Windows Analysis Report
PulseSecureAppLauncher.msi

Cryptography

Source: PulseApplicationLauncher.exe, 00000007.00000002.473216003.000000005A07E000.00000002.00000001.01000000.0000000B.sdmp

Binary or memory string: -----BEGIN RSA PUBLIC KEY-----

memstr_b6eccba3-6

Compliance

Source:	Binary string: s:\pulse\out\components\dsOpenSSL\obj\winnt-x64-Release\OpenSSL\openssl-1.1.1t\libcrypto-1_1-x64.pdbe source: libcrypto-1_1-x64.dll.2.dr
Source:	Binary string: s:\pulse\out\components\dsOpenSSL\obj\winnt-x86-Release\OpenSSL\openssl-1.1.1t\libssl-1_1.pdb source: PulseApplicationLauncher.exe, 00000007.00000002.473443554.0000000069A8C000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: s:\pulse\out\components\dsOpenSSL\obj\winnt-x86-Release\OpenSSL\openssl-1.1.1t\libssl-1_1.pdbAA source: PulseApplicationLauncher.exe, 00000007.00000002.473443554.0000000069A8C000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: s:\ive\out\bin\winnt-x64-Release\dsWinClientResource_JA.pdb source: dsWinClientResource_JA.dll1.2.dr
Source:	Binary string: d:\agent\_work\1\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdbGCTL source: PulseApplicationLauncher.exe, 00000007.00000002.473493357.0000000071671000.00000020.00000001.01000000.00000007.sdmp, vcruntime140.dll.2.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W1 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASM -DPULSESECURE_OPENSSL_BUILD -DOPENSSL_NO_ZLIB -DOPENSSL_NO_ZLIB_DYNAMICOpenSSL 1.1.1t 7 Feb 2023built on: Thu Dec 28 08:51:49 2023 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Pulse Secure\SSL"ENGINESDIR: "S:\pulse\out\dsOpenSSL\Win32\Release\lib\engines-1_1"not availabledes(long) source: PulseApplicationLauncher.exe, 00000007.00000002.473297345.00000000671A8000.00000002.00000001.01000000.00000006.sdmp, libcrypto-1_1.dll.2.dr
Source:	Binary string: C:\Users\admin\Downloads\Wolfssl_\wolfEngine\windows\fips_140_2\DLL Release\Win32\wolfEngine.pdb))) source: PulseApplicationLauncher.exe, 00000007.00000002.473473916.000000006A000000.00000002.00000001.01000000.0000000A.sdmp, wolfEngine.dll.2.dr, wolfEngine.dll0.2.dr
Source:	Binary string: s:\ive\out\bin\winnt-x64-Release\dsWinClientResource_ZH.pdb source: dsWinClientResource_ZH.dll1.2.dr
Source:	Binary string: s:\ive\out\bin\winnt-x64-Release\dsWinClientResource_KO.pdb source: dsWinClientResource_KO.dll1.2.dr
Source:	Binary string: C:\Users\admin\Downloads\Wolfssl_\wolfssl\IDE\WIN10\DLL Release\Win32\wolfssl-fips.pdbHHHGCTL source: PulseApplicationLauncher.exe, 00000007.00000002.473216003.000000005A07E000.00000002.00000001.01000000.0000000B.sdmp, wolfssl-fips.dll0.2.dr
Source:	Binary string: d:\agent\_work\8\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: vcruntime140.dll1.2.dr
Source:	Binary string: s:\ive\out\bin\winnt-x86-Release\psalswitch.pdb source: psalswitch.exe.2.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W1 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASM -DPULSESECURE_OPENSSL_BUILD -DOPENSSL_NO_ZLIB -DOPENSSL_NO_ZLIB_DYNAMIC source: PulseApplicationLauncher.exe, 00000007.00000002.473297345.00000000671A8000.00000002.00000001.01000000.00000006.sdmp, libcrypto-1_1.dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: PulseApplicationLauncher.exe, 00000007.00000002.473493357.0000000071671000.00000020.00000001.01000000.00000007.sdmp, vcruntime140.dll.2.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W1 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DPULSESECURE_OPENSSL_BUILD -DOPENSSL_NO_ZLIB -DOPENSSL_NO_ZLIB_DYNAMICOpenSSL 1.1.1t 7 Feb 2023built on: Thu Dec 28 09:16:51 2023 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files (x86)\Pulse Secure\SSL"ENGINESDIR: "S:\pulse\out\dsOpenSSL\x64\Release\lib\engines-1_1"not available source: libcrypto-1_1-x64.dll.2.dr
Source:	Binary string: s:\pulse\out\components\dsOpenSSL\obj\winnt-x86-Release\OpenSSL\openssl-1.1.1t\libcrypto-1_1.pdb source: PulseApplicationLauncher.exe, 00000007.00000002.473297345.0000000067205000.00000002.00000001.01000000.00000006.sdmp, libcrypto-1_1.dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: PulseApplicationLauncher.exe, 00000007.00000002.473350170.0000000069471000.00000020.00000001.01000000.0000000C.sdmp, msvcp140.dll.2.dr
Source:	Binary string: C:\Users\admin\Downloads\Wolfssl_\wolfssl\IDE\WIN10\DLL Release\Win32\wolfssl-fips.pdb source: PulseApplicationLauncher.exe, 00000007.00000002.473216003.000000005A07E000.00000002.00000001.01000000.0000000B.sdmp, wolfssl-fips.dll0.2.dr
Source:	Binary string: s:\pulse\out\components\dsOpenSSL\bin\winnt-x86-Release\dsOpenSSL.pdb source: PulseApplicationLauncher.exe, 00000007.00000002.473402713.0000000069A0A000.00000002.00000001.01000000.00000009.sdmp, dsOpenSSL.dll0.2.dr, dsOpenSSL.dll.2.dr
Source:	Binary string: s:\ive\out\bin\winnt-x64-Release\PulseExt.pdb source: PulseExt64.exe.2.dr
Source:	Binary string: s:\pulse\out\components\dsOpenSSL\obj\winnt-x64-Release\OpenSSL\openssl-1.1.1t\libcrypto-1_1-x64.pdb source: libcrypto-1_1-x64.dll.2.dr
Source:	Binary string: s:\pulse\out\components\dsOpenSSL\bin\winnt-x86-Release\dsOpenSSL.pdb99 source: PulseApplicationLauncher.exe, 00000007.00000002.473402713.0000000069A0A000.00000002.00000001.01000000.00000009.sdmp, dsOpenSSL.dll0.2.dr, dsOpenSSL.dll.2.dr
Source:	Binary string: s:\pulse\out\components\dsOpenSSL\obj\winnt-x64-Release\OpenSSL\openssl-1.1.1t\libssl-1_1-x64.pdb?? source: libssl-1_1-x64.dll.2.dr
Source:	Binary string: s:\ive\out\bin\winnt-x64-Release\dsWinClientResource_ZH_CN.pdb source: dsWinClientResource_ZH_CN.dll1.2.dr
Source:	Binary string: d:\agent\_work\1\s\\binaries\x86ret\bin\i386\\msvcp140.i386.pdbGCTL source: PulseApplicationLauncher.exe, 00000007.00000002.473350170.0000000069471000.00000020.00000001.01000000.0000000C.sdmp, msvcp140.dll.2.dr
Source:	Binary string: s:\ive\out\bin\winnt-x86-Release\psalswitch.pdb> source: psalswitch.exe.2.dr
Source:	Binary string: C:\agent\_work\82\s\build\ship\x86\wixca.pdb source: PulseSecureAppLauncher.msi, 754f69.msi.2.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W1 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DPULSESECURE_OPENSSL_BUILD -DOPENSSL_NO_ZLIB -DOPENSSL_NO_ZLIB_DYNAMIC source: libcrypto-1_1-x64.dll.2.dr
Source:	Binary string: s:\ive\out\bin\winnt-x86-Release\psal.pdb source: PulseApplicationLauncher.exe, 00000007.00000000.466523108.0000000000CF0000.00000002.00000001.01000000.00000005.sdmp, PulseApplicationLauncher.exe, 00000007.00000002.473018711.0000000000CF0000.00000002.00000001.01000000.00000005.sdmp, PulseApplicationLauncher.exe.2.dr
Source:	Binary string: s:\ive\out\bin\winnt-x86-Release\dsWinClientResource_FR.pdb source: dsWinClientResource_FR.dll0.2.dr
Source:	Binary string: s:\pulse\out\components\dsOpenSSL\obj\winnt-x64-Release\OpenSSL\openssl-1.1.1t\libssl-1_1-x64.pdb source: libssl-1_1-x64.dll.2.dr
Source:	Binary string: s:\ive\out\bin\winnt-x86-Release\dsWinClientResource_ZH.pdb source: dsWinClientResource_ZH.dll0.2.dr
Source:	Binary string: s:\ive\out\bin\winnt-x86-Release\dsWinClientResource_KO.pdb source: dsWinClientResource_KO.dll.2.dr
Source:	Binary string: C:\Users\admin\Downloads\Wolfssl_\wolfEngine\windows\fips_140_2\DLL Release\Win32\wolfEngine.pdb source: PulseApplicationLauncher.exe, 00000007.00000002.473473916.000000006A000000.00000002.00000001.01000000.0000000A.sdmp, wolfEngine.dll.2.dr, wolfEngine.dll0.2.dr

