Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Code function: 0_2_0040525A | 0_2_0040525A |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Code function: 0_2_00403FB0 | 0_2_00403FB0 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ADE22 | 2_3_006ADE22 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ABBEA | 2_3_006ABBEA |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ABBEA | 2_3_006ABBEA |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ABBEA | 2_3_006ABBEA |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ABBEA | 2_3_006ABBEA |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ABBEA | 2_3_006ABBEA |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ABBEA | 2_3_006ABBEA |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ABBEA | 2_3_006ABBEA |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ABBEA | 2_3_006ABBEA |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ABBEA | 2_3_006ABBEA |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ABBEA | 2_3_006ABBEA |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ABBEA | 2_3_006ABBEA |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ABBEA | 2_3_006ABBEA |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ABBEA | 2_3_006ABBEA |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ABBEA | 2_3_006ABBEA |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ABBEA | 2_3_006ABBEA |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ABBEA | 2_3_006ABBEA |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ABBEA | 2_3_006ABBEA |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ABBEA | 2_3_006ABBEA |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ABBEA | 2_3_006ABBEA |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ABBEA | 2_3_006ABBEA |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Code function: 2_3_006ABBEA | 2_3_006ABBEA |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Code function: 12_2_00007FF848F62825 | 12_2_00007FF848F62825 |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Code function: 12_2_00007FF848F73B3E | 12_2_00007FF848F73B3E |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Code function: 12_2_00007FF848F6F35C | 12_2_00007FF848F6F35C |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Code function: 12_2_00007FF848F72FBD | 12_2_00007FF848F72FBD |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Code function: 12_2_00007FF848F62953 | 12_2_00007FF848F62953 |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Code function: 12_2_00007FF848F6D6E9 | 12_2_00007FF848F6D6E9 |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Section loaded: propsys.dll | Jump to behavior |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Section loaded: edputil.dll | Jump to behavior |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Section loaded: windows.staterepositoryps.dll | Jump to behavior |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Section loaded: wintypes.dll | Jump to behavior |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Section loaded: appresolver.dll | Jump to behavior |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Section loaded: bcp47langs.dll | Jump to behavior |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Section loaded: slc.dll | Jump to behavior |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Section loaded: sppc.dll | Jump to behavior |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Section loaded: onecorecommonproxystub.dll | Jump to behavior |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Section loaded: onecoreuapcommonproxystub.dll | Jump to behavior |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Section loaded: pcacli.dll | Jump to behavior |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Section loaded: mpr.dll | Jump to behavior |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Section loaded: sfc_os.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: netapi32.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: oledlg.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: winmm.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: textinputframework.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: coreuicomponents.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: coremessaging.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: ntmarta.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: coremessaging.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: wintypes.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: wintypes.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: wintypes.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: textshaping.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: propsys.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: linkinfo.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: ntshrui.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: cscapi.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: edputil.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: windows.staterepositoryps.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: appresolver.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: bcp47langs.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: slc.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: sppc.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: onecorecommonproxystub.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: onecoreuapcommonproxystub.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: pcacli.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: mpr.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Section loaded: sfc_os.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: acgenral.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: winmm.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: samcli.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: msacm32.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: dwmapi.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: mpr.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: winmmbase.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: winmmbase.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: aclayers.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: sfc.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: sfc_os.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: textinputframework.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: coreuicomponents.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: coremessaging.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: ntmarta.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: coremessaging.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: wintypes.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: wintypes.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: wintypes.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: textshaping.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: spinf.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: devrtl.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: drvstore.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: devobj.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: msasn1.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Section loaded: cabinet.dll | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Section loaded: ntmarta.dll | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Section loaded: devrtl.dll | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Section loaded: drvstore.dll | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Section loaded: cabinet.dll | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Section loaded: msasn1.dll | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Section loaded: rsaenh.dll | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Section loaded: cryptbase.dll | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Section loaded: gpapi.dll | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Section loaded: cryptnet.dll | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Section loaded: slc.dll | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Section loaded: sppc.dll | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Section loaded: pnpui.dll | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Section loaded: dui70.dll | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\icacls.exe | Section loaded: ntmarta.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: mscoree.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: apphelp.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: version.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: windows.storage.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: wldp.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: profapi.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: msasn1.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: riched20.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: usp10.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: msls31.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: cryptsp.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: rsaenh.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: cryptbase.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: gpapi.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: cryptnet.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: iphlpapi.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: winnsi.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: uxtheme.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: shfolder.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: windowscodecs.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: textinputframework.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: coreuicomponents.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: coremessaging.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: ntmarta.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: coremessaging.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: wintypes.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: wintypes.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: wintypes.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: dwrite.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: textshaping.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: riched20.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: usp10.dll | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Section loaded: msls31.dll | |
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe | Section loaded: mscoree.dll | |
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe | Section loaded: cscomp.dll | |
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe | Section loaded: version.dll | |
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe | Section loaded: cryptsp.dll | |
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe | Section loaded: rsaenh.dll | |
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe | Section loaded: cryptbase.dll | |
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe | Section loaded: cryptsp.dll | |
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe | Section loaded: rsaenh.dll | |
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe | Section loaded: cryptbase.dll | |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2708517\de\PCID2708517.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702878\de\PCID2702878.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702878\ModbusLib.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313669\PCID2313669.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\uninstall.exe | Jump to dropped file |
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe | File created: C:\Users\user\AppData\Local\Temp\rqco3gp6.dll | Jump to dropped file |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | File created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\Firmware\Telit\Xfp1.9.exe | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901540\PCID2901540.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\zh-CHS\PCID2702863.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | File created: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x64\silabser.sys | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\PCID1081818.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\PCID2901541_HG.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | File created: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x64\silabenm.sys | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | File created: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x86\WdfCoInstaller01009.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\ru\PCID2901541.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702184\de\PCID2702184.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\PhoenixResourceManager.dll | Jump to dropped file |
Source: C:\Windows\System32\drvinst.exe | File created: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\silabenm.sys (copy) | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x86\silabenm.sys | Jump to dropped file |
Source: C:\Windows\System32\drvinst.exe | File created: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\SET17E6.tmp | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | File created: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x64\WdfCoInstaller01009.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901540\ModbusLib.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\PCID2313656.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313559\PCID2313559.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\zh-CHS\PCID2313656.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\zh-CHS\PCID2901541.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313449\PCID2313449.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901540\de\PCID2901540.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x86\WdfCoInstaller01009.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x86\silabser.sys | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313449\zh-CHS\PCID2313449.resources.dll | Jump to dropped file |
Source: C:\Windows\System32\drvinst.exe | File created: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\silabser.sys (copy) | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\BugReportGenerator\ICSharpCode.SharpZipLib.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | File created: C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\SET14FA.tmp | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\ModbusLib.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313669\zh-CHS\PCID2313669.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x64\silabser.sys | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x64\silabenm.sys | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\PhoenixResourceManager.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313559\de\PCID2313559.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\de\PCID2901541.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | File created: C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\SET14D9.tmp | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\BugReportGenerator\de\BugReportCreator.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2708517\PCID2708517.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702184\ModbusLib.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x64\WdfCoInstaller01009.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF AutoUpdate.exe | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\de\PSI-CONF.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | File created: C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\SET14EA.tmp | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\de\PCID2313106.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PhoenixResourceManager.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702878\zh-CHS\PCID2702878.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313643\PCID2313643.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\Firmware\Device\psiprog-1.57.exe | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\PCID2702863.dll | Jump to dropped file |
Source: C:\Windows\System32\drvinst.exe | File created: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\SET1845.tmp | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2708517\zh-CHS\PCID2708517.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313643\de\PCID2313643.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313643\zh-CHS\PCID2313643.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\zh-CHS\PCID2313106.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901540\zh-CHS\PCID2901540.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\ru\PCID2702863.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313559\zh-CHS\PCID2313559.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702184\zh-CHS\PCID2702184.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\de\PCID2702863.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\ru\PSI-CONF.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313449\de\PCID2313449.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\PCID2313106.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | File created: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x86\silabenm.sys | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\ModbusLib.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Uninstall\IRZip.lmd | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | File created: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x86\silabser.sys | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\GetActiveProxy.exe | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2904909\ModbusLib.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2904909\PCID2904909.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313643\ICSharpCode.SharpZipLib.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | File created: C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\silabenm.sys (copy) | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\PCID2901541.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2904909\zh-CHS\PCID2904909.resources.dll | Jump to dropped file |
Source: C:\Windows\System32\drvinst.exe | File created: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\SET1865.tmp | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\de\PCID2313656.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | File created: C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\silabser.sys (copy) | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313533\zh-CHS\PCID2313533.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313669\de\PCID2313669.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702184\PCID2702184.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313533\PCID2313533.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\BugReportGenerator\BugReportCreator.exe | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702878\PCID2702878.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313533\de\PCID2313533.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | File created: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\DriverUninstaller.exe | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\zh-CHS\PSI-CONF.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | File created: C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\WdfCoinstaller01009.dll (copy) | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2904909\de\PCID2904909.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\ModbusLib.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\de\PCID1081818.resources.dll | Jump to dropped file |
Source: C:\Windows\System32\drvinst.exe | File created: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\WdfCoinstaller01009.dll (copy) | Jump to dropped file |
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\rundll32.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Windows\System32\rundll32.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Windows\System32\rundll32.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Windows\System32\rundll32.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Windows\System32\conhost.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe | Process information set: NOOPENFILEERRORBOX | |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2708517\de\PCID2708517.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702878\de\PCID2702878.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702878\ModbusLib.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313669\PCID2313669.dll | Jump to dropped file |
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe | Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\rqco3gp6.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\zh-CHS\PCID2702863.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\Firmware\Telit\Xfp1.9.exe | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901540\PCID2901540.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x64\silabser.sys | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\PCID1081818.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\PCID2901541_HG.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x64\silabenm.sys | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x86\WdfCoInstaller01009.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\ru\PCID2901541.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702184\de\PCID2702184.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\PhoenixResourceManager.dll | Jump to dropped file |
Source: C:\Windows\System32\drvinst.exe | Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\silabenm.sys (copy) | Jump to dropped file |
Source: C:\Windows\System32\drvinst.exe | Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\SET17E6.tmp | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x86\silabenm.sys | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x64\WdfCoInstaller01009.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\PCID2313656.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901540\ModbusLib.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313559\PCID2313559.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\zh-CHS\PCID2313656.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\zh-CHS\PCID2901541.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313449\PCID2313449.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901540\de\PCID2901540.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x86\WdfCoInstaller01009.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x86\silabser.sys | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313449\zh-CHS\PCID2313449.resources.dll | Jump to dropped file |
Source: C:\Windows\System32\drvinst.exe | Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\silabser.sys (copy) | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\BugReportGenerator\ICSharpCode.SharpZipLib.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\SET14FA.tmp | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\ModbusLib.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313669\zh-CHS\PCID2313669.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x64\silabser.sys | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x64\silabenm.sys | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\PhoenixResourceManager.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313559\de\PCID2313559.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\de\PCID2901541.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\SET14D9.tmp | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\BugReportGenerator\de\BugReportCreator.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2708517\PCID2708517.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702184\ModbusLib.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF AutoUpdate.exe | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\de\PSI-CONF.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\SET14EA.tmp | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x64\WdfCoInstaller01009.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\de\PCID2313106.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702878\zh-CHS\PCID2702878.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PhoenixResourceManager.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313643\PCID2313643.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\Firmware\Device\psiprog-1.57.exe | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\PCID2702863.dll | Jump to dropped file |
Source: C:\Windows\System32\drvinst.exe | Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\SET1845.tmp | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2708517\zh-CHS\PCID2708517.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313643\de\PCID2313643.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313643\zh-CHS\PCID2313643.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\zh-CHS\PCID2313106.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901540\zh-CHS\PCID2901540.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313559\zh-CHS\PCID2313559.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\ru\PCID2702863.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702184\zh-CHS\PCID2702184.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\de\PCID2702863.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\ru\PSI-CONF.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313449\de\PCID2313449.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\PCID2313106.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x86\silabenm.sys | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\ModbusLib.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Uninstall\IRZip.lmd | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x86\silabser.sys | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\GetActiveProxy.exe | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2904909\ModbusLib.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2904909\PCID2904909.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313643\ICSharpCode.SharpZipLib.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\silabenm.sys (copy) | Jump to dropped file |
Source: C:\Windows\System32\drvinst.exe | Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\SET1865.tmp | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\PCID2901541.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2904909\zh-CHS\PCID2904909.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\de\PCID2313656.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\silabser.sys (copy) | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313533\zh-CHS\PCID2313533.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313669\de\PCID2313669.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702184\PCID2702184.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313533\PCID2313533.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\BugReportGenerator\BugReportCreator.exe | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702878\PCID2702878.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313533\de\PCID2313533.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\DriverUninstaller.exe | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe | Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\WdfCoinstaller01009.dll (copy) | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\zh-CHS\PSI-CONF.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2904909\de\PCID2904909.resources.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\ModbusLib.dll | Jump to dropped file |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\de\PCID1081818.resources.dll | Jump to dropped file |
Source: C:\Windows\System32\drvinst.exe | Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\WdfCoinstaller01009.dll (copy) | Jump to dropped file |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2308880687.000000000059C000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: @SYSTEM:vmci.inf_amd64_68ed49469341f563ommonProgramFiles = "%CommonProgramFiles |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300308294.00000000029E1000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2321398589.00000000027C6000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2275114474.0000000002780000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2322455462.00000000027C6000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: DeviceDesc = "Microsoft Hyper-V SCSI Controller" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2298463203.0000000002781000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: Activation.DeviceDesc = "Microsoft Hyper-V Activation Component" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: AddReg=VmIcShutdown.HW.AddReg |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2275114474.0000000002780000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Hyper-V-NETVS |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2297697663.000000000059C000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: @SYSTEM:vmci.inf_amd64_68ed49469341f563= |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2289335943.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324784219.000000000282D000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2299975086.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2323438455.000000000282C000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2322273255.000000000282C000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2306767874.0000000002780000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: DeviceDesc = "Microsoft Hyper-V Fibre Channel HBA" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2266698107.0000000000565000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: ; ConnectX-4 Hyper-V VF |
Source: irsetup.exe, 00000002.00000003.2510425719.00000000006A4000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\ |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: [VmIcShutdown.NT.HW] |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300142790.0000000000555000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: netvsc_eth.DeviceDesc = "Microsoft Hyper-V Ethernet Network Adapter" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2289335943.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2299975086.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2309945969.00000000027AA000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2275114474.0000000002780000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: Heartbeat.DeviceDesc = "Microsoft Hyper-V Heartbeat" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2289335943.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2299975086.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2301023666.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2275114474.0000000002780000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: Shutdown.DeviceDesc = "Microsoft Hyper-V Guest Shutdown" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2266698107.0000000000565000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: ; ConnectX-4 non Hyper-V VF |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2289874462.00000000029B1000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324727014.00000000027A0000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2292021624.00000000029DC000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2321398589.00000000027C6000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: VMBusHid.DeviceDesc = "Microsoft Hyper-V Input" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2309945969.00000000027AA000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: %VSS.DeviceDesc% = VmIcVss, vmbus\{2450ee40-33bf-4fbd-892e-9fb06e9214cf} |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300142790.0000000000555000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: netvsc_mbb_gsm.DeviceDesc = "Microsoft Hyper-V GSM MBB Network Adapter" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300142790.0000000000555000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: HyperVNetworkAdapterName = "Hyper-V Network Adapter Name" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300142790.0000000000555000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2290813674.00000000027E2000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2282968382.00000000027DB000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: ; Hyper-V Network Adapter Name |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2322425727.0000000000507000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: [VmIcVss.NT] |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2308880687.000000000059C000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: @SYSTEM:vmci.inf_amd64_68ed49469341f563b |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2309686444.00000000027F6000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300308294.00000000029E1000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2316477527.00000000027F5000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2280765136.0000000000525000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2322425727.0000000000507000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: DynMemVsc.DeviceDesc = "Microsoft Hyper-V Dynamic Memory" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: [VmIcHeartbeat.NT] |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2323611546.00000000027B2000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2301023666.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2322455462.00000000027AB000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2309945969.00000000027AA000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: TimeSync.DeviceDesc = "Microsoft Hyper-V Time Synchronization" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2308880687.000000000059C000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: @SYSTEM:vmci.inf_amd64_68ed49469341f563Y |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2323611546.00000000027B2000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2298463203.0000000002781000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2306767874.00000000027DA000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2289335943.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2299975086.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2301023666.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2322455462.00000000027AB000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2309945969.00000000027AA000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: DiskId1 = "Microsoft Hyper-V Integration Components" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2259785251.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2279239071.0000000002831000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: GenericScsiVmLun = "Hyper-V LUN" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2298463203.0000000002781000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2309945969.00000000027AA000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: VSS.DeviceDesc = "Microsoft Hyper-V Volume Shadow Copy" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: [VmIcHeartbeat.NT.HW] |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: AddReg=VmIcHeartbeat.HW.AddReg |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300308294.00000000029E1000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2289874462.00000000029B1000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2292021624.00000000029DC000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: ; Hyper-V Synthetic Video driver. |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2308880687.000000000059C000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: @SYSTEM:vmci.inf_amd64_68ed49469341f563w |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2309945969.00000000027AA000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: AddReg=VmIcVss.HW.AddReg |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2320101206.0000000002B86000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2321656088.0000000002B86000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: c = "Microsoft Hyper-V Activation Component" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2323679118.0000000002802000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2301077541.00000000027F6000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2271536312.0000000000533000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2280765136.0000000000525000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2302146162.00000000027E5000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: ; INF file for installing the Hyper-V crashdump driver. |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2321398589.00000000027C6000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: id.DeviceDesc = "Microsoft Hyper-V Input" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: [VmIcHeartbeat.NT.Services] |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2306767874.00000000027DA000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2289335943.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: GuestInterface.DeviceDesc = "Microsoft Hyper-V Guest Service Interface" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: [VmIcShutdown.HW.AddReg] |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2320101206.0000000002B86000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2321656088.0000000002B86000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{152fbe4b-c7ad-4f68-bada-a4fcc1464f6c}",,0x0,"Microsoft-Windows-Hyper-V-Netvsc" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2280765136.0000000000525000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: F file for installing the Hyper-V crashdump driver. |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2298463203.0000000002781000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2309945969.00000000027AA000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: Rdv.DeviceDesc = "Microsoft Hyper-V Remote Desktop Virtualization" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: %Heartbeat.DeviceDesc% = VmIcHeartbeat, vmbus\{57164f39-9115-4e78-ab55-382f3bd5422d} |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: [VmIcHeartbeat.HW.AddReg] |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: [VmIcShutdown.NT.Services] |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: [VmIcShutdown.NT] |
Source: PSI-CONF_Setup_v2.76.exe, 00000000.00000002.2849725983.00000000006BA000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: _VMware_80n |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300308294.00000000029E1000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2321398589.00000000027C6000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2275114474.0000000002780000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2322455462.00000000027C6000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: DiskId = "Microsoft Hyper-V SCSI Controller Installation Disk #1" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2289874462.00000000029B1000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324727014.00000000027A0000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2292021624.00000000029DC000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2321398589.00000000027C6000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: DiskId1 = "Microsoft Hyper-V Input Installation Disk #1" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2290813674.00000000027E2000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2282968382.00000000027DB000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: HyperVNetworkAdapterName = "Hyper-V Network Adapter N%m |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2289335943.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324784219.000000000282D000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2299975086.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2323438455.000000000282C000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2322273255.000000000282C000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2306767874.0000000002780000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: DeviceDesc_NULL = "Microsoft Hyper-V Fibre Channel HBA (not supported)" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2309945969.00000000027AA000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: [VmIcVss.NT.HW] |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2298463203.0000000002781000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2320101206.0000000002B86000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2321656088.0000000002B86000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: RdpD.DeviceDesc = "Microsoft Hyper-V Remote Desktop Data Channel" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300142790.0000000000555000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2290813674.00000000027E2000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2282968382.00000000027DB000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: netvsc_ppp.DeviceDesc = "Microsoft Hyper-V VPN Network Adapter" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300142790.0000000000555000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2282968382.00000000027DB000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2320101206.0000000002B86000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2321656088.0000000002B86000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{152fbe4b-c7ad-4f68-bada-a4fcc1464f6c}\ChannelReferences\1",,0x0,"Microsoft-Windows-Hyper-V-NETVSC/Diagnostic" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300142790.0000000000555000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: DiskId1 = "Microsoft Hyper-V Network Adapter Installation Disk #1" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2308880687.000000000059C000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: @SYSTEM:vmci.inf_amd64_68ed49469341f563x |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2323679118.0000000002802000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2301077541.00000000027F6000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2271536312.0000000000533000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2280765136.0000000000525000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2302146162.00000000027E5000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: HvCrash.DeviceDesc = "Microsoft Hyper-V Crashdump Driver" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2298463203.0000000002781000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2320101206.0000000002B86000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2321656088.0000000002B86000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: RdpC.DeviceDesc = "Microsoft Hyper-V Remote Desktop Control Channel" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: %Shutdown.DeviceDesc% = VmIcShutdown, vmbus\{b6650ff7-33bc-4840-8048-e0676786f393} |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2301023666.000000000050B000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: Desc = "Microsoft Hyper-V Guest Service Interface" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300142790.0000000000584000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2305972251.0000000002A70000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: ; This is the INF file for installing the Hyper-V S3 Cap driver |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2309945969.00000000027AA000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: [VmIcVss.HW.AddReg] |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2309945969.00000000027AA000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: [VmIcVss.NT.Services] |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324684756.00000000027E3000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: HyperKbd.DeviceDesc = "Microsoft Hyper-V Virtual Keyboard" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300308294.00000000029E1000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2289874462.00000000029B1000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2292021624.00000000029DC000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2321398589.00000000027C6000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2322455462.00000000027C6000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: SynthVid.DeviceDesc = "Microsoft Hyper-V Video" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300142790.0000000000555000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: netvsc.DeviceDesc = "Microsoft Hyper-V Network Adapter" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2275114474.0000000002780000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Hyper-V-NETVSC/Diagnostic","OwningPublisher",0x0,"{152fbe4b-c7ad-4f68-bada-a4fcc1464f6c}" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2297697663.000000000059C000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: @SYSTEM:vmci.inf_amd64_68ed49469341f563 |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Hyper-V-NETVSC/Diagnostic","ChannelAccess",0x0,"O:BAG:SYD:(A;;0x2;;;S-1-15-2-1)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x3;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324684756.00000000027E3000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: ; INF file for installing Hyper-V keyboard driver |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2308880687.000000000059C000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: @SYSTEM:vmci.inf_amd64_68ed49469341f563 |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: HKR, Ndi\Interfaces, FilterMediaTypes,,"ethernet, wlan, ppip, vmnetextension" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2275114474.0000000002780000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Hyper-V-NETVSC/Diagnostic","Isolation",0x00010001,0 |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300308294.00000000029E1000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2289874462.00000000029B1000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2292021624.00000000029DC000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2321398589.00000000027C6000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2322455462.00000000027C6000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: DiskId1 = "Microsoft Hyper-V Video Installation Disk #1" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2289335943.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324784219.000000000282D000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2299975086.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2323438455.000000000282C000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2322273255.000000000282C000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2306767874.0000000002780000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: DiskId = "Microsoft Hyper-V Fibre Channel HBA Installation Disk #1" |
Source: irsetup.exe, 00000002.00000003.2510425719.00000000006A4000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2323679118.0000000002802000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2301077541.00000000027F6000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2271536312.0000000000533000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2280765136.0000000000525000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2302146162.00000000027E5000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: DiskId1 = "Microsoft Hyper-V Crash Dump Installation Disk #1" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2275114474.0000000002780000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Hyper-V-NETVSC/Diagnostic","Enabled",0x00010001,0 |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2323611546.00000000027B2000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2289335943.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2301023666.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2322455462.00000000027AB000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2309945969.00000000027AA000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2275114474.0000000002780000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: KvpExchange.DeviceDesc = "Microsoft Hyper-V Data Exchange" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2320101206.0000000002B86000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2321656088.0000000002B86000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: "SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Hyper-V-NE |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: t Hyper-V Virtual Keyboard" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2309686444.00000000027F6000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300308294.00000000029E1000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2316477527.00000000027F5000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2280765136.0000000000525000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2322425727.0000000000507000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: DiskId1 = "Microsoft Hyper-V Dynamic Memory Installation Disk #1" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324727014.00000000027A0000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: sc = "Microsoft Hyper-V Input" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300142790.0000000000584000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2305972251.0000000002A70000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: S3CapDevice.DeviceDesc = "Microsoft Hyper-V S3 Cap" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300142790.0000000000584000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2305972251.0000000002A70000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: DiskId1 = "Microsoft Hyper-V S3 Cap Installation Disk #1" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300142790.0000000000555000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: netvsc_wifi.DeviceDesc = "Microsoft Hyper-V WiFi Network Adapter" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Hyper-V-NETV |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324684756.00000000027E3000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: DiskId1 = "Microsoft Hyper-V Virtual Keyboard Installation Disk #1" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300142790.0000000000555000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: netvsc_mbb_cdma.DeviceDesc = "Microsoft Hyper-V CDMA MBB Network Adapter" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2298463203.0000000002781000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324727014.0000000002781000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: rrentVersion\WINEVT\Channels\Microsoft-Windows-Hyper-V-NETVS |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2316477527.00000000027F5000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: HKR, Ndi\Interfaces,FilterMediaTypes,,"vmnetextension" |
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Hyper-V-NETVSC/Diagnostic","Type",0x00010001,2 |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Queries volume information: C:\ VolumeInformation | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Queries volume information: C:\ VolumeInformation | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Queries volume information: C:\ VolumeInformation | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Queries volume information: C:\ VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Queries volume information: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\slabvcp.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\drvinst.exe | Queries volume information: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\slabvcp.cat VolumeInformation | Jump to behavior |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\PCID1081818.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\PCID1081818.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\PCID2313106.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\PCID2313106.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313449\PCID2313449.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313449\PCID2313449.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313533\PCID2313533.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313533\PCID2313533.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313559\PCID2313559.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313559\PCID2313559.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313643\PCID2313643.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313643\PCID2313643.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\PCID2313656.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\PCID2313656.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313669\PCID2313669.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313669\PCID2313669.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702184\PCID2702184.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702184\PCID2702184.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\PCID2702863.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\PCID2702863.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702878\PCID2702878.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702878\PCID2702878.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2708517\PCID2708517.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2708517\PCID2708517.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901540\PCID2901540.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\PCID2901541.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\PCID2901541.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2904909\PCID2904909.dll VolumeInformation | |
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe | Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation | |