServiceBehaviorAttributeRefSafetyRulesAttributeCompilationRelaxationsAttributeAssemblyProductAttributeAssemblyCopyrightAttributeCLSCompliantAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributeByteget_Valueset_ValuemetadataValueGetValuenewValueset_KeepAliveAddCustomFieldDefPrivilegePolicyDefserviceRefovfRefresourcePoolRefvmRefmachineFolderReffolderRefsessionManagerRefcustomFieldsManagerRefhostRefLogOffSystem.ThreadingMicrosoft.Extensions.LoggingSystem.Runtime.VersioningToBase64StringEscapeDataStringSecureStringToStringPluginLogTraceMsgStopwatchFlushget_VhdTemplatePathimageDiskPathvmwareFolderPathdatacenterPathpathget_LengthGetFileLengthfileLengthset_ContentLengthVimApiget_AbsoluteUriproxyUriset_ServerCertificateCustomValidationCallbackget_SectorsPerTracklogonLockDiscUtils.VmdkSeekToSplunkSuspendVM_TaskCloneVM_TaskRelocateVM_TaskCreateVM_TaskPowerOffVM_TaskReconfigVM_TaskPowerOnVM_TaskResetVM_TaskDeleteDatastoreFile_TaskMoveDatastoreFile_TaskRename_TaskSearchDatastore_TaskCheckRelocate_TaskCreateVirtualDisk_TaskDeleteVirtualDisk_TaskCopyVirtualDisk_TaskRemoveAllSnapshots_TaskCreateSnapshot_TaskRevertToSnapshot_TaskDestroy_TaskReadDiskUploadDiskisStreamingDiskIVirtualDiskFromVirtualDiskPopulateNewDiskop_GreaterThanOrEqualSystem.ServiceModelSystem.ComponentModelCitrix.Xaxd.NgsTunnelLogLevelCallVirtualCenter.Operations.dllHttpWebClientProtocolget_Urlset_UrlvimServiceUrlserviceUrlbaseUrlGetDatastoreFileAccessUrlGetDatastoreFolderAccessUrlGetResponseStreamSparseStreamdiskStreamFromStreamOpenStreamGetRequestStreamSparseMemoryStreamget_ItemDiscFileSystemInMemoryFileSystemloggedOnLogOnsuppressPowerOnBooleanTimeSpanX509ChainchainCreateDomainTestHypCertificateInNewAppDomainget_CurrentDomainSeekOriginLoginget_RevisionGetVmwareVersionvmwareVersioncurrentStateVersionget_apiVersionversionUserSessionsessionDiskImageFileSpecificationCitrix.HCL.TlsCertificateVerificationSystem.Security.AuthenticationNGSLocationCheckStorageLocationget_SetupInformationSystem.Globalizationset_LoaderOptimizationactionSystem.ReflectionfunctionIFileDiskDefinitiondiskDefinitionset_Positionget_IsFatFilePartitionSearchOptionsearchOptionIOExceptionWebExceptionNotImplementedExceptionFileNotFoundExceptionManagedMachineGeneralExceptionArgumentNullExceptionVCenterSslCertificateAuthenticationExceptionInvalidOperationExceptionNotAuthorizedForOperationExceptionget_InnerExceptionVCenterMisconfiguredEndpointsExceptionArgumentExceptionsnapshotDescriptionHypervisorsCommonsearchPatternCultureInfoStoreCertificateInfoFileSystemInfoAboutInfoDirectoryInfoCreateInstanceAndUnwrapcdpOwnershipStopSystem.Net.HttpAppDomainSetupSystem.LinqILogProviderIFormatProviderDiskImageBuilderStringBuilderDiskBuilderdatastoreAccessUrlBuilderdestinationFoldertargetFoldersenderget_HeadsPerCylinder
Source: RegisterPlugins.exe, 00000024.00000002.2064004697.000001A1F83B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaLogging.dll`
Source: BrokerService.exe, 0000001D.00000002.1910073183.0000019492A61000.00000004.00000800.00020000.00000000.sdmp, BrokerService.exe, 0000001F.00000002.2546935378.0000025204A21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: BrokerService.exe, 0000001F.00000002.2556016980.00000254519F2000.00000002.00000001.01000000.00000049.sdmp	Binary or memory string: W.VMToolsStateT
Source: BrokerService.exe, 0000001D.00000002.1909653018.0000019491202000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: <MissingVirtualMachineReportingEnabled>k__BackingField
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ZC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\VimService.dllCitr@{3
Source: Broker_Service_x64.msi	Binary or memory string: DiscUtilsVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268Hp
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: eC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.Xaxd.NgsTunnel.dll
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	Binary or memory string: ActionMurn:ps/IHypervisorCommunicationsLibraryInterface/GetVmNetworkInterfaceDetailsT
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: GetVmwareVersion
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: #VMware\VirtualCenter.Operations.dll
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	Binary or memory string: ConvertArrayUsingCreateVmNetworkInterfaceDetailsConverter
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\VimService.dll
Source: Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr	Binary or memory string: <14>__CreateVmNetworkInterfaceDetails
Source: BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp	Binary or memory string: ERROR: CheckResetVirtualMachineOperations returned unknown operationId: {0}[QueryMcsForCompletedResetActions: Failed: {0}yStartPendingPowerActions: Invalid credentials, no work to dokStartPendingPowerActions: MaxActions=0, no work to doQStartPendingPowerActions: MaxActions={0}wStartPendingPowerActions: No pending actions, no work to do/StartPendingPowerAction
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp, BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp	Binary or memory string: VirtualMachineStateResult
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	Binary or memory string: Action[urn:ps/IHypervisorCallbacks/ValidateVirtualMachineConfigurationUpdateRemotePluginFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: ActionEhttp://tempuri.org/IMachineCreationApi/PollVirtualMachineCapabilitiesT
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: uC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.HCL.TlsCertificateVerification.dll
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: hC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\VirtualCenter.Interfaces.dll
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp, Citrix.HypervisorCommunicationsLibrary.dll.4.dr, Citrix.HypervisorCommunicationsLibrary.HostView.dll.4.dr	Binary or memory string: get_VirtualMachineId
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: #VMware\VirtualCenter.Interfaces.dll
Source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: VmwareCloudOnAwsEnabled
Source: BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp	Binary or memory string: McsResetVMqMcsResetVM: proxy.StartResetVirtualMachine performed {0}
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: UCitrix.InterServiceApiSpecifications.MachineCreationService.VirtualMachineStateResultX
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: ReplyActionGhttp://tempuri.org/IMachineCreationApi/StartResetVirtualMachineResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: <GetProvisionedVirtualMachineBySid>b__0
Source: Broker_Service_x64.msi	Binary or memory string: BlankDiskVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: Citrix.HypervisorCommunicationsLibrary.HostView.dll.4.dr	Binary or memory string: <VirtualMachineId>k__BackingField
Source: BrokerService.exe, 0000001F.00000002.2556016980.00000254519F2000.00000002.00000001.01000000.00000049.sdmp	Binary or memory string: VirtualMachineNotFound
Source: BrokerService.exe, 0000001F.00000002.2556016980.00000254519F2000.00000002.00000001.01000000.00000049.sdmp	Binary or memory string: <VMToolsState>k__BackingField
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: <CheckResetVirtualMachineOperations>b__0
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: ReplyActionNhttp://tempuri.org/IMachineCreationApi/CheckVirtualMachinePowerActionsResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: TerminateTask)UpdateProvVmHostVmId=PollVirtualMachineCapabilitiesMGetMaximumMachineCapabilitiesQuerySize
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: ReplyActionNhttp://tempuri.org/IMachineCreationApi/BeginVirtualMachineStateChangesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: ZCitrix.InterServiceApiSpecifications.MachineCreationService.VirtualMachinePowerStateResult
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: VirtualMachineStateResultT
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	Binary or memory string: ActionNurn:ps/IHypervisorCallbacks/GetVmNetworkInterfaceDetailsRemotePluginFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: WindowsActivationTypeProvisionedVirtualMachineField
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: ActionIhttp://tempuri.org/IMachineCreationApi/CheckResetVirtualMachineOperationsT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: UCitrix.InterServiceApiSpecifications.MachineCreationService.VirtualMachineStateResult
Source: BrokerService.exe, 0000001F.00000002.2553794425.0000025450D72000.00000002.00000001.01000000.0000003E.sdmp	Binary or memory string: VirtualMachineType
Source: RegisterPlugins.exe, 00000024.00000002.2064004697.000001A1F83B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\*
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp, Citrix.HypervisorCommunicationsLibrary.dll.4.dr	Binary or memory string: UnknownVirtualMachine
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp, BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp	Binary or memory string: StartVirtualMachinePowerActions
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: ProvisionedVirtualMachineT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: ActionEhttp://tempuri.org/IMachineCreationApi/StartVirtualMachinePowerActionT
Source: svchost.exe, 00000006.00000002.2538604510.0000016D5DC2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: RegisterPlugins.exe, 00000024.00000002.2064004697.000001A1F83B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.Xaxd.NgsTunnel.dll
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	Binary or memory string: Actionzurn:ps/IHypervisorCommunicationsLibraryInterface/ValidateVirtualMachineConfigurationUpdateRemoteHclCommunicationFaultFaultT
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: oC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Microsoft.Extensions.ObjectPool.dll
Source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: VmwarePluginBrowseVmFolder
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: get_WindowsActivationTypeProvisionedVirtualMachine
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: InterService3GetProvisioningSchemeByIdCGetProvisionedVirtualMachineBySid1StartResetVirtualMachine-CheckResetVmOperationsECheckResetVirtualMachineOperations=StartVirtualMachinePowerAction?StartVirtualMachinePowerActions?CheckVirtualMachinePowerActionsIBeginVirtualMachinePowerStateChangesICheckVirtualMachinePowerStateChanges?BeginVirtualMachineStateChanges?CheckVirtualMachineStateChanges;PollVirtualMachinePowerStates;GetMaximumPowerStateQuerySize
Source: BrokerService.exe, 0000001F.00000002.2556016980.00000254519F2000.00000002.00000001.01000000.00000049.sdmp	Binary or memory string: set_VMToolsState
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ]C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\VirtualCenter.dll
Source: RegisterPlugins.exe, 00000024.00000002.2064004697.000001A1F83B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\RestSharp.dllRq"
Source: BrokerService.exe, 0000001D.00000002.1910073183.0000019492A61000.00000004.00000800.00020000.00000000.sdmp, BrokerService.exe, 0000001F.00000002.2546935378.0000025204A21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: !Hyper-V PowerShell Direct Service
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: ActionFhttp://tempuri.org/IMachineCreationApi/CheckVirtualMachineStateChangesT
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.Xaxd.Authentication.Models.dll
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: _C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Newtonsoft.Json.dll
Source: Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr	Binary or memory string: numberOfVMs#virtualMachineUid!storageLocations-primaryStorageLocation3secondaryStorageLocations9allSecondaryStorageLocations
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: mC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\PvsVmTemplateForPreparationVM.vhd
Source: Broker_Service_x64.msi	Binary or memory string: HCLTlsCertificateVerificationVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268"!
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: jC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\StandardSocketsHttpHandler.dll
Source: Broker_Service_x64.msi	Binary or memory string: TemplateDiskForPreparationVMVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268&`
Source: BrokerAdminService.dll.4.dr	Binary or memory string: VMToolsState
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: <PollVirtualMachineCapabilities>b__0
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: <StartVirtualMachinePowerAction>b__0
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: ReplyActionNhttp://tempuri.org/IMachineCreationApi/StartVirtualMachinePowerActionsResponse
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	Binary or memory string: ReplyActionburn:ps/IHypervisorCommunicationsLibraryInterface/ValidateVirtualMachineConfigurationUpdateResponse
Source: Broker_Service_x64.msi	Binary or memory string: HypervisorsCommonVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: Broker_Service_x64.msi	Binary or memory string: DiscUtilsVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: hC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\VirtualCenter.Operations.dll21
Source: svchost.exe, 00000006.00000002.2539358038.0000016D5DC8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	Binary or memory string: VmNetworkInterfaceIpAddressAdapter
Source: DiscUtils.dll4.4.dr	Binary or memory string: VirtualMachineBuilder
Source: RegisterPlugins.exe, 00000024.00000002.2064004697.000001A1F83B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\VimService.dll_q-
Source: upgrade_site_7.21.0.0-7.22.0.0.xdu.4.dr	Binary or memory string: WxbJVeXVMxCb0ayFcvmqyKhgFsZkNqbzbyTXhzSSzGLv1BvIGhaVJjAEQPOP5qYZN4vfgP7ipDE9
Source: Citrix.HypervisorCommunicationsLibrary.dll.4.dr	Binary or memory string: VmwarePluginFactoryName
Source: Broker_Service_x64.msi	Binary or memory string: SUx RestSharpVMware.C98D514E_DF5A_4FD6_9A45_A29017538268xC
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: ReplyActionMhttp://tempuri.org/IMachineCreationApi/StartVirtualMachinePowerActionResponse
Source: BrokerService.exe, 0000001F.00000002.2546935378.0000025204A21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: Broker_Service_x64.msi	Binary or memory string: NewtonsoftJsonVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	Binary or memory string: CreateVmNetworkInterfaceIpAddress
Source: Broker_Service_x64.msi	Binary or memory string: FmaLoggingVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268H~H
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: ActionKhttp://tempuri.org/IMachineCreationApi/BeginVirtualMachinePowerStateChangesT
Source: BrokerService.exe, 0000001D.00000002.1909653018.0000019491202000.00000002.00000001.01000000.0000000C.sdmp, BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp	Binary or memory string: get_MissingVirtualMachineReportingEnabled
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: <StartResetVirtualMachine>b__0
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VmwarePluginCloudDDC
Source: BrokerService.exe, 0000001F.00000002.2556016980.00000254519F2000.00000002.00000001.01000000.00000049.sdmp	Binary or memory string: get_VMToolsState
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmwareFolderPath
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VmwarePluginCloudDDCy
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: VirtualMachinePowerStateResult
Source: BrokerService.exe, 0000001D.00000002.1910073183.0000019492A61000.00000004.00000800.00020000.00000000.sdmp, BrokerService.exe, 0000001F.00000002.2546935378.0000025204A21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: BrokerService.exe, 0000001D.00000002.1910073183.0000019492A61000.00000004.00000800.00020000.00000000.sdmp, BrokerService.exe, 0000001F.00000002.2546935378.0000025204A21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: -Hyper-V Remote Desktop Virtualization Service
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: UCitrix.InterServiceApiSpecifications.MachineCreationService.ProvisionedVirtualMachineK
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: ReplyActionMhttp://tempuri.org/IMachineCreationApi/PollVirtualMachineCapabilitiesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: VirtualMachineIdField
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: ActionHhttp://tempuri.org/IMachineCreationApi/GetProvisionedVirtualMachineBySidT
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp, BrokerService.exe, 0000001F.00000002.2553794425.0000025450D72000.00000002.00000001.01000000.0000003E.sdmp, Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr	Binary or memory string: VirtualMachinePowerAction
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Citrix.PoolManagement.VMManager.VmmImplementation.Vmware.Interfaces
Source: Broker_Service_x64.msi	Binary or memory string: FmaLoggingVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp, BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp	Binary or memory string: StartVirtualMachinePowerAction
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: <PollVirtualMachinePowerStates>b__0
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: set_WindowsActivationTypeProvisionedVirtualMachine
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: XC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaUtils.dll
Source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: McsUpdateProvSchemeTaskVmwareFactory
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: <CheckVirtualMachineStateChanges>b__0
Source: BrokerService.exe, 0000001D.00000002.1910073183.0000019492A61000.00000004.00000800.00020000.00000000.sdmp, BrokerService.exe, 0000001F.00000002.2546935378.0000025204A21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: Broker_Service_x64.msi	Binary or memory string: RestSharpVMware.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp, BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp	Binary or memory string: BeginVirtualMachineStateChanges
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	Binary or memory string: ConvertVirtualMachineIdentifierArrayToWcf
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	Binary or memory string: Action8urn:ps/IHypervisorCallbacks/GetVmNetworkInterfaceDetailsT
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	Binary or memory string: RemoteHCLClient.Hypervisor::ValidateVirtualMachineConfigurationUpdate originalSpecification.Name=9, updatedSpecification.Name=
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp, BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp	Binary or memory string: CheckResetVirtualMachineOperations
Source: Broker_Service_x64.msi	Binary or memory string: FmaUtilsVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr	Binary or memory string: <GetVmNetworkInterfaceDetails>b__1
Source: Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr	Binary or memory string: <GetVmNetworkInterfaceDetails>b__0
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\VirtualCenter.dll-
Source: svchost.exe, 00000006.00000002.2538142000.0000016D5DC02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: BeginVirtualMachinePowerStateChanges
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: mC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.HCL.DistributedTracing.dll153_0<>@{3
Source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: VmwareCloudOnGcpEnabled
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\RestSharp.dll
Source: RegisterPlugins.exe, 00000024.00000002.2064004697.000001A1F83B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.Xaxd.Authentication.Models.dll
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp, Citrix.HypervisorCommunicationsLibrary.dll.4.dr, Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr	Binary or memory string: virtualMachineUid
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	Binary or memory string: ConvertVirtualMachineStateToHcl
Source: Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr	Binary or memory string: MachineManagerFactoryMaximumOperationsInProgressAbsoluteDefaultkMachineManagerFactoryMaximumOperationIssueRateDefaultEMachineManagerFactoryLocalizedNameSMachineManagerFactoryLocalizedDescription[MachineManagerFactoryExampleConnectionAddressiMachineManagerFactoryValidateConnectionAddressFormat!EnumerateRegions'CreateSecurityGroup'DeleteSecurityGroup;AuthorizeSecurityGroupIngress9AuthorizeSecurityGroupEgress5RevokeSecurityGroupIngress3RevokeSecurityGroupEgress-SerializeSecurityGroup1DeserializeSecurityGroup9DiskImageToInfrastructureUid+ChangeDiskPersistence/PrepareDiskIdForDisplay!GetMachineStates?GetMaximumMachineStateQuerySize3GetFullMachineDescriptionGGetUpdateMachineCustomDataBatchSize/UpdateMachineCustomData;ValidateSetProvisioningSchemeSValidateVirtualMachineConfigurationUpdate-ValidateNewImageScheme3ValidateProvInventoryItem;SetMachineCatalogResourceTagsAGetProvOrphanedResourceUnmanaged=GetProvOrphanedResourceManagedISetMachineResourceTagsWithCustomData9GetVmNetworkInterfaceDetails)IsPageFileRedirected5GetWriteBackCacheDiskIndexCValidateProvMetadataConfiguration#configurationName%configurationValue+MergeCustomProperties+DisposeMachineManagerMGetMaximumMachineCapabilitiesQuerySize#connectionDetails-GetMachineCapabilities+machineIdToCustomData
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	Binary or memory string: CreateVmNetworkInterfaceDetails
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: Action?http://tempuri.org/IMachineCreationApi/StartResetVirtualMachineT
Source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: OrchVMWareResetProvVMDisk
Source: Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr	Binary or memory string: VmNetworkInterfaceDetailsAdapter
Source: Broker_Service_x64.msi	Binary or memory string: Microsoft.Extensions.ObjectPoolVmWare.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: ReplyActionShttp://tempuri.org/IMachineCreationApi/CheckVirtualMachinePowerStateChangesResponse
Source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: VmwarePluginSupportsDataDisk
Source: DiscUtils.dll4.4.dr	Binary or memory string: -DiscUtils.Xva.VirtualMachine+<get_Disks>d__11>
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp, BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp	Binary or memory string: PollVirtualMachinePowerStates
Source: Broker_Service_x64.msi	Binary or memory string: TemplateDiskForPvsBdmVMware.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: }8Citrix.PoolManagement.VMManager.VmmImplementation.Vmware
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	Binary or memory string: IsDumSupported=IsLocalStorageCachingAvailable9InfrastructureUidToDiskImage9DiskImageToInfrastructureUid+ChangeDiskPersistence/PrepareDiskIdForDisplay?GetMaximumMachineStateQuerySize3GetFullMachineDescription/UpdateMachineCustomData;ValidateSetProvisioningSchemeSValidateVirtualMachineConfigurationUpdate-ValidateNewImageScheme)IsPageFileRedirected+MergeCustomProperties9GetVmNetworkInterfaceDetailsAGetProvOrphanedResourceUnmanaged=GetProvOrphanedResourceManaged;SetMachineCatalogResourceTagsISetMachineResourceTagsWithCustomData5GetWriteBackCacheDiskIndexMGetMaximumMachineCapabilitiesQuerySize-GetMachineCapabilitiesCValidateProvMetadataConfiguration5RunStorageEnvironmentTests5RunNetworkEnvironmentTestsCRunInfrastructureEnvironmentTests;RunConnectionEnvironmentTests+RunVmEnvironmentTests%GetLocalizedStringAReadVMMetadataFromMachineProfile3ValidateProvInventoryItemYMaximumOperationsInProgressPercentageDefault_GetMaximumOperationsInProgressPercentageDefaultUMaximumOperationsInProgressAbsoluteDefault[GetMaximumOperationsInProgressAbsoluteDefaultAMaximumOperationIssueRateDefaultGGetMaximumOperationIssueRateDefault
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: <StartVirtualMachinePowerActions>b__0
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp, Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr	Binary or memory string: Citrix.ManagedMachineAPI.VirtualMachinePowerAction, Citrix.ManagedMachineAPI, Version=2.5.0.0, Culture=neutral, PublicKeyToken=a80ce61cfbf8b47a
Source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: StudioVMwareMachineProfile
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: IVmwareOperations
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp, BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp	Binary or memory string: StartResetVirtualMachine
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmwareVersion
Source: BrokerService.exe, 0000001D.00000002.1910073183.0000019492A61000.00000004.00000800.00020000.00000000.sdmp, BrokerService.exe, 0000001F.00000002.2546935378.0000025204A21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $Hyper-V Volume Shadow Copy Requestor
Source: Broker_Service_x64.msi	Binary or memory string: TemplateDiskForPreparationVMVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VirtualMachineMovePriority
Source: DiscUtils.dll4.4.dr	Binary or memory string: -DiscUtils.Xva.VirtualMachine+<get_Disks>d__11
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp, BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp	Binary or memory string: CheckVirtualMachinePowerActions
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	Binary or memory string: ActionZurn:ps/IHypervisorCommunicationsLibraryInterface/ValidateVirtualMachineConfigurationUpdateT
Source: Broker_Service_x64.msi	Binary or memory string: NewtonsoftJsonVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268H
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp, BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp	Binary or memory string: PollVirtualMachineCapabilities
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: ReplyActionShttp://tempuri.org/IMachineCreationApi/BeginVirtualMachinePowerStateChangesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp, BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp, Citrix.HypervisorCommunicationsLibrary.HostView.dll.4.dr	Binary or memory string: set_VirtualMachineId
Source: svchost.exe, 00000006.00000002.2539358038.0000016D5DC8F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: BrokerService.exe, 0000001F.00000002.2546935378.0000025204A21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: VirtualMachinePowerStateResultT
Source: BrokerService.exe, 0000001F.00000002.2553794425.0000025450D72000.00000002.00000001.01000000.0000003E.sdmp, DiscUtils.dll4.4.dr	Binary or memory string: VirtualMachine
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: aC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\HypervisorsCommon.dll
Source: BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp	Binary or memory string: get_MissingVirtualMachineReporting
Source: svchost.exe, 00000006.00000002.2538849833.0000016D5DC4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: olume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D: @
Source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: McsTaskNewProvSchemeVmwareFactory
Source: svchost.exe, 00000006.00000002.2539213847.0000016D5DC80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: RegisterPlugins.exe, 00000024.00000002.2064004697.000001A1F83B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\VirtualCenter.dllql
Source: DiscUtils.dll4.4.dr	Binary or memory string: VMware Swap
Source: Broker_Service_x64.msi	Binary or memory string: FmaEnvVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: UCitrix.InterServiceApiSpecifications.MachineCreationService.ProvisionedVirtualMachine
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\bdm.vhd
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\DiscUtils.dll
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: virtualMachineIds
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: <CheckVirtualMachinePowerActions>b__0
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: ReplyActionNhttp://tempuri.org/IMachineCreationApi/CheckVirtualMachineStateChangesResponse
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: ActionFhttp://tempuri.org/IMachineCreationApi/StartVirtualMachinePowerActionsT
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: KC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware
Source: upgrade_site_7.21.0.0-7.22.0.0.xdu.4.dr	Binary or memory string: OSjCVivmCi4A1SwxtCrF70RKNYwt9M4Mw+haRQv1ZSqCZy24UIN9k81sw0+HD77S/b5fuas5w5W8
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: CheckVirtualMachinePowerStateChanges
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ]C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\PvsVmTemplate.vhd
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: ZCitrix.InterServiceApiSpecifications.MachineCreationService.VirtualMachinePowerStateResultZ
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: ReplyActionQhttp://tempuri.org/IMachineCreationApi/CheckResetVirtualMachineOperationsResponse
Source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: RemoteVmwareSDKOnly
Source: svchost.exe, 00000006.00000002.2539213847.0000016D5DC64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000e1}
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: KC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware21
Source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: McsTaskNewProvVMVmwareFactory
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp, Citrix.HypervisorCommunicationsLibrary.dll.4.dr, Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr	Binary or memory string: VirtualMachineIdentifier
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: virtualMachineId
Source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: MissingVirtualMachineReporting
Source: svchost.exe, 00000006.00000002.2539358038.0000016D5DC8F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "@\??\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	Binary or memory string: Actionpurn:ps/IHypervisorCommunicationsLibraryInterface/ValidateVirtualMachineConfigurationUpdateRemotePluginFaultFaultT
Source: HypervisorsCommon.dll0.4.dr	Binary or memory string: HCL-VMware: EncodeUTF8AndBase64: Decoding failed because the input byte sequence cannot be mapped to Unicode.
Source: Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr	Binary or memory string: <ValidateVirtualMachineConfigurationUpdate>b__1
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp, Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr	Binary or memory string: <ValidateVirtualMachineConfigurationUpdate>b__0
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: ReplyActionLhttp://tempuri.org/IMachineCreationApi/PollVirtualMachinePowerStatesResponse
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaEnv.dll
Source: Broker_Service_x64.msi	Binary or memory string: TemplateDiskVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: ActionDhttp://tempuri.org/IMachineCreationApi/PollVirtualMachinePowerStatesT
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 8Citrix.PoolManagement.VMManager.VmmImplementation.Vmware
Source: HypervisorsCommon.dll0.4.dr	Binary or memory string: IVmNetworkInterfaceDetails
Source: Broker_Service_x64.msi	Binary or memory string: w TemplateDiskForPvsBdmVMware.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: GetProvisionedVirtualMachineBySid
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMwareHypervisorFactory
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ZC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\FmaLogging.dll
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp, BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp	Binary or memory string: CheckVirtualMachineStateChanges
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	Binary or memory string: ReplyActionUurn:ps/IHypervisorCommunicationsLibraryInterface/GetVmNetworkInterfaceDetailsResponse
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	Binary or memory string: ReplyActionMurn:ps/IHypervisorCallbacks/ValidateVirtualMachineConfigurationUpdateResponse
Source: upgrade_site_7.16.0.0-7.17.0.0.xdu.4.dr	Binary or memory string: uP2HZilPzw/PtjT+pwt3WpPeQhaOjiP7XDzAcFFOHAFhgFsMIDLHJXfmQeFJhhQWMDTSCVMhWEUb
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: <CheckVirtualMachinePowerStateChanges>b__0
Source: BrokerAdminService.dll.4.dr	Binary or memory string: Citrix.Broker.Admin.SDK.VMToolsState, BrokerSDKDefinition, Version=7.41.1100.0, Culture=neutral, PublicKeyToken=a80ce61cfbf8b47a
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	Binary or memory string: ActionXurn:ps/IHypervisorCallbacks/GetVmNetworkInterfaceDetailsRemoteHclCommunicationFaultFaultT
Source: Broker_Service_x64.msi	Binary or memory string: HypervisorsCommonVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268H
Source: Broker_Service_x64.msi	Binary or memory string: HCLTlsCertificateVerificationVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: IBrokerDAL.dll.4.dr	Binary or memory string: MachineToolStateToVMToolState
Source: Citrix.HypervisorCommunicationsLibrary.dll.4.dr	Binary or memory string: VmwareFactory
Source: BrokerService.exe, 0000001D.00000002.1910073183.0000019492A61000.00000004.00000800.00020000.00000000.sdmp, BrokerService.exe, 0000001F.00000002.2546935378.0000025204A21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $Hyper-V Time Synchronization Service
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	Binary or memory string: <ConvertVirtualMachineIdentifierArrayToWcf>b__28_0
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: ActionFhttp://tempuri.org/IMachineCreationApi/CheckVirtualMachinePowerActionsT
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp, Citrix.HypervisorCommunicationsLibrary.dll.4.dr, Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr	Binary or memory string: ValidateVirtualMachineConfigurationUpdate
Source: BrokerService.exe, 0000001F.00000002.2546935378.0000025204A21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VmwareFactoryq]G
Source: upgrade_site_5.1.0.0-5.6.0.0.xdu.4.dr	Binary or memory string: rtJP7ypXLZDwYd9APdcFLaHw+hXl3GbFbPkxMRlyzJQXoClmFwuQEMu7OUX+sJ871LnfUex2NbOp
Source: BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp	Binary or memory string: QueryMcsForCompletedResetActions: CheckResetVirtualMachineOperations returned {0} completed operations
Source: BrokerService.exe, 0000001D.00000002.1914776721.00000194AB432000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: VmwarePluginMCSPowerManaged
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: <BeginVirtualMachineStateChanges>b__0
Source: upgrade_site_7.24.2000.0-7.24.0.0.xdu.4.dr	Binary or memory string: fcbqcue5k5xmk8DvRfOiM2CgvtxZp44KipdW1TOpZVVHgfs9U3YJEuT329ELtQnpvZB+uNUAWR/X
Source: BrokerService.exe, 0000001D.00000002.1910073183.0000019492A61000.00000004.00000800.00020000.00000000.sdmp, BrokerService.exe, 0000001F.00000002.2546935378.0000025204A21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: ReplyActionPhttp://tempuri.org/IMachineCreationApi/GetProvisionedVirtualMachineBySidResponse
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	Binary or memory string: numberOfVMs-primaryStorageLocation3secondaryStorageLocations#virtualMachineUid!storageLocations9allSecondaryStorageLocations
Source: RegisterPlugins.exe, 00000024.00000002.2064004697.000001A1F83B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Newtonsoft.Json.dllfqv
Source: Broker_Service_x64.msi	Binary or memory string: FmaUtilsVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268H
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Citrix.PoolManagement.VMManager.VmmImplementation.Vmware.VmwareFactory, VirtualCenter, Version=7.41.1100.0, Culture=neutral, PublicKeyToken=a80ce61cfbf8b47a
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	Binary or memory string: <ConvertVirtualMachineStateToHcl>b__21_0
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	Binary or memory string: Actioncurn:ps/IHypervisorCommunicationsLibraryInterface/GetVmNetworkInterfaceDetailsRemotePluginFaultFaultT
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: <BeginVirtualMachinePowerStateChanges>b__0
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Citrix.PoolManagement.VMManager.VmmImplementation.Vmware.VMwareHypervisorFactory, VirtualCenter, Version=7.41.1100.0, Culture=neutral, PublicKeyToken=a80ce61cfbf8b47a
Source: BrokerService.exe, 0000001F.00000002.2554655217.00000254515F2000.00000002.00000001.01000000.00000044.sdmp	Binary or memory string: MapToMachineState: Could not parse MCS's VirtualMachinePowerState '{0}' to an HCL MachineState for machine ID '{1}'
Source: RegisterPlugins.exe, 00000024.00000002.2064004697.000001A1F83B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\Citrix.HCL.TlsCertificateVerification.dll
Source: Broker_Service_x64.msi	Binary or memory string: FmaEnvVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268H
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Citrix.PoolManagement.VMManager.VmmImplementation.Vmware.VMwareHypervisorFactory, VirtualCenter, Version=7.41.1100.0, Culture=neutral, PublicKeyToken=a80ce61cfbf8b47aCategory@{3
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: ActionKhttp://tempuri.org/IMachineCreationApi/CheckVirtualMachinePowerStateChangesT
Source: Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr	Binary or memory string: GetVmNetworkInterfaceDetails
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	Binary or memory string: Actioneurn:ps/IHypervisorCallbacks/ValidateVirtualMachineConfigurationUpdateRemoteHclCommunicationFaultFaultT
Source: svchost.exe, 0000000B.00000002.2538332592.0000025BF022B000.00000004.00000020.00020000.00000000.sdmp, BrokerService.exe, 0000001F.00000002.2551474492.00000254503FB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: HypervisorsCommon.dll0.4.dr	Binary or memory string: IVmNetworkInterfaceIpAddress
Source: BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp	Binary or memory string: ReplyAction@urn:ps/IHypervisorCallbacks/GetVmNetworkInterfaceDetailsResponse
Source: Broker_Service_x64.msi	Binary or memory string: TemplateDiskVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: Broker_Service_x64.msi	Binary or memory string: BlankDiskVMwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OperationContractAttributeAssemblyProductAttributeAssemblyCopyrightAttributeCLSCompliantAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributemetadataValuevalueAddCustomFieldDefPrivilegePolicyDefserviceRefovfRefresourcePoolRefvmRefmachineFolderReffolderRefcustomFieldsManagerRefhostRefSystem.Runtime.VersioningimageDiskPathvmwareFolderPathdatacenterPathpathVimApiUriDiscUtils.VmdkSuspendVM_TaskCloneVM_TaskRelocateVM_TaskCreateVM_TaskPowerOffVM_TaskReconfigVM_TaskPowerOnVM_TaskResetVM_TaskDeleteDatastoreFile_TaskMoveDatastoreFile_TaskRename_TaskSearchDatastore_TaskCheckRelocate_TaskCreateVirtualDisk_TaskDeleteVirtualDisk_TaskCopyVirtualDisk_TaskRemoveAllSnapshots_TaskCreateSnapshot_TaskRevertToSnapshot_TaskDestroy_TaskReadDiskUploadDiskIVirtualDiskSystem.ServiceModelVirtualCenter.Interfaces.dllSystemsuppressPowerOnTimeSpancurrentStateVersionCheckStorageLocationSystem.ReflectionIFileDiskDefinitiondiskDefinitionsnapshotDescriptioncdpdestinationFolderconnectionPeerserviceContentFileManagerserviceContentVirtualDiskManagerserviceContentSessionManagerserviceContentProvisioningCheckerRemoveSslHandlerCreateFiltersourceDatacenterdestinationDatacenterdatacenterConnectionDetailsAddInViewAdapter.ctorserviceContentPropertyCollectorCreateDescriptorpropertyFilterSpecsSystem.DiagnosticscloudConnectorIdsCitrix.PoolManagement.VMManager.VmmImplementation.Vmware.InterfacesVirtualCenter.InterfacesSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesSystem.ResourcesDebuggingModescreateParentDirectoriesRetrievePropertiesCitrix.HypervisorCommunicationsLibrary.Wcf.TypespartialUpdatesMicrosoft.CodeAnalysisIConnectionDetailsconnectionDetailsDiscUtilsOvfCreateDescriptorParamsIVmwareOperationsWaitOptionswaitOptionsconnectionAddressaddressAttributeTargetsObjectSystem.NetUpdateSetCertificateValidationResultOvfCreateDescriptorResultRetrieveServiceContentObjectContentget_Thumbprintset_ThumbprintAddAllowedThumbprintsslThumbprintconnectionThumbprintmaxUploadRetryCountmaxCheckStorageRetryCountbaseSnapshotShutdownGuestRebootGuesthostdiskUploadResponseTimeoutdiskUploadReadWriteTimeoutconnectionTimeoutLogoutWaitForUpdatesExfieldPolicyfieldDefPolicykeyCitrix.HypervisorCommunicationsLibrarymemoryMakeDirectorydirectoryVirtualMachineMovePrioritypriorityIWebProxyproxyav
Source: Broker_Service_x64.msi	Binary or memory string: k Microsoft.Extensions.ObjectPoolVmWare.C98D514E_DF5A_4FD6_9A45_A29017538268
Source: Citrix.HypervisorCommunicationsLibrary.dll.4.dr	Binary or memory string: SupportsGetVmNetworkInterfaceDetails
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: iC:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\VMware\VimService.XmlSerializers.dll
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A180001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %VMware\StandardSocketsHttpHandler.dll
Source: BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: ActionFhttp://tempuri.org/IMachineCreationApi/BeginVirtualMachineStateChangesT
Source: RegisterPlugins.exe, 00000024.00000002.2051062781.000001A1804BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\VirtualCenter.dll
Source: Broker_Service_x64.msi	Binary or memory string: HCLDistributedTracingVmwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268HV
Source: Broker_Service_x64.msi	Binary or memory string: HCLDistributedTracingVmwareFile.C98D514E_DF5A_4FD6_9A45_A29017538268

Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe

Process information queried: ProcessInformation

Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe

Memory allocated: page read and write | page guard

Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\AlwaysOnTracing.man"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\BrokerEventsProvider.man"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe "wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\HighAvailabilityEventsProvider.man"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\SysWOW64\sc.exe" sidtype CitrixBrokerService unrestricted	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\Citrix\Broker\Service\BrokerService.exe "C:\Program Files\Citrix\Broker\Service\BrokerService.exe" -Upgrade	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe "C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe" -Pipeline "C:\Program Files\Citrix\Broker\Service\Pipeline\"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe "C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe" -PluginsRoot "C:\Program Files\Common Files\Citrix\HCLPlugins\Hypervisor\v2.73.0.0\"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\BrokerService.exe VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\ComponentInterface.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaUtils.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utilities.AssemblyResolver.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaRegistry.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaLogging.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\BrokerCdeLibrary.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cdf.Net.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\LhcUtils.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaEnv.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\System.ServiceProcess.ServiceController.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\System.Configuration.ConfigurationManager.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.InteropServices.RuntimeInformation\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.InteropServices.RuntimeInformation.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Strings.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaRegistry.Interface.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Microsoft.Win32.Registry.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Settings.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSite.Interface.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Diagnostics.Tracing.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Logging.Abstractions.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaDalRuntime.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaTransactionScope.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.DistributedTracing.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaFeature.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.Interface.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.Interfaces.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.Models.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\System.Diagnostics.DiagnosticSource.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaDependencyInjection.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\System.Diagnostics.DiagnosticSource.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaCommandLine.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\UrlAclSupport.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\RegistryCounters.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Licensing.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Channels\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Channels.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Web\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Web.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\XmlMultiplexer.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\XmsInterfaces.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Wpnbr.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\VirtualSites.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\CtxAdmin.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\XmsRuntime.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\ProxyCommon.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\BrokerComponentCommon.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\EventLog.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\BrokerService.exe VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\ComponentInterface.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaUtils.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utilities.AssemblyResolver.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaRegistry.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Common\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Data.Common.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.StackTrace\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Diagnostics.StackTrace.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.Tracing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Diagnostics.Tracing.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Globalization.Extensions\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Globalization.Extensions.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Composition\v4.0_4.0.0.0__b77a5c561934e089\System.ComponentModel.Composition.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Sockets\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Sockets.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\System.ValueTuple.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.InteropServices.RuntimeInformation\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.InteropServices.RuntimeInformation.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Xml\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Xml.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Primitives.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.Cryptography.Algorithms\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.Cryptography.Algorithms.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.SecureString\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.SecureString.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.XPath.XDocument\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Xml.XPath.XDocument.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Caching\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Caching.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.RegularExpressions\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Design.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.ApplicationServices\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.ApplicationServices.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\v4.0_4.0.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Utilities.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.v4.0.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.v4.0.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaLogging.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\BrokerCdeLibrary.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Cdf.Net.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\LhcUtils.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaEnv.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\System.ServiceProcess.ServiceController.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\System.Configuration.ConfigurationManager.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Strings.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaRegistry.Interface.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Microsoft.Win32.Registry.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.Settings.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSite.Interface.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Diagnostics.Tracing.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Microsoft.Extensions.Logging.Abstractions.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaDalRuntime.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaTransactionScope.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.DistributedTracing.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaFeature.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.DistributedTracing.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.Interface.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Messaging\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.DurableInstancing\v4.0_4.0.0.0__31bf3856ad364e35\System.Runtime.DurableInstancing.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel.Selectors\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.Selectors.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activation\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Activation.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Activities.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xaml.Hosting\v4.0_4.0.0.0__31bf3856ad364e35\System.Xaml.Hosting.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.DurableInstancing\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.DurableInstancing.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Activities.Compiler.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Authentication.Interfaces.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaInterServiceManager.Models.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\System.Diagnostics.DiagnosticSource.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaDependencyInjection.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Settings.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\EventLog.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaWcf.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaEventLog.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaPlugin.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.DateTime.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Xaxd.Utils.Events.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Channels\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Channels.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Design\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Services.Design.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Linq.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Entity.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\BrokerComponentCommon.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\TicketStore.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\HostingManagementComponent.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaSiteServices.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\RemoteHCLClient.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\BrokerSDKDefinition.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.ManagedMachineAPI.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\BrokerComponent.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\WorkerChannelFactoryLoader.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\CbpControllerSdk.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.ServiceRegistration.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSiteManager.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaServiceCommon.VirtualSite.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\VirtualSites.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Citrix.Fma.Sdk.Utilities.Sids.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaActiveDirectory.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\FmaActiveDirectory.Interfaces.dll VolumeInformation
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\System.Security.Principal.Windows.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn\v4.0_4.0.0.0__b77a5c561934e089\System.AddIn.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn.Contract\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.AddIn.Contract.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HCL.Shared.Contracts.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HypervisorCommunicationsLibrary.Contracts.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HypervisorCommunicationsLibrary.Models.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.ManagedMachineAPI.Contracts.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.Xaxd.Utils.Strings.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaEnv.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaFeature.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaLogging.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FmaServiceStatus.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\FMAUtils.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Microsoft.Extensions.Logging.Abstractions.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Microsoft.Extensions.ObjectPool.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\PluginUtilities.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\System.Buffers.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\System.Memory.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HCL.DistributedTracing.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.DistributedTracing.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HCL.Shared.Adapters.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HCL.Shared.Contracts.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HCL.TlsCertificateVerification.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Http\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Http.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.HypervisorCommunicationsLibrary.AddInSideAdapter.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HypervisorCommunicationsLibrary.Contracts.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.ManagedMachineAPI.Contracts.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.MachineCreationAPI.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.ManagedMachineAPI.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HCL.Shared.Contracts.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\Citrix.ManagedMachineAPI.AddInSideAdapter.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.ManagedMachineAPI.Contracts.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.MachineCreationAPI.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HCL.Shared.Contracts.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\CustomProvisioningCommon.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.ManagedMachineAPI.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Citrix.HypervisorCommunicationsLibrary.Models.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.MachineCreationAPI.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\DiscUtils.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInSideAdapters\HypervisorsCommon.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.ManagedMachineAPI.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\System.Diagnostics.DiagnosticSource.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\Contracts\Microsoft.Extensions.Logging.Abstractions.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.ManagedMachineAPI.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.Wcf.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.ManagedMachineAPI.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.Wcf.Types.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.ManagedMachineAPI.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.MachineCreationAPI.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.ManagedMachineAPI.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.ManagedMachineAPI.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.DistributedTracing.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.Utilities.AssemblyResolver.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.Utilities.EnumCache.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.Xaxd.Utils.Strings.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Microsoft.WindowsAzure.Configuration.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\RemoteHCLCLient.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.HypervisorCommunicationsLibrary.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\Citrix.ManagedMachineAPI.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\System.Configuration.ConfigurationManager.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\System.Diagnostics.DiagnosticSource.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\System.Memory.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\System.Memory.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Citrix\Broker\Service\Pipeline\AddInViews\System.Runtime.CompilerServices.Unsafe.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn\v4.0_4.0.0.0__b77a5c561934e089\System.AddIn.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn.Contract\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.AddIn.Contract.dll VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe VolumeInformation
Source: C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn\v4.0_4.0.0.0__b77a5c561934e089\System.AddIn.dll VolumeInformation

Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{D68DDC3A-831F-4fae-9E44-DA132C1ACF46} STATE

Jump to behavior

Modifies Internet Explorer zone settings

Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones NULL
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 DisplayName
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 PMDisplayName
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 Description
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 Icon
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 LowIcon
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 CurrentLevel
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 Flags
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 DisplayName
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 PMDisplayName
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 Description
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 Icon
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 LowIcon
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 CurrentLevel
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 Flags
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 DisplayName
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 PMDisplayName
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 Description
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 Icon
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 LowIcon
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 CurrentLevel
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 Flags
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 DisplayName
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 PMDisplayName
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Description
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Icon
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 LowIcon
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 CurrentLevel
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Flags
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 DisplayName
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 PMDisplayName
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Description
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Icon
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 LowIcon
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 CurrentLevel
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Flags
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 1200
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 1200
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 1400
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 1400
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 2500
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones SelfHealCount
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 DisplayName
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 PMDisplayName

Modifies Internet Explorer zonemap settings

Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap ProxyByPass
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap IntranetName
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap UNCAsIntranet
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap AutoDetect
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults http
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults https
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults ftp
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults file
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults @ivt
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults shell
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults knownfolder
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap ProxyBypass
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap IntranetName
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap UNCAsIntranet
Source: C:\Program Files\Citrix\Broker\Service\BrokerService.exe	Registry key created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap AutoDetect

Source: svchost.exe, 00000009.00000002.2539757321.000001C94C702000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000009.00000002.2539757321.000001C94C702000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\SysWOW64\msiexec.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7613BA1FFF7E3EEF6E1BD42237A9A3D68FC2EE7E Blob

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Windows Management Instrumentation	21 Windows Service	21 Windows Service	23 Masquerading	OS Credential Dumping	141 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Service Execution	1 DLL Side-Loading	11 Process Injection	1 Modify Registry	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Browser Session Hijacking	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	311 Disable or Modify Tools	Security Account Manager	151 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	151 Virtualization/Sandbox Evasion	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	11 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	23 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Source	Detection	Scanner
C:\Program Files\Citrix\Broker\Service\32\ccauthcpp_dynamic.dll	0%	ReversingLabs
C:\Program Files\Citrix\Broker\Service\64\ccauthcpp_dynamic.dll	0%	ReversingLabs
C:\Program Files\Citrix\Broker\Service\Avro.dll	0%	ReversingLabs
C:\Program Files\Citrix\Broker\Service\Azure.Core.dll	0%	ReversingLabs
C:\Program Files\Citrix\Broker\Service\Azure.Identity.dll	0%	ReversingLabs
C:\Program Files\Citrix\Broker\Service\BouncyCastle.Cryptography.dll	0%	ReversingLabs
C:\Program Files\Citrix\Broker\Service\Castle.Core.dll	0%	ReversingLabs
C:\Program Files\Citrix\Broker\Service\Castle.Windsor.dll	0%	ReversingLabs
C:\Program Files\Citrix\Broker\Service\Citrix.Base.dll	0%	ReversingLabs
C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.AgentFoundation.Common.Classic.dll	0%	ReversingLabs
C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.AgentFoundation.Common.dll	0%	ReversingLabs
C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.AgentFoundation.OnPremiseCommon.dll	0%	ReversingLabs
C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.AgentFoundation.OnPremiseContracts.dll	0%	ReversingLabs
C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Core.Api.Client.dll	0%	ReversingLabs
C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Diagnostics.dll	0%	ReversingLabs
C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Logging.dll	0%	ReversingLabs
C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Monitoring.ApplicationInsights.Shared.dll	0%	ReversingLabs
C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Redis.dll	0%	ReversingLabs
C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Security.CCAuth.Managed.dll	0%	ReversingLabs
C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.ServiceRuntime.ApiClient.Core.dll	0%	ReversingLabs
C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.ServiceRuntime.ApiClient.dll	0%	ReversingLabs
C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.ServiceRuntime.Configuration.dll	0%	ReversingLabs
C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Trust.Api.Client.dll	0%	ReversingLabs
C:\Program Files\Citrix\Broker\Service\Citrix.CloudServices.Utilities.dll	0%	ReversingLabs
C:\Program Files\Citrix\Broker\Service\Citrix.IdentityManagement.Client.dll	0%	ReversingLabs
C:\Program Files\Citrix\Broker\Service\Citrix.IdentityManagement.Logging.dll	0%	ReversingLabs
C:\Program Files\Citrix\Broker\Service\Citrix.IdentityManagement.Utilities.dll	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
_ldap._tcp.	unknown	unknown	false	unknown
_ldap._tcp.	unknown	unknown	false	unknown
_ldap._tcp.	unknown	unknown	false	unknown
time.windows.com	unknown	unknown	false	unknown

Name	Source	Malicious	Reputation
http://tempuri.org/IMachineCreationApi/CheckVirtualMachinePowerActionsT	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://tempuri.org/IADIdentityApi/ValidateAndLockIdentitiesForPoolT	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://tempuri.org/ITrustApi/NewBearerTokenResponse	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://tempuri.org/IDelegatedAdminApiV2/CheckScopeAccessMultipleUsingBearerTokenT	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://tempuri.org/ITrustAdminQuery/SetServiceInstanceKeyResponse	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://schemas.citrix.com/CBP/IQueryAgent/QueryUsersFaultFaultT	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://schemas.citrix.com/CBP/ISessionManager/RebootResponsew	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://tempuri.org/IRetrieveAdAccount/SetAdAccountInUseAndClearPasswordT	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://tempuri.org/IHostApi/GetHostingUnitsAllResponse	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://tempuri.org/IAppLibApi/FetchAppVTelemetryT	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://schemas.datacontract.org/2004/07/Citrix.Trust.Logicw	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://standards.iso.org/iso/19770/-2/2009/schema.xsd	svchost.exe, 0000000A.00000002.2538923261.00000196A3C87000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2539402260.00000196A4502000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://tempuri.org/IFeatureChecksApi/IsFeatureEnabledT	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://tempuri.org/IDelegatedAdminApiV2/CheckScopeAccessUsingBearerTokenResponse	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://schemas.citrix.com/CBP/ISessionManager/ReRegisterNowT	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://schemas.citrix.com/CBP/IDummyInterface/useAddressHelperT	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://tempuri.org/ITrustApi/NewBearerTokenT	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://schemas.citrix.com/CBP/IDummyInterface/useLogonRequestHelperT	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://tempuri.org/IFeatureChecksApi/IsFeatureDefinedResponse	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://www.citrix.com/fmaplatform/VirtualSiteId	BrokerService.exe, 0000001D.00000002.1915578302.00000194AB522000.00000002.00000001.01000000.00000023.sdmp	false	unknown
http://schemas.datacontract.org/2004/07/Citrix.Trust.LogicX	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://tempuri.org/IHostApi/SetHypervisorConnectionMetadataT	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000002.00000003.1367443151.0000020960E62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1368998929.0000020960E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367707880.0000020960E5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369233575.0000020960E63000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://schemas.citrix.com/CBP/IConfiguration/SetResponses	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://tempuri.org/IRetrieveAdAccount/FilterServiceAccountByIdentityProviderTypeResponse	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://tempuri.org/IRetrieveAdAccount/SetAdAccountInUseAndClearPasswordNoSuchAdAccountFaultFaultT	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://tempuri.org/IADIdentityApi/SetServiceAccountHealthStatusByUidResponse	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://tempuri.org/ITrustApi/NewTrustVdaEnrollmentTokenResponse	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://tempuri.org/IADIdentityApi/GetIdentityContentInIdentityPoolByNameResponse	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://tempuri.org/IRetrieveAdAccount/RetrieveAdAccountT	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://schemas.citrix.com/CBP/ISessionManager/StartRecordingResponse	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000002.00000002.1369147638.0000020960E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367792280.0000020960E57000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://tempuri.org/ITrustApi/GetTrustVdaEnrollmentTokensResponse	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://schemas.citrix.com/CBP/ISessionManager/RebootResponse	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://schemas.citrix.com/CBP/IDynamicDataQuery/GetFaultFaultT	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://tempuri.org/ITrustAdminQuery/RegisterServiceInstanceFaultFaultT	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://tempuri.org/ITrustAdminQuery/UpdateServiceKeyT	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
https://dynamic.t	svchost.exe, 00000002.00000003.1367942743.0000020960E54000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://schemas.citrix.com/CBP/IDummyInterface/useSetRequestHelperResponse	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://schemas.citrix.com/CBP/ILaunch/CancelLaunchResponse	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://tempuri.org/IFeatureChecksApi/GetDefinedFeaturesT	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://tempuri.org/IMachineCreationApi/GetProvisioningSchemeByIdT	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://tempuri.org/IMachineCreationApi/UpdateProvVmHostVmIdResponse	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://tempuri.org/IMachineCreationApi/BeginVirtualMachineStateChangesResponse	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000002.00000002.1369147638.0000020960E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367792280.0000020960E57000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://schemas.citrix.com/CBP/ISessionManager/SendMessageT	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://tempuri.org/ITrustApi/UnregisterServiceInstanceT	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://schemas.citrix.com/CBP/IQueryAgent/QueryStartMenuShortcutIconT	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://schemas.citrix.com/CBP/IQueryAgent/QueryAllFtasResponsey	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://tempuri.org/IADIdentityApi/SetLockStateForADAccountT	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://tempuri.org/IDelegatedAdminApiV4/CheckScopeAccessUsingBearerTokenWithExcludedT	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://schemas.citrix.com/CBP/ILaunch/PrepareSessionT	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://tempuri.org/IHostApi/GetVolumeServiceBootstrappedTemplatesT	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://schemas.datacontract.org/2004/07/Citrix.Host.DataModelu	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://schemas.datacontract.org/2004/07/Citrix.Host.DataModels	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://schemas.datacontract.org/2004/07/Citrix.Host.DataModelr	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://tempuri.org/IHostApi/AddVolumeServiceBootstrappedTemplateResponse	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://schemas.datacontract.org/2004/07/Citrix.Host.DataModelx	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://tempuri.org/IADIdentityApi/GetIdentityByNameResponse	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://tempuri.org/IRetrieveAdAccount/InterfaceIsActiveResponse	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://schemas.citrix.com/CBP/ISessionManager/ReRegisterNowFaultFaultT	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000002.00000002.1369147638.0000020960E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367792280.0000020960E57000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://tempuri.org/ITrustApi/NewTrustVdaEnrollmentTokenFaultFaultT	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://tempuri.org/ITrustAdminQuery/GetServiceKeyNamesT	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://schemas.citrix.com/CBP/ISessionManager/StartRecordingFaultFaultT	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://schemas.citrix.com/CBP/IDummyInterface/useAddressHelperResponse	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://schemas.citrix.com/CBP/IDummyInterface/useGetReplyHelperResponse	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://tempuri.org/ITrustApi/AuthenticateHeaderResponse	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://schemas.citrix.com/CBP/IQueryAgent/QueryAllSessions2Response	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://www.citrix.com/hcl/opId#SourceMachineNameWhttp://www.citrix.com/hcl/sourceMachineName	BrokerService.exe, 0000001F.00000002.2557092445.0000025451AC2000.00000002.00000001.01000000.0000004B.sdmp, Citrix.HypervisorCommunicationsLibrary.Wcf.dll.4.dr	false	unknown
http://tempuri.org/IHostApi/GetVolumeServiceBootstrappedTemplatesResponse	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://schemas.citrix.com/CBP/IDummyInterface/useSiteInformationHelperResponse	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://schemas.citrix.com/CBP/IQueryAgent/QueryAllFtasT	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://schemas.datacontract.org/2004/07/Citrix.XDInterServiceTypesf	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://tempuri.org/ISecondaryBrokerControl/StopBrokeringT	BrokerService.exe, 0000001F.00000002.2558857309.0000025451C32000.00000002.00000001.01000000.0000004C.sdmp	false	unknown
http://schemas.datacontract.org/2004/07/Citrix.Host.DataModelY	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://schemas.citrix.com/CBP/ISessionManager/RebootFaultFaultT	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://schemas.citrix.com/CBP/IQueryAgent/QueryAllStartMenuShortcutsT	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://schemas.citrix.com/CBP/ISessionManager/DisconnectT	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://tempuri.org/IHostApi/GetHypervisorConnectionByIdResponse	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://tempuri.org/IMachineCreationApi/CheckVirtualMachinePowerActionsResponse	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://schemas.citrix.com/CBP/IDummyInterface/useFaultHelperT	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://schemas.citrix.com/CBP/IDummyInterface/useReverseSeamlessAppHelperResponse	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://schemas.datacontract.org/2004/07/Citrix.XDInterServiceTypeso	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://schemas.citrix.com/CBP/IDummyInterface/useServiceDetailsResultHelperT	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://schemas.datacontract.org/2004/07/Citrix.Host.DataModeld	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://schemas.citrix.com/CBP/IDummyInterface/usePrepareRequestHelperT	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://schemas.datacontract.org/2004/07/Citrix.Host.DataModelg	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://schemas.datacontract.org/2004/07/Citrix.Host.DataModelf	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://schemas.datacontract.org/2004/07/Citrix.Host.DataModela	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://schemas.datacontract.org/2004/07/Citrix.Host.DataModel_	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://schemas.citrix.com/CBP/IDummyInterface/useCancelLaunchRequestHelperT	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://schemas.citrix.com/CBP/IDummyInterface/useIntuneMetadataResultHelperResponse	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://schemas.citrix.com/CBP/IDynamicDataQuery/GetResponsev	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 00000002.00000003.1367143308.0000020960E75000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369431890.0000020960E77000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000002.00000003.1367443151.0000020960E62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367764046.0000020960E41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369075101.0000020960E42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1369233575.0000020960E63000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://tempuri.org/IDelegatedAdminApi/DummyOperationT	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
http://schemas.citrix.com/CBP/IQueryAgent/QueryAllSessionsFaultFaultT	BrokerService.exe, 0000001F.00000002.2555603364.00000254519A2000.00000002.00000001.01000000.00000048.sdmp	false	unknown
http://tempuri.org/ITrustAdminQuery/GetServiceKeyNamesResponse	BrokerService.exe, 0000001D.00000002.1917406756.00000194ABA12000.00000002.00000001.01000000.00000031.sdmp	false	unknown
https://mindtouch.eng.citrite.net/Technologies/Citrix.Diagnostics.Tracing)J	BrokerService.exe, 0000001D.00000002.1915180152.00000194AB4BC000.00000002.00000001.01000000.0000001E.sdmp	false	unknown

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529042
Start date and time:	2024-10-08 15:28:51 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	41
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Broker_Service_x64.msi
Detection:	SUS
Classification:	sus30.phis.troj.evad.winMSI@56/744@4/0
Cookbook Comments:	Found application associated with file extension: .msi

Time	Type	Description
10:58:51	API Interceptor	26881x Sleep call for process: BrokerService.exe modified
10:58:55	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified
10:58:59	API Interceptor	37x Sleep call for process: RegisterPlugins.exe modified

Process:	C:\Program Files\Citrix\Broker\Service\BrokerService.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34193
Entropy (8bit):	5.122278897062649
Encrypted:	false
SSDEEP:	192:9Qr59hFtHhxEh6VhdXeDW9pFtHpxEp6VpdXskywsexFCco4n0hJdCaULdcAC0RaT:dmH6JyJuJzyJz2ZFqJYQlC
MD5:	5E328FDCC9D1EAEC19657170D92A083F
SHA1:	3CF5BE442D3658550D903F9E84269D38EAD17B4F
SHA-256:	674A5F0FC6AD5B20D1560DE5DF66607A76120A41BD5A182865325AF37C2AC33D
SHA-512:	F3D91EB1DA4F1DB4E27809F0400A6323916C3B04D7D4B9F8AA07EED395A4D5A04DC31826FCE970DC5E31943B30CA9305E304EEA1D1A129FDE6B80663A4115F86
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup useLegacyV2RuntimeActivationPolicy="true">.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.7.2" />.. </startup>.. <system.net>.. <connectionManagement>.. <clear />.. <add address="*" maxconnection="100" />.. </connectionManagement>.. </system.net>.. <system.serviceModel>.. <client>.. <endpoint name="WsHttpBindingILaunchEndpoint" binding="wsHttpBinding" bindingConfiguration="WorkerWsHttpBinding" behaviorConfiguration="WorkerEndpointBehaviour" contract="Citrix.Cds.Protocol.Worker.ILaunch" />.. <endpoint name="WsHttpBindingIDynamicDataQueryEndpoint" binding="wsHttpBinding" bindingConfiguration="WorkerWsHttpBinding" behaviorConfiguration="WorkerEndpointBehaviour" contract="Citrix.Cds.Protocol.Worker.IDynamicDataQuery" />.. <endpoint name="WsHttpBindingIConfigurationEndpoint" binding="wsHttpBinding" bindingConfiguration="WorkerWsHttpBinding" behaviorConfiguration="Wo

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2035864
Entropy (8bit):	6.9949546327343075
Encrypted:	false
SSDEEP:	49152:Qv8zmhvkhwZ3uGuBADftPYqZfEjD/Pv8g:Qv8zmTZeGuqTeqZQ
MD5:	E2CF969D3066353DCFD9F8ED27F9A4F5
SHA1:	69A3FE31520D8D6427BDB4FD49EE93AB1655E656
SHA-256:	E4AA3CA8FF7094D5B7A7417A23D0C405E6B72A9F35C73E2FD011FEFE1F499E84
SHA-512:	F073FCF3AC581585FDD85E8CE41ACCFBAA60A5A0A6B11CECD70B14E805ED0FCD22B1931F91A67C951CD225906A17387EF5925B7B094E62517F65FF49FB729051
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......5&r\qG..qG..qG..x?..gG..d8..tG..d8..{G..d8..}G..d8..gG..d8..uG..:?..\|G..qG..(F.......G..qG..nG...2...F..I...#G......nG..I...eG..I...pG..I...pG..I...pG..RichqG..........PE..L.....(e...........!...%.....T......xa...............................................N....@.............................8 ..H............................(......t...@...T...............................@...............t............................text....t.......v.................. ..`fipstx...\|.......~...z.............. ..`.rdata........... ..................@..@.data....\|...0......................@...fipsrd.../.......0...2..............@..@fipsda...............b..............@...fipsro..H............p..............@..@.rsrc...............................@..@.reloc..t...........................@..B................................................................................................

Process:	C:\Program Files\Common Files\Citrix\HCLPlugins\RegisterPlugins.exe
File Type:	data
Category:	dropped
Size (bytes):	589
Entropy (8bit):	5.254846093055834
Encrypted:	false
SSDEEP:	12:NJ5oDLI4MW0Tn1sJrK98AsoDLI4MWJcK98AsoDLI4MWhtHFDEX/:9AE4gTGJrKrsAE49cKrsAE4zFgv
MD5:	16829DF43ABC7FD08EF2D7B574D59D38
SHA1:	0A033135109B993241D538044ED36DB6732F6564
SHA-256:	82EF71E8965997C44AFE6B15B8C9C119A3755162AB929CAA5949B33B64B85FA6
SHA-512:	5545805C021A866649264A1BC14BA2D6CBBDE813E29A8D97BFED40110B8DADBDE7201C46BAFCDDFB632935A85509BEC19C37C7CE126A8F69AC021B84681193CD
Malicious:	false
Preview:	....A.............................OSystem.AddIn, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089.....)System.AddIn.Hosting.AddInDeploymentState....._addins._fileCount....System.Collections.Generic.List`1[[System.AddIn.AddIn, System.AddIn, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]].....................System.Collections.Generic.List`1[[System.AddIn.AddIn, System.AddIn, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]....._items._size._version....System.AddIn.AddIn[]...................................System.AddIn.AddIn.....

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	999
Entropy (8bit):	4.966299883488245
Encrypted:	false
SSDEEP:
MD5:	24567B9212F806F6E3E27CDEB07728C0
SHA1:	371AE77042FFF52327BF4B929495D5603404107D
SHA-256:	82F352AD3C9B3E58ECD3207EDC38D5F01B14D968DA908406BD60FD93230B69F6
SHA-512:	5D5E65FCD9061DADC760C9B3124547F2BABEB49FD56A2FD2FE2AD2211A1CB15436DB24308A0B5A87DA24EC6AB2A9B0C5242D828BE85BD1B2683F9468CE310904
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<software_identification_tag xmlns="http://standards.iso.org/iso/19770/-2/2009/schema.xsd">...<entitlement_required_indicator>true</entitlement_required_indicator>...<product_title>Windows 10 Pro</product_title>...<product_version>....<name>10.0.19041.1865</name>....<numeric>.....<major>10</major>.....<minor>0</minor>.....<build>19041</build>.....<review>1865</review>....</numeric>...</product_version>...<software_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_creator>...<software_licensor>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_licensor>...<software_id>....<unique_id>Windows-10-Pro</unique_id>....<tag_creator_regid>regid.1991-06.com.microsoft</tag_creator_regid>...</software_id>...<tag_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</tag_creator>..</software_identification_tag>..

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PEM certificate
Category:	dropped
Size (bytes):	2540
Entropy (8bit):	5.974621309222696
Encrypted:	false
SSDEEP:
MD5:	A1034DEC4958C973B301D47449B86B7B
SHA1:	959A3D45B2F91CD1FD4EA4A92C502791E6624A59
SHA-256:	121824F8DFFD7C70A079603814C74129F543BD456A64B99C227D130612B9F4E1
SHA-512:	CED457D2A7C1C83D635ACCD3BE6F1C5A2B5D54DE24ABE5F32D5B9D1AAC4A9DEB907D27F622E23CFFF438DCFE47C2C660AC794E17E018EE119E9688E76571953F
Malicious:	false
Preview:	-----BEGIN CERTIFICATE-----..MIIHCDCCBPCgAwIBAgIQBMSlUV04iQWOmQX47ZpRcDANBgkqhkiG9w0BAQsFADBp..MQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMT..OERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0..IDIwMjEgQ0ExMB4XDTI0MDMwODAwMDAwMFoXDTI1MDMwNzIzNTk1OVowgY8xCzAJ..BgNVBAYTAlVTMRAwDgYDVQQIEwdGbG9yaWRhMRgwFgYDVQQHEw9Gb3J0IExhdWRl..cmRhbGUxHTAbBgNVBAoTFENpdHJpeCBTeXN0ZW1zLCBJbmMuMRYwFAYDVQQLEw1D..aXRyaXggWGVuQXBwMR0wGwYDVQQDExRDaXRyaXggU3lzdGVtcywgSW5jLjCCAaIw..DQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAPoCfOCCtrdGgYAblwd8n6qAvq4s..CBKIV00B1ajbye798YoiGA/D782C4WkKtnRuHrmNQDoVy9FHNqzS3EGShAeD7JWK..66K4PseYkSZdpPV5bQxKQ26iSapFBC2OnexhCKaeAoXRnzSbhlPRggIIppfPLc2T..Do7QKnCyF0kUjroEII1DkfhL33i5TEy7PwA48jovPfPtJk7XROksv2tm5/34LCWl..PDtip+/GIh19TepZJSigczubWH0Q9lWYTp9pMej1CPp/kXJMBNtqNIQYXJAXgRjV..tg1KwAQy8GLjThFmRBsdSgtlAzuKfng5sQDYwv/qvbed3WeFdWP6i/QkZ4p9CTaM..FXC098xqnnm4CGoNj6rIept5bwEosuw6Zg7cmkwsL/2i3dceU2b1D4inH7zDkgkc..Uz/muy+A3Y7qnEMVhDZNZDRGY2Wv2UtAQ1mpZJaeiYvZIia

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	2464
Entropy (8bit):	3.244554458910001
Encrypted:	false
SSDEEP:
MD5:	621C50CFFCAA64B719217AE71104F2A2
SHA1:	3189496C6AA5878CCD13D84675331E8CB816D95A
SHA-256:	015B4A7E62C0FC75AF9C9B201CBB4AAC18434D4B4BD88AB12E9C638F71AF2C40
SHA-512:	966FBA865D7D968EBDBD4CEC6E7245E8484665847E3E05DBB07B2768D2BCAA5886A18EC1BFC32ED43774E30C7CF53400EDA3C548FC7174C99BC791FB8A23A40C
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.u.e. .. O.c.t. .. 0.8. .. 2.0.2.4. .1.0.:.5.8.:.5.5.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Citrix Broker Service (x64) 7.41.1100.45, Author: Citrix Systems, Inc., Keywords: XenDesktop,Installer, Comments: Version 7.41.1100.45, Create Time/Date: Thu Aug 8 07:08:40 2024, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 4, Template: x64;1033, Last Saved By: x64;2052, Revision Number: {16FBB4F8-8C17-4AD9-93A4-B3F2C57666D7}7.41.1100.45;{8AC8180C-94B6-4259-B3FE-502143159DA5}7.41.1100.45;{DCD61024-BE72-49C9-B21A-D53C641B722B}, Number of Pages: 300, Number of Characters: 131135
Entropy (8bit):	7.978008029319694
TrID:	Microsoft Windows Installer (60509/1) 57.88% ClickyMouse macro set (36024/1) 34.46% Generic OLE2 / Multistream Compound File (8008/1) 7.66%
File name:	Broker_Service_x64.msi
File size:	72'298'496 bytes
MD5:	2d8222e63cc0a2d86d80a57d26347c84
SHA1:	8d762e32f294bc971873f031027393520ac0161d
SHA256:	991636b9ba9a4a528e0267de74cad67012fe031dc5b859a9a7a32a1303b90dd8
SHA512:	666e5dd76fae155ef80b4cced367a0d9efc36eeda659df9d5af0dafc293341a4327be26d9fc5d4e7850e1da153a7e995bf73f69788d6017d2f396c660fa0b123
SSDEEP:	1572864:8IVXEL/fP5ItOVagEUalUyGfQh8maDKYYysJy:v5EL/JI8ylUyGfQh81OYvn
TLSH:	88F73322B561847EEEAB0533A139CB201A3DFD355790C9DF93A4B3294DF26C255B3A07
File Content Preview:	........................>.................................................................................... ...$...(...,...0...4...8...<...@...C.............................................................................................................

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 15:29:51.932256937 CEST	56965	53	192.168.2.7	1.1.1.1
Oct 8, 2024 15:31:05.305309057 CEST	54717	53	192.168.2.7	1.1.1.1
Oct 8, 2024 15:31:05.502684116 CEST	53	54717	1.1.1.1	192.168.2.7
Oct 8, 2024 15:31:21.522141933 CEST	61215	53	192.168.2.7	1.1.1.1
Oct 8, 2024 15:31:21.544053078 CEST	53	61215	1.1.1.1	192.168.2.7
Oct 8, 2024 15:31:37.575346947 CEST	55878	53	192.168.2.7	1.1.1.1
Oct 8, 2024 15:31:37.586652994 CEST	53	55878	1.1.1.1	192.168.2.7

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 15:29:51.939266920 CEST	1.1.1.1	192.168.2.7	0x2a9e	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 15:31:05.502684116 CEST	1.1.1.1	192.168.2.7	0xf0b0	Name error (3)	_ldap._tcp.	none	none	33	IN (0x0001)	false
Oct 8, 2024 15:31:21.544053078 CEST	1.1.1.1	192.168.2.7	0x4783	Name error (3)	_ldap._tcp.	none	none	33	IN (0x0001)	false
Oct 8, 2024 15:31:37.586652994 CEST	1.1.1.1	192.168.2.7	0x960b	Name error (3)	_ldap._tcp.	none	none	33	IN (0x0001)	false

Target ID:	0
Start time:	09:29:45
Start date:	08/10/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\Broker_Service_x64.msi"
Imagebase:	0x7ff65f1b0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	09:29:46
Start date:	08/10/2024
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff6e8040000
File size:	329'504 bytes
MD5 hash:	3BA1A18A0DC30A0545E7765CB97D8E63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	9
Start time:	09:29:47
Start date:	08/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	10
Start time:	09:29:48
Start date:	08/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Broker_Service_x64.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Citrix\Broker\Service\0dpsrs21.newcfg

C:\Program Files\Citrix\Broker\Service\32\ccauthcpp_dynamic.dll

C:\Program Files\Citrix\Broker\Service\64\ccauthcpp_dynamic.dll

C:\Program Files\Citrix\Broker\Service\ADIdentityInterService.dll

C:\Program Files\Citrix\Broker\Service\ActiveDirectory.SiteManagement.dll

C:\Program Files\Citrix\Broker\Service\AlwaysOnTracing.dll

C:\Program Files\Citrix\Broker\Service\AlwaysOnTracing.man

C:\Program Files\Citrix\Broker\Service\Avro.dll

C:\Program Files\Citrix\Broker\Service\Azure.Core.dll

C:\Program Files\Citrix\Broker\Service\Azure.Identity.dll

C:\Program Files\Citrix\Broker\Service\BaseDAL.dll

C:\Program Files\Citrix\Broker\Service\BouncyCastle.Cryptography.dll

C:\Program Files\Citrix\Broker\Service\BrokerAdminQuery.dll

C:\Program Files\Citrix\Broker\Service\BrokerAdminService.dll

C:\Program Files\Citrix\Broker\Service\BrokerCde.dll

C:\Program Files\Citrix\Broker\Service\BrokerCdeLibrary.dll

C:\Program Files\Citrix\Broker\Service\BrokerComponent.dll

C:\Program Files\Citrix\Broker\Service\BrokerComponentCommon.dll

C:\Program Files\Citrix\Broker\Service\BrokerDAL.dll

C:\Program Files\Citrix\Broker\Service\BrokerEnvTests.dll

Windows Analysis Report
Broker_Service_x64.msi

Target ID:	11
Start time:	09:29:50
Start date:	08/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	12
Start time:	09:29:57
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 7D00F72EBD1F03FE2BA91EB00E79F5F2
Imagebase:	0x810000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	15
Start time:	09:30:03
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding E5BAB935B9E62F5EF499449BA355B5C1 E Global\MSI0000
Imagebase:	0x810000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	16
Start time:	10:58:37
Start date:	08/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	17
Start time:	10:58:44
Start date:	08/10/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\MsiExec.exe -Embedding B57FEBC80AACA307814E81531C396CA3 E Global\MSI0000
Imagebase:	0x7ff65f1b0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	21
Start time:	10:58:45
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\wevtutil.exe
Wow64 process (32bit):	true
Commandline:	"wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\BrokerEventsProvider.man"
Imagebase:	0x170000
File size:	208'384 bytes
MD5 hash:	3C0E48DA02447863279B0FE3CE7FE5E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	24
Start time:	10:58:47
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\wevtutil.exe
Wow64 process (32bit):	true
Commandline:	"wevtutil.exe" im "C:\Program Files\Citrix\Broker\Service\HighAvailabilityEventsProvider.man"
Imagebase:	0x170000
File size:	208'384 bytes
MD5 hash:	3C0E48DA02447863279B0FE3CE7FE5E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	27
Start time:	10:58:48
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\sc.exe" sidtype CitrixBrokerService unrestricted
Imagebase:	0x2d0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	29
Start time:	10:58:49
Start date:	08/10/2024
Path:	C:\Program Files\Citrix\Broker\Service\BrokerService.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Citrix\Broker\Service\BrokerService.exe" -Upgrade
Imagebase:	0x19490e50000
File size:	117'832 bytes
MD5 hash:	CB044A172BFC56F40916FDDFB0381694
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	31
Start time:	10:58:52
Start date:	08/10/2024
Path:	C:\Program Files\Citrix\Broker\Service\BrokerService.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Citrix\Broker\Service\BrokerService.exe"
Imagebase:	0x25003f60000
File size:	117'832 bytes
MD5 hash:	CB044A172BFC56F40916FDDFB0381694
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false