Spreading

Source: C:\Windows\System32\msiexec.exe	File opened: z:			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: c:			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:			Jump to behavior

Networking

Source: PulseSecureAppLauncher.msi, dsOpenSSL.dll0.2.dr, PulseApplicationLauncher.exe.2.dr, libcrypto-1_1.dll.2.dr, dsWinClientResource_KO.dll.2.dr, wolfEngine.dll.2.dr, dsOpenSSL.dll.2.dr, dsWinClientResource_ZH.dll0.2.dr, wolfssl-fips.dll0.2.dr, dsWinClientResource_FR.dll0.2.dr, psalswitch.exe.2.dr, PulseExt64.exe.2.dr, dsWinClientResource_JA.dll1.2.dr, dsWinClientResource_ZH_CN.dll1.2.dr, libcrypto-1_1-x64.dll.2.dr, dsWinClientResource_ZH.dll1.2.dr, dsWinClientResource_KO.dll1.2.dr, wolfEngine.dll0.2.dr, 754f69.msi.2.dr, libssl-1_1-x64.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: PulseSecureAppLauncher.msi, dsOpenSSL.dll0.2.dr, PulseApplicationLauncher.exe.2.dr, libcrypto-1_1.dll.2.dr, dsWinClientResource_KO.dll.2.dr, wolfEngine.dll.2.dr, dsOpenSSL.dll.2.dr, dsWinClientResource_ZH.dll0.2.dr, wolfssl-fips.dll0.2.dr, dsWinClientResource_FR.dll0.2.dr, psalswitch.exe.2.dr, PulseExt64.exe.2.dr, dsWinClientResource_JA.dll1.2.dr, dsWinClientResource_ZH_CN.dll1.2.dr, libcrypto-1_1-x64.dll.2.dr, dsWinClientResource_ZH.dll1.2.dr, dsWinClientResource_KO.dll1.2.dr, wolfEngine.dll0.2.dr, 754f69.msi.2.dr, libssl-1_1-x64.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: PulseSecureAppLauncher.msi, dsOpenSSL.dll0.2.dr, PulseApplicationLauncher.exe.2.dr, libcrypto-1_1.dll.2.dr, dsWinClientResource_KO.dll.2.dr, wolfEngine.dll.2.dr, dsOpenSSL.dll.2.dr, dsWinClientResource_ZH.dll0.2.dr, wolfssl-fips.dll0.2.dr, dsWinClientResource_FR.dll0.2.dr, psalswitch.exe.2.dr, PulseExt64.exe.2.dr, dsWinClientResource_JA.dll1.2.dr, dsWinClientResource_ZH_CN.dll1.2.dr, libcrypto-1_1-x64.dll.2.dr, dsWinClientResource_ZH.dll1.2.dr, dsWinClientResource_KO.dll1.2.dr, wolfEngine.dll0.2.dr, 754f69.msi.2.dr, libssl-1_1-x64.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: PulseSecureAppLauncher.msi, 754f69.msi.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: PulseSecureAppLauncher.msi, dsOpenSSL.dll0.2.dr, PulseApplicationLauncher.exe.2.dr, libcrypto-1_1.dll.2.dr, dsWinClientResource_KO.dll.2.dr, wolfEngine.dll.2.dr, dsOpenSSL.dll.2.dr, dsWinClientResource_ZH.dll0.2.dr, wolfssl-fips.dll0.2.dr, dsWinClientResource_FR.dll0.2.dr, psalswitch.exe.2.dr, PulseExt64.exe.2.dr, dsWinClientResource_JA.dll1.2.dr, dsWinClientResource_ZH_CN.dll1.2.dr, libcrypto-1_1-x64.dll.2.dr, dsWinClientResource_ZH.dll1.2.dr, dsWinClientResource_KO.dll1.2.dr, wolfEngine.dll0.2.dr, 754f69.msi.2.dr, libssl-1_1-x64.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: PulseSecureAppLauncher.msi, dsOpenSSL.dll0.2.dr, PulseApplicationLauncher.exe.2.dr, libcrypto-1_1.dll.2.dr, dsWinClientResource_KO.dll.2.dr, wolfEngine.dll.2.dr, dsOpenSSL.dll.2.dr, dsWinClientResource_ZH.dll0.2.dr, wolfssl-fips.dll0.2.dr, dsWinClientResource_FR.dll0.2.dr, psalswitch.exe.2.dr, PulseExt64.exe.2.dr, dsWinClientResource_JA.dll1.2.dr, dsWinClientResource_ZH_CN.dll1.2.dr, libcrypto-1_1-x64.dll.2.dr, dsWinClientResource_ZH.dll1.2.dr, dsWinClientResource_KO.dll1.2.dr, wolfEngine.dll0.2.dr, 754f69.msi.2.dr, libssl-1_1-x64.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: PulseSecureAppLauncher.msi, 754f69.msi.2.dr	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: PulseSecureAppLauncher.msi, dsOpenSSL.dll0.2.dr, PulseApplicationLauncher.exe.2.dr, libcrypto-1_1.dll.2.dr, dsWinClientResource_KO.dll.2.dr, wolfEngine.dll.2.dr, dsOpenSSL.dll.2.dr, dsWinClientResource_ZH.dll0.2.dr, wolfssl-fips.dll0.2.dr, dsWinClientResource_FR.dll0.2.dr, psalswitch.exe.2.dr, PulseExt64.exe.2.dr, dsWinClientResource_JA.dll1.2.dr, dsWinClientResource_ZH_CN.dll1.2.dr, libcrypto-1_1-x64.dll.2.dr, dsWinClientResource_ZH.dll1.2.dr, dsWinClientResource_KO.dll1.2.dr, wolfEngine.dll0.2.dr, 754f69.msi.2.dr, libssl-1_1-x64.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: PulseSecureAppLauncher.msi, dsOpenSSL.dll0.2.dr, PulseApplicationLauncher.exe.2.dr, libcrypto-1_1.dll.2.dr, dsWinClientResource_KO.dll.2.dr, wolfEngine.dll.2.dr, dsOpenSSL.dll.2.dr, dsWinClientResource_ZH.dll0.2.dr, wolfssl-fips.dll0.2.dr, dsWinClientResource_FR.dll0.2.dr, psalswitch.exe.2.dr, PulseExt64.exe.2.dr, dsWinClientResource_JA.dll1.2.dr, dsWinClientResource_ZH_CN.dll1.2.dr, libcrypto-1_1-x64.dll.2.dr, dsWinClientResource_ZH.dll1.2.dr, dsWinClientResource_KO.dll1.2.dr, wolfEngine.dll0.2.dr, 754f69.msi.2.dr, libssl-1_1-x64.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: PulseSecureAppLauncher.msi, 754f69.msi.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: PulseSecureAppLauncher.msi, 754f69.msi.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: PulseSecureAppLauncher.msi, dsOpenSSL.dll0.2.dr, PulseApplicationLauncher.exe.2.dr, libcrypto-1_1.dll.2.dr, dsWinClientResource_KO.dll.2.dr, wolfEngine.dll.2.dr, dsOpenSSL.dll.2.dr, dsWinClientResource_ZH.dll0.2.dr, wolfssl-fips.dll0.2.dr, dsWinClientResource_FR.dll0.2.dr, psalswitch.exe.2.dr, PulseExt64.exe.2.dr, dsWinClientResource_JA.dll1.2.dr, dsWinClientResource_ZH_CN.dll1.2.dr, libcrypto-1_1-x64.dll.2.dr, dsWinClientResource_ZH.dll1.2.dr, dsWinClientResource_KO.dll1.2.dr, wolfEngine.dll0.2.dr, 754f69.msi.2.dr, libssl-1_1-x64.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: PulseSecureAppLauncher.msi, dsOpenSSL.dll0.2.dr, PulseApplicationLauncher.exe.2.dr, libcrypto-1_1.dll.2.dr, dsWinClientResource_KO.dll.2.dr, wolfEngine.dll.2.dr, dsOpenSSL.dll.2.dr, dsWinClientResource_ZH.dll0.2.dr, wolfssl-fips.dll0.2.dr, dsWinClientResource_FR.dll0.2.dr, psalswitch.exe.2.dr, PulseExt64.exe.2.dr, dsWinClientResource_JA.dll1.2.dr, dsWinClientResource_ZH_CN.dll1.2.dr, libcrypto-1_1-x64.dll.2.dr, dsWinClientResource_ZH.dll1.2.dr, dsWinClientResource_KO.dll1.2.dr, wolfEngine.dll0.2.dr, 754f69.msi.2.dr, libssl-1_1-x64.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: PulseSecureAppLauncher.msi, 754f69.msi.2.dr	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: PulseSecureAppLauncher.msi, dsOpenSSL.dll0.2.dr, PulseApplicationLauncher.exe.2.dr, libcrypto-1_1.dll.2.dr, dsWinClientResource_KO.dll.2.dr, wolfEngine.dll.2.dr, dsOpenSSL.dll.2.dr, dsWinClientResource_ZH.dll0.2.dr, wolfssl-fips.dll0.2.dr, dsWinClientResource_FR.dll0.2.dr, psalswitch.exe.2.dr, PulseExt64.exe.2.dr, dsWinClientResource_JA.dll1.2.dr, dsWinClientResource_ZH_CN.dll1.2.dr, libcrypto-1_1-x64.dll.2.dr, dsWinClientResource_ZH.dll1.2.dr, dsWinClientResource_KO.dll1.2.dr, wolfEngine.dll0.2.dr, 754f69.msi.2.dr, libssl-1_1-x64.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: PulseSecureAppLauncher.msi, 754f69.msi.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: PulseSecureAppLauncher.msi, dsOpenSSL.dll0.2.dr, PulseApplicationLauncher.exe.2.dr, libcrypto-1_1.dll.2.dr, dsWinClientResource_KO.dll.2.dr, wolfEngine.dll.2.dr, dsOpenSSL.dll.2.dr, dsWinClientResource_ZH.dll0.2.dr, wolfssl-fips.dll0.2.dr, dsWinClientResource_FR.dll0.2.dr, psalswitch.exe.2.dr, PulseExt64.exe.2.dr, dsWinClientResource_JA.dll1.2.dr, dsWinClientResource_ZH_CN.dll1.2.dr, libcrypto-1_1-x64.dll.2.dr, dsWinClientResource_ZH.dll1.2.dr, dsWinClientResource_KO.dll1.2.dr, wolfEngine.dll0.2.dr, 754f69.msi.2.dr, libssl-1_1-x64.dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: PulseSecureAppLauncher.msi, 754f69.msi.2.dr	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
Source: PulseSecureAppLauncher.msi, dsOpenSSL.dll0.2.dr, PulseApplicationLauncher.exe.2.dr, libcrypto-1_1.dll.2.dr, dsWinClientResource_KO.dll.2.dr, wolfEngine.dll.2.dr, dsOpenSSL.dll.2.dr, dsWinClientResource_ZH.dll0.2.dr, wolfssl-fips.dll0.2.dr, dsWinClientResource_FR.dll0.2.dr, psalswitch.exe.2.dr, PulseExt64.exe.2.dr, dsWinClientResource_JA.dll1.2.dr, dsWinClientResource_ZH_CN.dll1.2.dr, libcrypto-1_1-x64.dll.2.dr, dsWinClientResource_ZH.dll1.2.dr, dsWinClientResource_KO.dll1.2.dr, wolfEngine.dll0.2.dr, 754f69.msi.2.dr, libssl-1_1-x64.dll.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: PulseSecureAppLauncher.msi, 754f69.msi.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: PulseSecureAppLauncher.msi, dsOpenSSL.dll0.2.dr, PulseApplicationLauncher.exe.2.dr, libcrypto-1_1.dll.2.dr, dsWinClientResource_KO.dll.2.dr, wolfEngine.dll.2.dr, dsOpenSSL.dll.2.dr, dsWinClientResource_ZH.dll0.2.dr, wolfssl-fips.dll0.2.dr, dsWinClientResource_FR.dll0.2.dr, psalswitch.exe.2.dr, PulseExt64.exe.2.dr, dsWinClientResource_JA.dll1.2.dr, dsWinClientResource_ZH_CN.dll1.2.dr, libcrypto-1_1-x64.dll.2.dr, dsWinClientResource_ZH.dll1.2.dr, dsWinClientResource_KO.dll1.2.dr, wolfEngine.dll0.2.dr, 754f69.msi.2.dr, libssl-1_1-x64.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: PulseSecureAppLauncher.msi, dsOpenSSL.dll0.2.dr, PulseApplicationLauncher.exe.2.dr, libcrypto-1_1.dll.2.dr, dsWinClientResource_KO.dll.2.dr, wolfEngine.dll.2.dr, dsOpenSSL.dll.2.dr, dsWinClientResource_ZH.dll0.2.dr, wolfssl-fips.dll0.2.dr, dsWinClientResource_FR.dll0.2.dr, psalswitch.exe.2.dr, PulseExt64.exe.2.dr, dsWinClientResource_JA.dll1.2.dr, dsWinClientResource_ZH_CN.dll1.2.dr, libcrypto-1_1-x64.dll.2.dr, dsWinClientResource_ZH.dll1.2.dr, dsWinClientResource_KO.dll1.2.dr, wolfEngine.dll0.2.dr, 754f69.msi.2.dr, libssl-1_1-x64.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: PulseSecureAppLauncher.msi, 754f69.msi.2.dr	String found in binary or memory: http://ocsp.digicert.com0K
Source: PulseSecureAppLauncher.msi, dsOpenSSL.dll0.2.dr, PulseApplicationLauncher.exe.2.dr, libcrypto-1_1.dll.2.dr, dsWinClientResource_KO.dll.2.dr, wolfEngine.dll.2.dr, dsOpenSSL.dll.2.dr, dsWinClientResource_ZH.dll0.2.dr, wolfssl-fips.dll0.2.dr, dsWinClientResource_FR.dll0.2.dr, psalswitch.exe.2.dr, PulseExt64.exe.2.dr, dsWinClientResource_JA.dll1.2.dr, dsWinClientResource_ZH_CN.dll1.2.dr, libcrypto-1_1-x64.dll.2.dr, dsWinClientResource_ZH.dll1.2.dr, dsWinClientResource_KO.dll1.2.dr, wolfEngine.dll0.2.dr, 754f69.msi.2.dr, libssl-1_1-x64.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: PulseSecureAppLauncher.msi, 754f69.msi.2.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: PulseSecureAppLauncher.msi, dsOpenSSL.dll0.2.dr, PulseApplicationLauncher.exe.2.dr, libcrypto-1_1.dll.2.dr, dsWinClientResource_KO.dll.2.dr, wolfEngine.dll.2.dr, dsOpenSSL.dll.2.dr, dsWinClientResource_ZH.dll0.2.dr, wolfssl-fips.dll0.2.dr, dsWinClientResource_FR.dll0.2.dr, psalswitch.exe.2.dr, PulseExt64.exe.2.dr, dsWinClientResource_JA.dll1.2.dr, dsWinClientResource_ZH_CN.dll1.2.dr, libcrypto-1_1-x64.dll.2.dr, dsWinClientResource_ZH.dll1.2.dr, dsWinClientResource_KO.dll1.2.dr, wolfEngine.dll0.2.dr, 754f69.msi.2.dr, libssl-1_1-x64.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: PulseSecureAppLauncher.msi, 754f69.msi.2.dr	String found in binary or memory: http://wixtoolset.org
Source: PulseSecureAppLauncher.msi, dsOpenSSL.dll0.2.dr, PulseApplicationLauncher.exe.2.dr, libcrypto-1_1.dll.2.dr, dsWinClientResource_KO.dll.2.dr, wolfEngine.dll.2.dr, dsOpenSSL.dll.2.dr, dsWinClientResource_ZH.dll0.2.dr, wolfssl-fips.dll0.2.dr, dsWinClientResource_FR.dll0.2.dr, psalswitch.exe.2.dr, PulseExt64.exe.2.dr, dsWinClientResource_JA.dll1.2.dr, dsWinClientResource_ZH_CN.dll1.2.dr, libcrypto-1_1-x64.dll.2.dr, dsWinClientResource_ZH.dll1.2.dr, dsWinClientResource_KO.dll1.2.dr, wolfEngine.dll0.2.dr, 754f69.msi.2.dr, libssl-1_1-x64.dll.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: PulseSecureAppLauncher.msi, dsOpenSSL.dll0.2.dr, PulseApplicationLauncher.exe.2.dr, libcrypto-1_1.dll.2.dr, dsWinClientResource_KO.dll.2.dr, wolfEngine.dll.2.dr, dsOpenSSL.dll.2.dr, dsWinClientResource_ZH.dll0.2.dr, wolfssl-fips.dll0.2.dr, dsWinClientResource_FR.dll0.2.dr, psalswitch.exe.2.dr, PulseExt64.exe.2.dr, dsWinClientResource_JA.dll1.2.dr, dsWinClientResource_ZH_CN.dll1.2.dr, libcrypto-1_1-x64.dll.2.dr, dsWinClientResource_ZH.dll1.2.dr, dsWinClientResource_KO.dll1.2.dr, wolfEngine.dll0.2.dr, 754f69.msi.2.dr, libssl-1_1-x64.dll.2.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: PulseApplicationLauncher.exe, 00000007.00000002.473453531.0000000069AAB000.00000002.00000001.01000000.00000008.sdmp, PulseApplicationLauncher.exe, 00000007.00000002.473332236.0000000067232000.00000002.00000001.01000000.00000006.sdmp, libcrypto-1_1.dll.2.dr, libcrypto-1_1-x64.dll.2.dr, libssl-1_1-x64.dll.2.dr	String found in binary or memory: https://www.openssl.org/H

System Summary

Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe

Memory allocated: 770B0000 page execute and read and write

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\754f69.msi			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE496.tmp			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\754f6a.ipi			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\754f6a.ipi			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{E68B2226-4D66-4FD6-893E-3F7A7FB0B156}			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAC58.tmp			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\754f6c.msi			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\754f6c.msi			Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSIE496.tmp

Jump to behavior

Source: dsWinClientResource_DE.dll.2.dr	Static PE information: No import functions for PE file found
Source: dsWinClientResource_FR.dll0.2.dr	Static PE information: No import functions for PE file found
Source: dsWinClientResource_ZH_CN.dll1.2.dr	Static PE information: No import functions for PE file found
Source: dsWinClientResource_FR.dll.2.dr	Static PE information: No import functions for PE file found
Source: dsWinClientResource_ES.dll.2.dr	Static PE information: No import functions for PE file found
Source: dsWinClientResource_JA.dll0.2.dr	Static PE information: No import functions for PE file found
Source: dsWinClientResource_JA.dll1.2.dr	Static PE information: No import functions for PE file found
Source: dsWinClientResource_FR.dll1.2.dr	Static PE information: No import functions for PE file found
Source: dsWinClientResource_ZH.dll0.2.dr	Static PE information: No import functions for PE file found
Source: dsWinClientResource_DE.dll1.2.dr	Static PE information: No import functions for PE file found
Source: dsWinClientResource_KO.dll.2.dr	Static PE information: No import functions for PE file found
Source: dsWinClientResource_KO.dll1.2.dr	Static PE information: No import functions for PE file found
Source: dsWinClientResource_ZH.dll1.2.dr	Static PE information: No import functions for PE file found
Source: dsWinClientResource_EN.dll1.2.dr	Static PE information: No import functions for PE file found
Source: dsWinClientResource_KO.dll0.2.dr	Static PE information: No import functions for PE file found
Source: dsWinClientResource_JA.dll.2.dr	Static PE information: No import functions for PE file found
Source: dsWinClientResource_ES.dll0.2.dr	Static PE information: No import functions for PE file found
Source: dsWinClientResource_ZH_CN.dll.2.dr	Static PE information: No import functions for PE file found
Source: dsWinClientResource_EN.dll0.2.dr	Static PE information: No import functions for PE file found
Source: dsWinClientResource_EN.dll.2.dr	Static PE information: No import functions for PE file found
Source: dsWinClientResource_ZH.dll.2.dr	Static PE information: No import functions for PE file found
Source: dsWinClientResource_DE.dll0.2.dr	Static PE information: No import functions for PE file found
Source: dsWinClientResource_ES.dll1.2.dr	Static PE information: No import functions for PE file found
Source: dsWinClientResource_ZH_CN.dll0.2.dr	Static PE information: No import functions for PE file found

Source: PulseSecureAppLauncher.msi

Binary or memory string: OriginalFilenamewixca.dll\ vs PulseSecureAppLauncher.msi

Source: metadata-2.2.dr	Binary string: highlight.png22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\66program files\windows sidebar\gadgets\rssfeeds.gadgeticon.png22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}
Source: metadata-2.2.dr	Binary string: wmplayer.exe.mui22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\BBprogram files (x86)\windows sidebar\gadgets\weather.gadget\images**undocked_black_moon-new_partly-cloudy.png22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\((windows\diagnostics\system\device\en-us
Source: metadata-2.2.dr	Binary string: buttonup_off.png22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}
Source: metadata-2.2.dr	Binary string: system.web.dynamicdata.dll22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\BBprogram files (x86)\windows sidebar\gadgets\weather.gadget\images33docked_black_moon-waxing-gibbous_partly-cloudy.png22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}
Source: metadata-2.2.dr	Binary string: system.addin.contract.dll22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}
Source: metadata-2.2.dr	Binary string: btn-previous-static.png22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}
Source: metadata-2.2.dr	Binary string: keypad.xml22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\99program files\dvd maker\shared\dvdstyles\specialoccasion,,specialnavigationup_selectionsubpicture.png22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}
Source: metadata-2.2.dr	Binary string: scenes_intro_bg_pal.wmv22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}
Source: metadata-2.2.dr	Binary string: acxtrnal.dll22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\((windows\diagnostics\system\device\en-us
Source: metadata-2.2.dr	Binary string: sbdrop.dll22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}

Source: classification engine

Classification label: clean8.winMSI@6/81@0/0

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Pulse Secure

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\PulseSecure.LogService.Settings.Mutex.v2
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Mutant created: NULL

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\Temp\~DF98004BD7CA64244C.TMP

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: PulseSecureAppLauncher.msi

Static file information: TRID: Microsoft Windows Installer (60509/1) 57.88%

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\PulseSecureAppLauncher.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 5EA4F1DB765305D91232278ED78127E9
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe "C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe" PSALInstallFinished
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 5EA4F1DB765305D91232278ED78127E9			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe "C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe" PSALInstallFinished			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dwmapi.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: bcrypt.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rpcrtremote.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dwmapi.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rpcrtremote.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: atl.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dsrole.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: bcrypt.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sxs.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: samcli.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: samlib.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: winsta.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: devrtl.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wow64win.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wow64cpu.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winmm.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msacm32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dwmapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rpcrtremote.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Section loaded: wow64win.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Section loaded: wow64cpu.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Section loaded: libcrypto-1_1.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Section loaded: vcruntime140.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Section loaded: ucrtbase.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Section loaded: libssl-1_1.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Section loaded: dsopenssl.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Section loaded: wolfengine.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Section loaded: wolfssl-fips.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Section loaded: msvcp140.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Section loaded: ncrypt.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Section loaded: bcrypt.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Section loaded: msi.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Section loaded: dwmapi.dll			Jump to behavior

Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F8383852-FCD3-11D1-A6B9-006097DF5BD4}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File written: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\Version.ini

Jump to behavior

Source: PulseSecureAppLauncher.msi

Static file information: File size 7266304 > 1048576

Source:	Binary string: s:\pulse\out\components\dsOpenSSL\obj\winnt-x64-Release\OpenSSL\openssl-1.1.1t\libcrypto-1_1-x64.pdbe source: libcrypto-1_1-x64.dll.2.dr
Source:	Binary string: s:\pulse\out\components\dsOpenSSL\obj\winnt-x86-Release\OpenSSL\openssl-1.1.1t\libssl-1_1.pdb source: PulseApplicationLauncher.exe, 00000007.00000002.473443554.0000000069A8C000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: s:\pulse\out\components\dsOpenSSL\obj\winnt-x86-Release\OpenSSL\openssl-1.1.1t\libssl-1_1.pdbAA source: PulseApplicationLauncher.exe, 00000007.00000002.473443554.0000000069A8C000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: s:\ive\out\bin\winnt-x64-Release\dsWinClientResource_JA.pdb source: dsWinClientResource_JA.dll1.2.dr
Source:	Binary string: d:\agent\_work\1\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdbGCTL source: PulseApplicationLauncher.exe, 00000007.00000002.473493357.0000000071671000.00000020.00000001.01000000.00000007.sdmp, vcruntime140.dll.2.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W1 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASM -DPULSESECURE_OPENSSL_BUILD -DOPENSSL_NO_ZLIB -DOPENSSL_NO_ZLIB_DYNAMICOpenSSL 1.1.1t 7 Feb 2023built on: Thu Dec 28 08:51:49 2023 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Pulse Secure\SSL"ENGINESDIR: "S:\pulse\out\dsOpenSSL\Win32\Release\lib\engines-1_1"not availabledes(long) source: PulseApplicationLauncher.exe, 00000007.00000002.473297345.00000000671A8000.00000002.00000001.01000000.00000006.sdmp, libcrypto-1_1.dll.2.dr
Source:	Binary string: C:\Users\admin\Downloads\Wolfssl_\wolfEngine\windows\fips_140_2\DLL Release\Win32\wolfEngine.pdb))) source: PulseApplicationLauncher.exe, 00000007.00000002.473473916.000000006A000000.00000002.00000001.01000000.0000000A.sdmp, wolfEngine.dll.2.dr, wolfEngine.dll0.2.dr
Source:	Binary string: s:\ive\out\bin\winnt-x64-Release\dsWinClientResource_ZH.pdb source: dsWinClientResource_ZH.dll1.2.dr
Source:	Binary string: s:\ive\out\bin\winnt-x64-Release\dsWinClientResource_KO.pdb source: dsWinClientResource_KO.dll1.2.dr
Source:	Binary string: C:\Users\admin\Downloads\Wolfssl_\wolfssl\IDE\WIN10\DLL Release\Win32\wolfssl-fips.pdbHHHGCTL source: PulseApplicationLauncher.exe, 00000007.00000002.473216003.000000005A07E000.00000002.00000001.01000000.0000000B.sdmp, wolfssl-fips.dll0.2.dr
Source:	Binary string: d:\agent\_work\8\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: vcruntime140.dll1.2.dr
Source:	Binary string: s:\ive\out\bin\winnt-x86-Release\psalswitch.pdb source: psalswitch.exe.2.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W1 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASM -DPULSESECURE_OPENSSL_BUILD -DOPENSSL_NO_ZLIB -DOPENSSL_NO_ZLIB_DYNAMIC source: PulseApplicationLauncher.exe, 00000007.00000002.473297345.00000000671A8000.00000002.00000001.01000000.00000006.sdmp, libcrypto-1_1.dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: PulseApplicationLauncher.exe, 00000007.00000002.473493357.0000000071671000.00000020.00000001.01000000.00000007.sdmp, vcruntime140.dll.2.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W1 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DPULSESECURE_OPENSSL_BUILD -DOPENSSL_NO_ZLIB -DOPENSSL_NO_ZLIB_DYNAMICOpenSSL 1.1.1t 7 Feb 2023built on: Thu Dec 28 09:16:51 2023 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files (x86)\Pulse Secure\SSL"ENGINESDIR: "S:\pulse\out\dsOpenSSL\x64\Release\lib\engines-1_1"not available source: libcrypto-1_1-x64.dll.2.dr
Source:	Binary string: s:\pulse\out\components\dsOpenSSL\obj\winnt-x86-Release\OpenSSL\openssl-1.1.1t\libcrypto-1_1.pdb source: PulseApplicationLauncher.exe, 00000007.00000002.473297345.0000000067205000.00000002.00000001.01000000.00000006.sdmp, libcrypto-1_1.dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: PulseApplicationLauncher.exe, 00000007.00000002.473350170.0000000069471000.00000020.00000001.01000000.0000000C.sdmp, msvcp140.dll.2.dr
Source:	Binary string: C:\Users\admin\Downloads\Wolfssl_\wolfssl\IDE\WIN10\DLL Release\Win32\wolfssl-fips.pdb source: PulseApplicationLauncher.exe, 00000007.00000002.473216003.000000005A07E000.00000002.00000001.01000000.0000000B.sdmp, wolfssl-fips.dll0.2.dr
Source:	Binary string: s:\pulse\out\components\dsOpenSSL\bin\winnt-x86-Release\dsOpenSSL.pdb source: PulseApplicationLauncher.exe, 00000007.00000002.473402713.0000000069A0A000.00000002.00000001.01000000.00000009.sdmp, dsOpenSSL.dll0.2.dr, dsOpenSSL.dll.2.dr
Source:	Binary string: s:\ive\out\bin\winnt-x64-Release\PulseExt.pdb source: PulseExt64.exe.2.dr
Source:	Binary string: s:\pulse\out\components\dsOpenSSL\obj\winnt-x64-Release\OpenSSL\openssl-1.1.1t\libcrypto-1_1-x64.pdb source: libcrypto-1_1-x64.dll.2.dr
Source:	Binary string: s:\pulse\out\components\dsOpenSSL\bin\winnt-x86-Release\dsOpenSSL.pdb99 source: PulseApplicationLauncher.exe, 00000007.00000002.473402713.0000000069A0A000.00000002.00000001.01000000.00000009.sdmp, dsOpenSSL.dll0.2.dr, dsOpenSSL.dll.2.dr
Source:	Binary string: s:\pulse\out\components\dsOpenSSL\obj\winnt-x64-Release\OpenSSL\openssl-1.1.1t\libssl-1_1-x64.pdb?? source: libssl-1_1-x64.dll.2.dr
Source:	Binary string: s:\ive\out\bin\winnt-x64-Release\dsWinClientResource_ZH_CN.pdb source: dsWinClientResource_ZH_CN.dll1.2.dr
Source:	Binary string: d:\agent\_work\1\s\\binaries\x86ret\bin\i386\\msvcp140.i386.pdbGCTL source: PulseApplicationLauncher.exe, 00000007.00000002.473350170.0000000069471000.00000020.00000001.01000000.0000000C.sdmp, msvcp140.dll.2.dr
Source:	Binary string: s:\ive\out\bin\winnt-x86-Release\psalswitch.pdb> source: psalswitch.exe.2.dr
Source:	Binary string: C:\agent\_work\82\s\build\ship\x86\wixca.pdb source: PulseSecureAppLauncher.msi, 754f69.msi.2.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W1 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DPULSESECURE_OPENSSL_BUILD -DOPENSSL_NO_ZLIB -DOPENSSL_NO_ZLIB_DYNAMIC source: libcrypto-1_1-x64.dll.2.dr
Source:	Binary string: s:\ive\out\bin\winnt-x86-Release\psal.pdb source: PulseApplicationLauncher.exe, 00000007.00000000.466523108.0000000000CF0000.00000002.00000001.01000000.00000005.sdmp, PulseApplicationLauncher.exe, 00000007.00000002.473018711.0000000000CF0000.00000002.00000001.01000000.00000005.sdmp, PulseApplicationLauncher.exe.2.dr
Source:	Binary string: s:\ive\out\bin\winnt-x86-Release\dsWinClientResource_FR.pdb source: dsWinClientResource_FR.dll0.2.dr
Source:	Binary string: s:\pulse\out\components\dsOpenSSL\obj\winnt-x64-Release\OpenSSL\openssl-1.1.1t\libssl-1_1-x64.pdb source: libssl-1_1-x64.dll.2.dr
Source:	Binary string: s:\ive\out\bin\winnt-x86-Release\dsWinClientResource_ZH.pdb source: dsWinClientResource_ZH.dll0.2.dr
Source:	Binary string: s:\ive\out\bin\winnt-x86-Release\dsWinClientResource_KO.pdb source: dsWinClientResource_KO.dll.2.dr
Source:	Binary string: C:\Users\admin\Downloads\Wolfssl_\wolfEngine\windows\fips_140_2\DLL Release\Win32\wolfEngine.pdb source: PulseApplicationLauncher.exe, 00000007.00000002.473473916.000000006A000000.00000002.00000001.01000000.0000000A.sdmp, wolfEngine.dll.2.dr, wolfEngine.dll0.2.dr

Data Obfuscation

Source: PulseApplicationLauncher.exe0.2.dr	Static PE information: section name: _RDATA
Source: dsOpenSSL64.dll.2.dr	Static PE information: section name: .00cfg
Source: dsOpenSSL.dll.2.dr	Static PE information: section name: .00cfg
Source: dsOpenSSL.dll0.2.dr	Static PE information: section name: .00cfg
Source: PulseExt64.exe.2.dr	Static PE information: section name: _RDATA
Source: vcruntime140.dll1.2.dr	Static PE information: section name: _RDATA
Source: wolfssl-fips.dll.2.dr	Static PE information: section name: .fipsA
Source: wolfssl-fips.dll.2.dr	Static PE information: section name: .fipsB
Source: wolfssl-fips.dll0.2.dr	Static PE information: section name: .fipsA
Source: wolfssl-fips.dll0.2.dr	Static PE information: section name: .fipsB
Source: wolfssl-fips-x64.dll.2.dr	Static PE information: section name: .fipsA
Source: wolfssl-fips-x64.dll.2.dr	Static PE information: section name: .fipsB
Source: libcrypto-1_1.dll.2.dr	Static PE information: section name: .00cfg
Source: libcrypto-1_1.dll0.2.dr	Static PE information: section name: .00cfg
Source: libcrypto-1_1-x64.dll.2.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.2.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll0.2.dr	Static PE information: section name: .00cfg
Source: libssl-1_1-x64.dll.2.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.2.dr	Static PE information: section name: .didat
Source: msvcp140.dll0.2.dr	Static PE information: section name: .didat
Source: msvcp140.dll1.2.dr	Static PE information: section name: .didat

Persistence and Installation Behavior

Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\dsWinClientResource_KO.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x86\libssl-1_1.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\libssl-1_1.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x86\dsWinClientResource_KO.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\dsOpenSSL64.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\dsWinClientResource_KO.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x86\wolfssl-fips.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\dsOpenSSL.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\dsWinClientResource_EN.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\libssl-1_1-x64.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x86\dsWinClientResource_DE.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\dsWinClientResource_DE.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\psalswitch.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\vcruntime140.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\vcruntime140.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\wolfEngine-x64.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\dsWinClientResource_ES.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\dsWinClientResource_EN.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\libcrypto-1_1-x64.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\wolfssl-fips-x64.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x86\dsWinClientResource_ZH.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\dsWinClientResource_JA.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\dsWinClientResource_ZH.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\msvcp140.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x86\dsWinClientResource_EN.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\dsWinClientResource_ZH_CN.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\dsWinClientResource_FR.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\wolfEngine.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\wolfssl-fips.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x86\dsWinClientResource_FR.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x86\msvcp140.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\dsWinClientResource_FR.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseExt64.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x86\PulseApplicationLauncher.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseExt.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\dsWinClientResource_JA.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\msvcp140.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x86\libcrypto-1_1.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x86\dsWinClientResource_JA.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\libcrypto-1_1.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x86\vcruntime140.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\dsWinClientResource_DE.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE496.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x86\wolfEngine.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x86\dsWinClientResource_ZH_CN.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\dsWinClientResource_ZH.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x86\dsOpenSSL.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\PulseApplicationLauncher.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\dsWinClientResource_ZH_CN.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x86\dsWinClientResource_ES.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\dsWinClientResource_ES.dll			Jump to dropped file

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\MSIE496.tmp

Jump to dropped file

Source: metadata-2.2.dr	Binary or memory string: bcdedit.exe22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\
Source: metadata-2.2.dr	Binary or memory string: bcdedit.exe.mui22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\

Boot Survival

Source: C:\Windows\System32\msiexec.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior

Malware Analysis System Evasion

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\dsWinClientResource_KO.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x86\dsWinClientResource_KO.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\dsOpenSSL64.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x86\dsWinClientResource_FR.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\dsWinClientResource_KO.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\dsWinClientResource_FR.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseExt64.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x86\PulseApplicationLauncher.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseExt.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\dsWinClientResource_JA.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\dsWinClientResource_EN.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x86\dsWinClientResource_JA.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\libssl-1_1-x64.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x86\dsWinClientResource_DE.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\dsWinClientResource_DE.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIE496.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x86\dsWinClientResource_ZH_CN.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\dsWinClientResource_DE.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\psalswitch.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\dsWinClientResource_ZH.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\PulseApplicationLauncher.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\wolfEngine-x64.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\dsWinClientResource_ES.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\dsWinClientResource_EN.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\libcrypto-1_1-x64.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x86\dsWinClientResource_ZH.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\wolfssl-fips-x64.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\dsWinClientResource_JA.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\dsWinClientResource_ZH.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\dsWinClientResource_ZH_CN.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x86\dsWinClientResource_EN.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\dsWinClientResource_ZH_CN.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\dsWinClientResource_FR.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x86\dsWinClientResource_ES.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\x64\dsWinClientResource_ES.dll			Jump to dropped file

Source: C:\Windows\System32\msiexec.exe TID: 3300	Thread sleep time: -120000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\msiexec.exe TID: 3808	Thread sleep time: -60000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\msiexec.exe TID: 3336	Thread sleep time: -360000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3620	Thread sleep time: -60000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3620	Thread sleep time: -60000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: PulseApplicationLauncher.exe.2.dr	Binary or memory string: AAppIdAppActionLaunchParamsURLServerTokensSrvCertMd5LocaleServerVersionTimeStampPSALSwitchTruehcHost CheckerepoacOdyssey Access ClientepjamPulse SecurectsPulse Secure Citrix Services ClientwtsPulse Terminal Services ClientpulsencNetwork ConnectsamSecure Application ManagercitrixvdiCitrix Xen DesktopvmwarevdiVMware DesktopLog UploadjsamhobautowtsWindows Terminal ServicesInvalid parameterPsal::CmdParsers:\ive\setup\psal\common\psalcmd.cppKey = %sKey = %s, Value = %sUnknown key. IgnoringFirefoxfirefoxEdgeChromechromeStartStopUninstallSetHCCookieInvalid 'AppAction' present in the input = %s'AppId' is not present in the inputInvalid 'AppId' present in the input'AppId' conatins unexpected character'AppAction' is not present in the inputInvalid 'AppAction' present in the input'AppAction' conatins unexpected characterpsalparams.cgiwelcome.cgimtgpleasewait.cgirdremediate.cgi'LaunchParamsURL' is not present in the inputInvalid 'LaunchParamsURL' present in the input.cgiInvalid 'LaunchParamsURL'. NO Qmark and No Cgi in LaunchURLInvalid 'LaunchParamsURL'. NO slash in LaunchURLInvalid 'LaunchParamsURL' Invalid start positionIndex of ? = %dIndex of slash = %dstrCGIFile = %s'Host' is not present in the inputInvalid 'Host' present in the input'ServerTokens' is not present in the inputInvalid 'ServerTokens' present in the input'SrvCertMd5' is not present in the inputInvalid 'SrvCertMd5' present in the input'SrvCertMd5' conatins unexpected character'UserAgent' is not present in the inputInvalid 'UserAgent' present in the input'Locale' is not present in the inputInvalid 'Locale' present in the input'Locale' conatins unexpected character'ServerVersion' is not present in the inputInvalid 'ServerVersion' present in the input'ServerVersion' conatins unexpected character'Timestamp' is not present in the inputInvalid 'Timestamp' present in the input'Timestamp' conatins unexpected characterlist too longPsal::ExtensionUtilsRead result = %ds:\ive\setup\psal\common\psalExtensionUtils.cppfread errorMessage length = %dRead result = %d, Message = %sMessage = %sError = %sMessage is emptyfwrite errorjson_dumps error
Source: metadata-2.2.dr	Binary or memory string: lsm.exe22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\--windows\system32\migwiz\replacementmanifests,,microsoft-hyper-v-migration-replacement.man22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\
Source: PulseApplicationLauncher.exe.2.dr	Binary or memory string: vmwarevdi
Source: PulseApplicationLauncher.exe, 00000007.00000002.473018711.0000000000CF0000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: AppIdAppActionLaunchParamsURLServerTokensSrvCertMd5LocaleServerVersionTimeStampPSALSwitchTruehcHost CheckerepoacOdyssey Access ClientepjamPulse SecurectsPulse Secure Citrix Services ClientwtsPulse Terminal Services ClientpulsencNetwork ConnectsamSecure Application ManagercitrixvdiCitrix Xen DesktopvmwarevdiVMware DesktopLog UploadjsamhobautowtsWindows Terminal ServicesInvalid parameterPsal::CmdParsers:\ive\setup\psal\common\psalcmd.cppKey = %sKey = %s, Value = %sUnknown key. IgnoringFirefoxfirefoxEdgeChromechromeStartStopUninstallSetHCCookieInvalid 'AppAction' present in the input = %s'AppId' is not present in the inputInvalid 'AppId' present in the input'AppId' conatins unexpected character'AppAction' is not present in the inputInvalid 'AppAction' present in the input'AppAction' conatins unexpected characterpsalparams.cgiwelcome.cgimtgpleasewait.cgirdremediate.cgi'LaunchParamsURL' is not present in the inputInvalid 'LaunchParamsURL' present in the input.cgiInvalid 'LaunchParamsURL'. NO Qmark and No Cgi in LaunchURLInvalid 'LaunchParamsURL'. NO slash in LaunchURLInvalid 'LaunchParamsURL' Invalid start positionIndex of ? = %dIndex of slash = %dstrCGIFile = %s'Host' is not present in the inputInvalid 'Host' present in the input'ServerTokens' is not present in the inputInvalid 'ServerTokens' present in the input'SrvCertMd5' is not present in the inputInvalid 'SrvCertMd5' present in the input'SrvCertMd5' conatins unexpected character'UserAgent' is not present in the inputInvalid 'UserAgent' present in the input'Locale' is not present in the inputInvalid 'Locale' present in the input'Locale' conatins unexpected character'ServerVersion' is not present in the inputInvalid 'ServerVersion' present in the input'ServerVersion' conatins unexpected character'Timestamp' is not present in the inputInvalid 'Timestamp' present in the input'Timestamp' conatins unexpected characterlist too longPsal::ExtensionUtilsRead result = %ds:\ive\setup\psal\common\psalExtensionUtils.cppfread errorMessage length = %dRead result = %d, Message = %sMessage = %sError = %sMessage is emptyfwrite errorjson_dumps error
Source: metadata-2.2.dr	Binary or memory string: iasmigplugin-dl.man22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\--windows\system32\migwiz\replacementmanifests33microsoft-hyper-v-client-migration-replacement.man22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\##windows\system32\spp\tokens\ppdlic
Source: PulseApplicationLauncher.exe.2.dr	Binary or memory string: VMware Desktop
Source: metadata-2.2.dr	Binary or memory string: iasmigplugin-dl.man22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\--windows\syswow64\migwiz\replacementmanifests33microsoft-hyper-v-client-migration-replacement.man22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\,,program files (x86)\internet explorer\en-us
Source: metadata-2.2.dr	Binary or memory string: imscmig.dll22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\--windows\system32\migwiz\replacementmanifests44microsoft-hyper-v-drivers-migration-replacement.man22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe "C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe" PSALInstallFinished

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 5EA4F1DB765305D91232278ED78127E9

Jump to behavior

Language, Device and Operating System Detection

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Queries volume information: C:\Users\Public\Pulse Secure\Logging\PulseClient.log VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Queries volume information: C:\Users\Public\Pulse Secure\Logging\PulseClient.log VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Queries volume information: C:\Users\Public\Pulse Secure\Logging\PulseClient.log VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Queries volume information: C:\Users\Public\Pulse Secure\Logging\PulseClient.log VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Queries volume information: C:\Users\Public\Pulse Secure\Logging\PulseClient.log VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Queries volume information: C:\Users\Public\Pulse Secure\Logging\PulseClient.log VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Queries volume information: C:\Users\Public\Pulse Secure\Logging\PulseClient.log VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Queries volume information: C:\Users\Public\Pulse Secure\Logging\PulseClient.log VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Queries volume information: C:\Users\Public\Pulse Secure\Logging\PulseClient.log VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Queries volume information: C:\Users\Public\Pulse Secure\Logging\PulseClient.log VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Queries volume information: C:\Users\Public\Pulse Secure\Logging\PulseClient.log VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Queries volume information: C:\Users\Public\Pulse Secure\Logging\PulseClient.log VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Queries volume information: C:\Users\Public\Pulse Secure\Logging\PulseClient.log VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Queries volume information: C:\Users\Public\Pulse Secure\Logging\PulseClient.log VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Queries volume information: C:\Users\Public\Pulse Secure\Logging\PulseClient.log VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe	Queries volume information: C:\Users\Public\Pulse Secure\Logging\PulseClient.log VolumeInformation			Jump to behavior

Source: C:\Users\user\AppData\Roaming\Pulse Secure\PSAL\PulseApplicationLauncher.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior